CIS Amazon Linux 2023 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /tmp Is a Separate Partition may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /tmp
# Should show a dedicated mount

# Via systemd tmp.mount:
systemctl unmask tmp.mount
systemctl enable --now tmp.mount

# Or add to /etc/fstab:
tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0

This recommendation verifies that nodev, nosuid, noexec Options on /tmp on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nodev, nosuid, noexec Options on /tmp may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /tmp | grep -E "nodev|nosuid|noexec"

# In /etc/fstab:
tmpfs /tmp tmpfs defaults,nosuid,nodev,noexec 0 0
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /var Is a Separate Partition may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /var

# Create separate partition at install time or use LVM to add /var

This recommendation verifies that /home Is a Separate Partition on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /home Is a Separate Partition may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /home

# Create /home partition with nosuid, nodev options

This setting controls whether Unused Filesystems is disabled on the Amazon Linux 2023 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Unused Filesystems enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Amazon Linux 2023 operating system.

modprobe -n -v cramfs 2>&1 | grep -E "install|not found"
modprobe -n -v squashfs 2>&1 | grep -E "install|not found"
modprobe -n -v udf 2>&1 | grep -E "install|not found"

# Create /etc/modprobe.d/cis-filesystems.conf:
install cramfs /bin/false
install squashfs /bin/false
install udf /bin/false

blacklist cramfs
blacklist squashfs
blacklist udf

This setting controls whether USB Storage is disabled on the Amazon Linux 2023 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving USB Storage enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Amazon Linux 2023 operating system.

modprobe -n -v usb-storage 2>&1 | grep "install /bin/false"

echo "install usb-storage /bin/false" >> /etc/modprobe.d/cis-usb.conf
echo "blacklist usb-storage" >> /etc/modprobe.d/cis-usb.conf

This setting ensures that core dumps is restricted on the Amazon Linux 2023 operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted core dumps could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Amazon Linux 2023 operating system is essential for defense in depth.

grep -E "^\*.*hard.*core" /etc/security/limits.conf /etc/security/limits.d/*
sysctl fs.suid_dumpable

echo "* hard core 0" >> /etc/security/limits.d/cis-core.conf
echo "fs.suid_dumpable = 0" >> /etc/sysctl.d/cis-core.conf
sysctl -w fs.suid_dumpable=0

xinetd should not be installed on the Amazon Linux 2023 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If xinetd remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

rpm -q xinetd

dnf remove xinetd

Avahi Server should not be installed on the Amazon Linux 2023 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If Avahi Server remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

rpm -q avahi-daemon

systemctl stop avahi-daemon
systemctl disable avahi-daemon
dnf remove avahi

This recommendation verifies that cUPS Is Not Installed Unless Needed on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to cUPS Is Not Installed Unless Needed may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q cups

dnf remove cups

DHCP Server should not be installed on the Amazon Linux 2023 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If DHCP Server remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

rpm -q dhcp-server

dnf remove dhcp-server

This recommendation addresses the proper configuration of chrony on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of chrony can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

rpm -q chrony
systemctl is-enabled chronyd
grep -E "^(server|pool)" /etc/chrony.conf

dnf install chrony
systemctl enable --now chronyd

# In /etc/chrony.conf:
pool 169.254.169.123 iburst  # Amazon Time Sync Service

This recommendation verifies that chrony User Is Non-Root on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to chrony User Is Non-Root may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep "^OPTIONS" /etc/sysconfig/chronyd
# Should contain -u chrony

# In /etc/sysconfig/chronyd:
OPTIONS="-u chrony"

This setting controls whether IP Forwarding is disabled on the Amazon Linux 2023 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Forwarding enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Amazon Linux 2023 operating system.

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding
# Both should be 0

echo "net.ipv4.ip_forward = 0" >> /etc/sysctl.d/cis-network.conf
echo "net.ipv6.conf.all.forwarding = 0" >> /etc/sysctl.d/cis-network.conf
sysctl --system

This recommendation verifies that source Routed Packets Are Rejected on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to source Routed Packets Are Rejected may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route

cat >> /etc/sysctl.d/cis-network.conf << 'EOF'
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
EOF
sysctl --system

This recommendation verifies that iCMP Redirects Are Not Accepted on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iCMP Redirects Are Not Accepted may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects

cat >> /etc/sysctl.d/cis-network.conf << 'EOF'
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
EOF
sysctl --system

This setting controls whether Reverse Path Filtering is enabled on the Amazon Linux 2023 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via system configuration files, sysctl, or systemd settings.

Without Reverse Path Filtering enabled, the Amazon Linux 2023 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filter

echo "net.ipv4.conf.all.rp_filter = 1" >> /etc/sysctl.d/cis-network.conf
echo "net.ipv4.conf.default.rp_filter = 1" >> /etc/sysctl.d/cis-network.conf
sysctl --system

This setting controls whether TCP SYN Cookies is enabled on the Amazon Linux 2023 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via system configuration files, sysctl, or systemd settings.

Without TCP SYN Cookies enabled, the Amazon Linux 2023 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

sysctl net.ipv4.tcp_syncookies

echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.d/cis-network.conf
sysctl --system

This recommendation verifies that nftables Is Installed on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nftables Is Installed may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q nftables

dnf install nftables
systemctl enable --now nftables

This recommendation verifies that default Deny Firewall Policy on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Deny Firewall Policy may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

nft list ruleset | grep -E "policy (accept|drop)"

nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
nft add chain inet filter forward '{ type filter hook forward priority 0; policy drop; }'
nft add chain inet filter output '{ type filter hook output priority 0; policy accept; }'
nft add rule inet filter input iif lo accept
nft add rule inet filter input ct state established,related accept

This recommendation addresses the proper configuration of Loopback Traffic on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Loopback Traffic can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

nft list ruleset | grep "iif lo"

nft add rule inet filter input iif lo accept
nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop

This recommendation addresses the proper configuration of rsyslog or journald on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of rsyslog or journald can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

systemctl is-active rsyslog || systemctl is-active systemd-journald

dnf install rsyslog
systemctl enable --now rsyslog

This recommendation verifies that journald Is Configured for Persistent Storage on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to journald Is Configured for Persistent Storage may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E "^Storage=" /etc/systemd/journald.conf

# In /etc/systemd/journald.conf:
[Journal]
Storage=persistent
Compress=yes
SystemMaxUse=500M

This recommendation addresses the proper configuration of Log File Permissions on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Log File Permissions can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

find /var/log -type f -perm /037 -ls

find /var/log -type f -exec chmod g-wx,o-rwx {} +

This recommendation verifies that auditd Is Installed and Enabled on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to auditd Is Installed and Enabled may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q audit
systemctl is-enabled auditd

dnf install audit
systemctl enable --now auditd

This recommendation addresses the proper configuration of Audit Log Size on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Audit Log Size can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep "^max_log_file " /etc/audit/auditd.conf

# In /etc/audit/auditd.conf:
max_log_file = 256
max_log_file_action = keep_logs
space_left_action = email

This recommendation verifies that events That Modify Date/Time Are Collected on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to events That Modify Date/Time Are Collected may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep time-change

# In /etc/audit/rules.d/cis-time.rules:
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change

This recommendation verifies that events That Modify User/Group Info Are Collected on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to events That Modify User/Group Info Are Collected may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep identity

# In /etc/audit/rules.d/cis-identity.rules:
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

File and directory permissions for sshd_config should be set to Correct. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Amazon Linux 2023 operating system.

Incorrect permissions on sshd_config could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

stat -c "%U:%G %a" /etc/ssh/sshd_config
# Expected: root:root 600

chown root:root /etc/ssh/sshd_config
chmod 600 /etc/ssh/sshd_config

This setting controls whether SSH Root Login is disabled on the Amazon Linux 2023 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH Root Login enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Amazon Linux 2023 operating system.

sshd -T | grep permitrootlogin
# Should be "no"

# In /etc/ssh/sshd_config:
PermitRootLogin no
# Restart: systemctl restart sshd

SSH Protocol 1 has known cryptographic weaknesses. SSH on Amazon Linux 2023 defaults to Protocol 2 but verify explicitly.

Failure to sSH Protocol Is Version 2 may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep protocol

# In /etc/ssh/sshd_config (already default):
Protocol 2

This recommendation verifies that sSH MaxAuthTries Is ≤ 4 on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sSH MaxAuthTries Is ≤ 4 may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep maxauthtries

# In /etc/ssh/sshd_config:
MaxAuthTries 4

This recommendation addresses the proper configuration of SSH Idle Timeout on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of SSH Idle Timeout can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

sshd -T | grep clientaliveinterval
sshd -T | grep clientalivecountmax

# In /etc/ssh/sshd_config:
ClientAliveInterval 300
ClientAliveCountMax 3

This setting controls whether SSH PasswordAuthentication is disabled on the Amazon Linux 2023 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH PasswordAuthentication enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Amazon Linux 2023 operating system.

sshd -T | grep passwordauthentication

# In /etc/ssh/sshd_config:
PasswordAuthentication no

This recommendation addresses the proper configuration of Password Quality Requirements on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Quality Requirements can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E "^(minlen|minclass|dcredit|ucredit|ocredit|lcredit)" /etc/security/pwquality.conf

# In /etc/security/pwquality.conf:
minlen = 14
minclass = 4
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

This recommendation addresses the proper configuration of Password Lockout on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Lockout can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth

# In /etc/security/faillock.conf:
deny = 5
unlock_time = 900
fail_interval = 900

This recommendation verifies that password Hashing Algorithm Is SHA-512 on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Hashing Algorithm Is SHA-512 may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E "^ENCRYPT_METHOD" /etc/login.defs

# In /etc/login.defs:
ENCRYPT_METHOD SHA512

This recommendation verifies that root Account Is the Only UID 0 Account on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to root Account Is the Only UID 0 Account may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print}' /etc/passwd
# Should return only root

# Remove or change UID for any non-root UID 0 accounts

This recommendation verifies that no Accounts Have Empty Passwords on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Accounts Have Empty Passwords may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow

# Set password or lock all accounts with empty passwords:
passwd -l <username>

This recommendation addresses the proper configuration of Shadow Password Suite Parameters on the Amazon Linux 2023 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Shadow Password Suite Parameters can lead to security gaps that may be exploited by attackers. A properly configured Amazon Linux 2023 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E "^PASS_MAX_DAYS|^PASS_MIN_DAYS|^PASS_WARN_AGE" /etc/login.defs

# In /etc/login.defs:
PASS_MAX_DAYS 365
PASS_MIN_DAYS 1
PASS_WARN_AGE 7

This recommendation verifies that default umask Is Restrictive on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default umask Is Restrictive may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E "^UMASK" /etc/login.defs
grep -E "umask" /etc/profile /etc/bashrc

# In /etc/login.defs:
UMASK 027

# In /etc/profile.d/cis-umask.sh:
umask 027

This recommendation verifies that aIDE Is Installed on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aIDE Is Installed may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q aide

dnf install aide
aide --init
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

This recommendation verifies that periodic AIDE Checks Are Scheduled on the Amazon Linux 2023 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to periodic AIDE Checks Are Scheduled may leave the Amazon Linux 2023 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-enabled aidecheck.timer 2>/dev/null || crontab -l | grep aide

# Via cron:
echo "0 5 * * * /usr/sbin/aide --check" | crontab -

# Or via systemd timer:
systemctl enable --now aidecheck.timer

This recommendation verifies that No World-Writable Files is present on the Amazon Linux 2023 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No World-Writable Files leaves the Amazon Linux 2023 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

find / -xdev -type f -perm -0002 -print 2>/dev/null

# Remove world-writable permission:
find / -xdev -type f -perm -0002 -exec chmod o-w {} +

This recommendation verifies that No Unowned or Ungrouped Files is present on the Amazon Linux 2023 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Unowned or Ungrouped Files leaves the Amazon Linux 2023 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

find / -xdev -nouser -print 2>/dev/null
find / -xdev -nogroup -print 2>/dev/null

# Assign appropriate ownership:
find / -xdev -nouser -exec chown root {} +
find / -xdev -nogroup -exec chgrp root {} +