CIS Caddy Benchmark

This recommendation verifies that Caddy is running the latest stable version on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Caddy version
caddy version
# Check running user
ps -eo user,pid,comm | grep caddy

# Install latest Caddy
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
apt-get update && apt-get install caddy
# Ensure dedicated user:
useradd -r -s /usr/sbin/nologin caddy

This setting ensures that Caddyfile permissions are restricted on the Caddy web server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Caddy web server is essential for defense in depth.

# Check Caddyfile permissions
stat -c '%a %U %G' /etc/caddy/Caddyfile
find /etc/caddy -type f -exec stat -c '%a %n' {} \;

# Restrict Caddyfile permissions
chmod 640 /etc/caddy/Caddyfile
chown root:caddy /etc/caddy/Caddyfile
chmod 750 /etc/caddy/
chmod 700 /var/lib/caddy/

This recommendation verifies that automatic HTTPS is properly configured on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify automatic HTTPS is active
caddy validate --config /etc/caddy/Caddyfile
caddy list-modules | grep tls

# Configure automatic HTTPS
# In Caddyfile:
example.com {
    # Caddy automatically provisions TLS
    # Override email for ACME:
    tls admin@example.com
}
# Or use internal CA for dev:
# tls internal

This recommendation verifies that TLS protocols and ciphers are hardened on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration
grep -E 'tls|protocols|ciphers' /etc/caddy/Caddyfile

# Harden TLS settings
# In Caddyfile:
example.com {
    tls {
        protocols tls1.2 tls1.3
        ciphers TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
        curves x25519 secp384r1
    }
}

This recommendation verifies that security headers are configured on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check security headers
grep -E 'header|Strict-Transport|Content-Security|X-Frame' /etc/caddy/Caddyfile

# Configure security headers
# In Caddyfile:
example.com {
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Content-Security-Policy "default-src 'self'"
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }
}

This recommendation verifies that rate limiting is configured on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting
caddy list-modules | grep rate_limit
grep 'rate_limit' /etc/caddy/Caddyfile

# Configure rate limiting
# In Caddyfile:
example.com {
    rate_limit {
        zone static {
            key static
            events 100
            window 1m
        }
    }
}

This recommendation verifies that structured access logging is enabled on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check access logging
grep -E 'log|output|format' /etc/caddy/Caddyfile

# Configure access logging
# In Caddyfile:
example.com {
    log {
        output file /var/log/caddy/access.log {
            roll_size 100mb
            roll_keep 10
            roll_keep_for 720h
        }
        format json
        level INFO
    }
}

This recommendation verifies that custom error pages prevent information disclosure on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check error handling
grep -E 'handle_errors|error' /etc/caddy/Caddyfile

# Configure error pages (prevent info disclosure)
# In Caddyfile:
example.com {
    handle_errors {
        respond "{err.status_code} {err.status_text}"
    }
}

This recommendation verifies that reverse proxy upstream uses TLS with header controls on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check reverse proxy configuration
grep -E 'reverse_proxy|upstream' /etc/caddy/Caddyfile

# Harden reverse proxy
# In Caddyfile:
example.com {
    reverse_proxy backend:8080 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Real-IP {remote_host}
        header_down -Server
        transport http {
            tls_insecure_skip_verify false
        }
    }
}

This recommendation verifies that authentication is configured for sensitive paths on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check basic auth configuration
grep -E 'basicauth|forward_auth' /etc/caddy/Caddyfile

# Configure authentication
# In Caddyfile:
example.com {
    basicauth /admin/* {
        admin $2a$14$... # bcrypt hash
    }
}
# Generate hash:
caddy hash-password --plaintext 'strongpassword'

This recommendation verifies that admin API is disabled or restricted to localhost on the Caddy web server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Caddy web server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check admin API endpoint
grep -E 'admin|api' /etc/caddy/Caddyfile
caddy environ | grep CADDY_ADMIN

# Restrict admin API
# In Caddyfile global options:
{
    admin off
    # Or restrict to localhost:
    # admin localhost:2019
}

This recommendation verifies that file server hides sensitive files and disables browsing on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check file server settings
grep -E 'file_server|browse' /etc/caddy/Caddyfile

# Restrict file server
# In Caddyfile:
example.com {
    file_server {
        # Do NOT enable browse in production
        hide .git .env .htaccess
    }
    # Block dotfiles:
    @dotfiles path */.* */.*/*
    respond @dotfiles 403
}

This recommendation verifies that configuration is validated before reload on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Caddy config
caddy validate --config /etc/caddy/Caddyfile
caddy fmt --diff /etc/caddy/Caddyfile

# Validate and format config
caddy validate --config /etc/caddy/Caddyfile
caddy fmt --overwrite /etc/caddy/Caddyfile
# Reload without downtime:
caddy reload --config /etc/caddy/Caddyfile

This recommendation verifies that ACME certificate storage is protected on the Caddy web server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Caddy web server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ACME certificate storage
ls -la /var/lib/caddy/.local/share/caddy/
stat -c '%a %U %G' /var/lib/caddy/.local/share/caddy/

# Protect certificate storage
chmod 700 /var/lib/caddy/.local/share/caddy/
chown caddy:caddy /var/lib/caddy/.local/share/caddy/
# Configure ACME CA:
# In Caddyfile global options:
# {
#     acme_ca https://acme-v02.api.letsencrypt.org/directory
# }