CIS Apache CouchDB 3 Benchmark

This recommendation verifies that CouchDB Is Installed from Official Repositories on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that CouchDB Is Installed from Official Repositories:

audit_check_repositories

Apply the following configuration to ensure CouchDB Is Installed from Official Repositories:

remediate_repositories

This recommendation verifies that CouchDB Runs Under a Dedicated User on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that CouchDB Runs Under a Dedicated User:

audit_check_user

Apply the following configuration to ensure CouchDB Runs Under a Dedicated User:

remediate_user

This recommendation verifies that Latest Stable Version Is Installed on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Latest Stable Version Is Installed:

audit_check_installed

Apply the following configuration to ensure Latest Stable Version Is Installed:

remediate_installed

This setting ensures that Configuration File Permissions Are Restricted on the Apache CouchDB 3 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache CouchDB 3 database server is essential for defense in depth.

Run the following command and verify that Configuration File Permissions Are Restricted:

audit_check_restricted

Apply the following configuration to ensure Configuration File Permissions Are Restricted:

remediate_restricted

This setting ensures that Data Directory Permissions Are Restricted on the Apache CouchDB 3 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache CouchDB 3 database server is essential for defense in depth.

Run the following command and verify that Data Directory Permissions Are Restricted:

audit_check_restricted

Apply the following configuration to ensure Data Directory Permissions Are Restricted:

remediate_restricted

This recommendation verifies that Bind Address Is Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Bind Address Is Configured:

audit_check_configured

Apply the following configuration to ensure Bind Address Is Configured:

remediate_configured

This recommendation verifies that Admin Party Mode Is Disabled on the Apache CouchDB 3 database server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Apache CouchDB 3 database server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Admin Party Mode Is Disabled:

audit_check_disabled

Apply the following configuration to ensure Admin Party Mode Is Disabled:

remediate_disabled

This recommendation verifies that Server Admins Are Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Server Admins Are Configured:

audit_check_configured

Apply the following configuration to ensure Server Admins Are Configured:

remediate_configured

This recommendation verifies that Password Hashing Uses PBKDF2 on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Hashing Uses PBKDF2:

audit_check_pbkdf2

Apply the following configuration to ensure Password Hashing Uses PBKDF2:

remediate_pbkdf2

This recommendation verifies that Cookie Authentication Timeout Is Set on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Cookie Authentication Timeout Is Set:

audit_check_set

Apply the following configuration to ensure Cookie Authentication Timeout Is Set:

remediate_set

This recommendation verifies that Database Security Objects Are Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Database Security Objects Are Configured:

audit_check_configured

Apply the following configuration to ensure Database Security Objects Are Configured:

remediate_configured

This recommendation verifies that _users Database Is Protected on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that _users Database Is Protected:

audit_check_protected

Apply the following configuration to ensure _users Database Is Protected:

remediate_protected

This recommendation verifies that Design Document Validation Is Enabled on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Design Document Validation Is Enabled:

audit_check_enabled

Apply the following configuration to ensure Design Document Validation Is Enabled:

remediate_enabled

This recommendation verifies that CouchDB Listens Only on Intended Interfaces on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that CouchDB Listens Only on Intended Interfaces:

audit_check_interfaces

Apply the following configuration to ensure CouchDB Listens Only on Intended Interfaces:

remediate_interfaces

This recommendation verifies that Default Port Is Changed on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Default Port Is Changed:

audit_check_changed

Apply the following configuration to ensure Default Port Is Changed:

remediate_changed

This recommendation verifies that CORS Is Properly Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that CORS Is Properly Configured:

audit_check_configured

Apply the following configuration to ensure CORS Is Properly Configured:

remediate_configured

This recommendation verifies that Host-Level Firewall Restricts CouchDB Ports on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Host-Level Firewall Restricts CouchDB Ports:

audit_check_ports

Apply the following configuration to ensure Host-Level Firewall Restricts CouchDB Ports:

remediate_ports

This setting ensures that Futon/Fauxton Admin UI Access Is Restricted on the Apache CouchDB 3 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache CouchDB 3 database server is essential for defense in depth.

Run the following command and verify that Futon/Fauxton Admin UI Access Is Restricted:

audit_check_restricted

Apply the following configuration to ensure Futon/Fauxton Admin UI Access Is Restricted:

remediate_restricted

This recommendation verifies that Reverse Proxy Is Used for Public Access on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Reverse Proxy Is Used for Public Access:

audit_check_access

Apply the following configuration to ensure Reverse Proxy Is Used for Public Access:

remediate_access

This recommendation verifies that TLS Is Enabled for Client Connections on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that TLS Is Enabled for Client Connections:

audit_check_connections

Apply the following configuration to ensure TLS Is Enabled for Client Connections:

remediate_connections

This recommendation verifies that TLS 1.2 Is the Minimum Version on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that TLS 1.2 Is the Minimum Version:

audit_check_version

Apply the following configuration to ensure TLS 1.2 Is the Minimum Version:

remediate_version

This recommendation verifies that Strong Cipher Suites Are Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Strong Cipher Suites Are Configured:

audit_check_configured

Apply the following configuration to ensure Strong Cipher Suites Are Configured:

remediate_configured

This recommendation verifies that Encryption at Rest Is Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Encryption at Rest Is Configured:

audit_check_configured

Apply the following configuration to ensure Encryption at Rest Is Configured:

remediate_configured

This recommendation verifies that Sensitive Data in Documents Is Encrypted on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Sensitive Data in Documents Is Encrypted:

audit_check_encrypted

Apply the following configuration to ensure Sensitive Data in Documents Is Encrypted:

remediate_encrypted

This recommendation verifies that Logging Level Is Set to Info or Higher on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Logging Level Is Set to Info or Higher:

audit_check_higher

Apply the following configuration to ensure Logging Level Is Set to Info or Higher:

remediate_higher

This recommendation verifies that Log File Rotation Is Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Log File Rotation Is Configured:

audit_check_configured

Apply the following configuration to ensure Log File Rotation Is Configured:

remediate_configured

This recommendation verifies that Access Logs Are Enabled on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Access Logs Are Enabled:

audit_check_enabled

Apply the following configuration to ensure Access Logs Are Enabled:

remediate_enabled

This recommendation verifies that _stats Endpoint Is Monitored on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that _stats Endpoint Is Monitored:

audit_check_monitored

Apply the following configuration to ensure _stats Endpoint Is Monitored:

remediate_monitored

This recommendation verifies that Health Checks Are Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Health Checks Are Configured:

audit_check_configured

Apply the following configuration to ensure Health Checks Are Configured:

remediate_configured

This recommendation verifies that Disk Space Monitoring Is Configured on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Disk Space Monitoring Is Configured:

audit_check_configured

Apply the following configuration to ensure Disk Space Monitoring Is Configured:

remediate_configured

This recommendation verifies that Replication Uses TLS on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Replication Uses TLS:

audit_check_tls

Apply the following configuration to ensure Replication Uses TLS:

remediate_tls

This recommendation verifies that Replication Credentials Are Protected on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Replication Credentials Are Protected:

audit_check_protected

Apply the following configuration to ensure Replication Credentials Are Protected:

remediate_protected

This recommendation verifies that Continuous Replication Is Monitored on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Continuous Replication Is Monitored:

audit_check_monitored

Apply the following configuration to ensure Continuous Replication Is Monitored:

remediate_monitored

This recommendation verifies that Erlang Cookie Is Changed from Default on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Erlang Cookie Is Changed from Default:

audit_check_default

Apply the following configuration to ensure Erlang Cookie Is Changed from Default:

remediate_default

This recommendation verifies that Cluster Communication Is Encrypted on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Cluster Communication Is Encrypted:

audit_check_encrypted

Apply the following configuration to ensure Cluster Communication Is Encrypted:

remediate_encrypted

This recommendation verifies that Node Membership Is Verified on the Apache CouchDB 3 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache CouchDB 3 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Node Membership Is Verified:

audit_check_verified

Apply the following configuration to ensure Node Membership Is Verified:

remediate_verified