CIS Amazon Linux 2 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp
systemctl is-enabled tmp.mount

systemctl unmask tmp.mount
systemctl enable --now tmp.mount

# Or add to /etc/fstab:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec 0 0

This recommendation verifies that nodev Option Is Set on /tmp on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nodev

# Add nodev to /tmp mount options in /etc/fstab
mount -o remount /tmp

This recommendation verifies that nosuid Option Is Set on /tmp on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nosuid

# Add nosuid to /tmp mount options in /etc/fstab
mount -o remount /tmp

This recommendation verifies that noexec Option Is Set on /tmp on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep noexec

# Add noexec to /tmp mount options in /etc/fstab
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var
# Verify /var is a separate partition

# Partition /var at install time. For existing systems:
lvcreate -L 10G -n var_lv amz_vg
mkfs.xfs /dev/amz_vg/var_lv
# Update /etc/fstab

This recommendation verifies that /home Is a Separate Partition on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /home
# Verify /home is a separate partition
findmnt --kernel /home | grep nodev

# Partition /home at install time
# Add nodev to mount options in /etc/fstab:
# /dev/amz_vg/home_lv /home xfs defaults,nodev 0 0

This recommendation verifies that GPG Check Is Enabled for All Repos on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -r 'gpgcheck' /etc/yum.repos.d/
yum repolist
# Verify gpgcheck=1 for all repos

sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.repos.d/*.repo

# Also ensure in /etc/yum.conf:
sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/yum.conf

This recommendation verifies that Security Updates Are Applied on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

yum check-update --security 2>/dev/null
# Review pending security updates

yum update -y --security
# Or full update:
yum update -y

This recommendation verifies that Automatic Updates Are Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-enabled yum-cron
grep 'apply_updates' /etc/yum/yum-cron.conf

yum install -y yum-cron
sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/yum/yum-cron.conf
systemctl enable --now yum-cron

This recommendation verifies that Avahi Server Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active avahi-daemon
systemctl is-enabled avahi-daemon

systemctl stop avahi-daemon
systemctl disable avahi-daemon
yum remove -y avahi

This recommendation verifies that CUPS Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active cups
systemctl is-enabled cups

systemctl stop cups
systemctl disable cups
yum remove -y cups

This recommendation verifies that NFS Is Disabled Unless Required on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active nfs-server
systemctl is-enabled nfs-server
rpm -q nfs-utils

systemctl stop nfs-server
systemctl disable nfs-server
systemctl mask nfs-server

This recommendation verifies that rpcbind Is Disabled Unless Required on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active rpcbind
systemctl is-enabled rpcbind
rpm -q rpcbind

systemctl stop rpcbind
systemctl disable rpcbind
systemctl mask rpcbind

This recommendation verifies that SNMP Server Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active snmpd
systemctl is-enabled snmpd

systemctl stop snmpd
systemctl disable snmpd
yum remove -y net-snmp

This recommendation verifies that telnet Client Is Not Installed on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q telnet
# Should return: package telnet is not installed

yum remove -y telnet

This recommendation verifies that rsh Client Is Not Installed on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q rsh
# Should return: package rsh is not installed

yum remove -y rsh

This recommendation verifies that NIS Client Is Not Installed on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

rpm -q ypbind
# Should return: package ypbind is not installed

yum remove -y ypbind

This recommendation verifies that IP Forwarding Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.ip_forward
# Should return 0
sysctl net.ipv6.conf.all.forwarding
# Should return 0

echo 'net.ipv4.ip_forward = 0' > /etc/sysctl.d/60-disable-forward.conf
echo 'net.ipv6.conf.all.forwarding = 0' >> /etc/sysctl.d/60-disable-forward.conf
sysctl --system

This recommendation verifies that Packet Redirect Sending Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.conf.all.send_redirects
sysctl net.ipv4.conf.default.send_redirects
# Both should return 0

echo 'net.ipv4.conf.all.send_redirects = 0' >> /etc/sysctl.d/60-disable-forward.conf
echo 'net.ipv4.conf.default.send_redirects = 0' >> /etc/sysctl.d/60-disable-forward.conf
sysctl --system

This recommendation verifies that ICMP Redirects Are Not Accepted on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects

echo 'net.ipv4.conf.all.accept_redirects = 0' >> /etc/sysctl.d/60-netipv4.conf
echo 'net.ipv4.conf.default.accept_redirects = 0' >> /etc/sysctl.d/60-netipv4.conf
sysctl --system

This recommendation verifies that Suspicious Packets Are Logged on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.log_martians
sysctl net.ipv4.conf.default.log_martians
# Both should return 1

echo 'net.ipv4.conf.all.log_martians = 1' >> /etc/sysctl.d/60-netipv4.conf
echo 'net.ipv4.conf.default.log_martians = 1' >> /etc/sysctl.d/60-netipv4.conf
sysctl --system

This recommendation verifies that iptables Is Installed and Running on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q iptables
iptables -L -n --line-numbers
ip6tables -L -n --line-numbers

yum install -y iptables-services
systemctl enable --now iptables
systemctl enable --now ip6tables

This recommendation verifies that Default Deny Policy Is Set on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

iptables -L INPUT -n | head -3
# Verify default INPUT policy is DROP or REJECT
iptables -L FORWARD -n | head -3
# Verify FORWARD is DROP

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
service iptables save

This recommendation verifies that Loopback and Established Connections Are Allowed on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

iptables -L INPUT -n | grep 'state ESTABLISHED'
# Verify established connections are allowed

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
service iptables save

This recommendation verifies that Unnecessary Rules Are Removed on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

iptables -L INPUT -n | grep -v 'DROP\|ACCEPT\|REJECT\|Chain\|target'
# Review any unexpected rules

# Remove unnecessary rules:
iptables -D INPUT <rule_number>
service iptables save

This recommendation verifies that auditd Is Installed and Enabled on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q audit
systemctl is-enabled auditd
systemctl is-active auditd

yum install -y audit
systemctl enable --now auditd

This recommendation verifies that Audit Log Size Is Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^max_log_file\b' /etc/audit/auditd.conf
grep 'max_log_file_action' /etc/audit/auditd.conf

sed -i 's/^max_log_file\b.*/max_log_file = 8/' /etc/audit/auditd.conf
sed -i 's/^max_log_file_action.*/max_log_file_action = keep_logs/' /etc/audit/auditd.conf
service auditd restart

This recommendation verifies that Identity Changes Are Audited on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'passwd|shadow|group|gshadow|opasswd'
grep identity /etc/audit/rules.d/*.rules

cat >> /etc/audit/rules.d/50-identity.rules << 'EOF'
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
EOF
augenrules --load

This recommendation verifies that Sudoers Changes Are Audited on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep scope
grep scope /etc/audit/rules.d/*.rules

cat >> /etc/audit/rules.d/50-scope.rules << 'EOF'
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope
EOF
augenrules --load

This recommendation verifies that rsyslog Is Installed on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q rsyslog
systemctl is-enabled rsyslog

yum install -y rsyslog
systemctl enable --now rsyslog

This recommendation verifies that Remote Logging Is Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\*\.\*\s+@@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null

echo '*.* @@loghost.example.com:514' > /etc/rsyslog.d/50-remote.conf
systemctl restart rsyslog

This recommendation verifies that Log File Permissions Are Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find /var/log -type f -perm /037 -ls
stat -c '%a %U %G' /var/log/messages /var/log/secure

chmod 640 /var/log/messages
chmod 640 /var/log/secure
find /var/log -type f -perm /037 -exec chmod 640 {} \;

This recommendation verifies that SSH Root Login Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitrootlogin
# Should return: permitrootlogin no

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the Amazon Linux 2 Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Amazon Linux 2 Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitemptypasswords
# Should return: permitemptypasswords no

sed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH MaxAuthTries Is 4 or Less on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep maxauthtries
# Should return: maxauthtries 4 or less

sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Idle Timeout Is Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep -E 'clientaliveinterval|clientalivecountmax'

sed -i 's/^#\?ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config
sed -i 's/^#\?ClientAliveCountMax.*/ClientAliveCountMax 3/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Banner Is Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep banner
# Should return: banner /etc/issue.net

sed -i 's/^#\?Banner.*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation ensures that Password Creation Requirements Are Configured on the Amazon Linux 2 Linux operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Amazon Linux 2 Linux operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

grep -E '^\s*minlen|dcredit|ucredit|ocredit|lcredit' /etc/security/pwquality.conf

sed -i 's/^#\? *minlen.*/minlen = 14/' /etc/security/pwquality.conf
sed -i 's/^#\? *dcredit.*/dcredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ucredit.*/ucredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ocredit.*/ocredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *lcredit.*/lcredit = -1/' /etc/security/pwquality.conf

This setting ensures that Password Reuse Is Limited on the Amazon Linux 2 Linux operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon Linux 2 Linux operating system is essential for defense in depth.

grep -E 'pam_pwhistory|remember' /etc/pam.d/system-auth

# In /etc/pam.d/system-auth, add or update:
# password requisite pam_pwhistory.so use_authtok remember=5 retry=3
sed -i '/pam_unix.so/i password    requisite     pam_pwhistory.so use_authtok remember=5 retry=3' /etc/pam.d/system-auth

This recommendation verifies that Account Lockout Is Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
grep -E '^deny|^unlock_time' /etc/security/faillock.conf 2>/dev/null

# Configure /etc/security/faillock.conf:
echo 'deny = 5' >> /etc/security/faillock.conf
echo 'unlock_time = 900' >> /etc/security/faillock.conf
echo 'fail_interval = 900' >> /etc/security/faillock.conf

# Update PAM to use faillock:
authconfig --enablefaillock --update

This recommendation verifies that Permissions on /etc/passwd Are Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/passwd
# Should return: 644 root root

chmod 644 /etc/passwd
chown root:root /etc/passwd

This recommendation verifies that Permissions on /etc/shadow Are Configured on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/shadow
# Should return: 0 root root

chmod 0000 /etc/shadow
chown root:root /etc/shadow

This recommendation verifies that No World-Writable Files Exist on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Should return empty — no world-writable files

find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

This recommendation verifies that No Accounts Have Empty Passwords on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow
# Should return empty

awk -F: '($2 == "") {print $1}' /etc/shadow | while read user; do
  passwd -l "$user"
done

This recommendation verifies that Root Is the Only UID 0 Account on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print $1}' /etc/passwd
# Should return only: root

usermod -u <new_uid> <non_root_uid0_user>

This recommendation verifies that All Users Home Directories Exist on the Amazon Linux 2 Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Amazon Linux 2 Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($1 !~ /^(root|halt|sync|shutdown)$/ && $7 != "/sbin/nologin" && $7 != "/bin/false") {print $1":"$6}' /etc/passwd | \
  while IFS=: read user dir; do [ ! -d "$dir" ] && echo "Missing: $user -> $dir"; done

mkhomedir_helper <username>
# Or:
mkdir -p /home/<username>
chown <username>:<group> /home/<username>
chmod 750 /home/<username>