CIS Cumulus Linux Benchmark

This recommendation verifies that local accounts use SSH keys and root login is disabled on the Cumulus Linux network operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Cumulus Linux network operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check user accounts:
nv show system aaa user
cat /etc/passwd | grep -v nologin | grep -v false

# Check sudo configuration:
nv show system aaa role

# Configure secure user accounts:
# Remove default cumulus user password, use SSH keys only:
passwd -l cumulus

# Create named admin accounts:
nv set system aaa user netadmin role system-admin
nv set system aaa user netadmin ssh-authorized-key key1 \
  type ssh-ed25519 \
  key 'AAAAC3NzaC1lZDI1NTE5AAAAI...'

# Restrict SSH access:
nv set system ssh-server allow-users netadmin
nv set system ssh-server permit-root-login no
nv set system ssh-server password-authentication disabled
nv config apply

This recommendation verifies that TACACS+ or RADIUS authentication is configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TACACS+ or RADIUS:
nv show system aaa tacacs
nv show system aaa radius

# Check PAM configuration:
grep -r tacplus /etc/pam.d/ 2>/dev/null

# Configure TACACS+ authentication:
nv set system aaa tacacs server 10.0.0.100 port 49
nv set system aaa tacacs server 10.0.0.100 secret TACACS_SECRET
nv set system aaa tacacs server 10.0.0.101 port 49
nv set system aaa tacacs server 10.0.0.101 secret TACACS_SECRET
nv set system aaa tacacs authentication-type chap
nv set system aaa tacacs timeout 5
nv config apply

# Alternatively, configure RADIUS:
nv set system aaa radius server 10.0.0.100 port 1812
nv set system aaa radius server 10.0.0.100 secret RADIUS_SECRET
nv config apply

This recommendation verifies that ingress ACLs restrict management access on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check ACL configuration:
nv show acl
nv show interface swp1 acl

# Check iptables rules:
sudo iptables -L -n --line-numbers
sudo ip6tables -L -n --line-numbers

# Configure ingress ACLs:
nv set acl MGMT_ACL rule 10 match ip protocol tcp
nv set acl MGMT_ACL rule 10 match ip dest-port 22
nv set acl MGMT_ACL rule 10 match ip source-ip 10.0.0.0/24
nv set acl MGMT_ACL rule 10 action permit

nv set acl MGMT_ACL rule 20 match ip protocol tcp
nv set acl MGMT_ACL rule 20 match ip dest-port 443
nv set acl MGMT_ACL rule 20 match ip source-ip 10.0.0.0/24
nv set acl MGMT_ACL rule 20 action permit

nv set acl MGMT_ACL rule 999 action deny

# Apply to management interface:
nv set interface eth0 acl MGMT_ACL inbound
nv config apply

This recommendation verifies that control plane policing rate limits are configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check control plane policing:
nv show system control-plane
sudo cl-acltool -L | head -30

# Check rate limiting:
nv show system control-plane policer

# Configure control plane policing:
nv set system control-plane policer ssh burst 100
nv set system control-plane policer ssh rate 100

nv set system control-plane policer snmp burst 100
nv set system control-plane policer snmp rate 100

nv set system control-plane policer ntp burst 100
nv set system control-plane policer ntp rate 200

nv set system control-plane policer dhcp burst 100
nv set system control-plane policer dhcp rate 200

# Restrict ICMP rate:
nv set system control-plane policer icmp burst 50
nv set system control-plane policer icmp rate 100

nv config apply

This recommendation verifies that management VRF is enabled for out-of-band access on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check management VRF:
nv show vrf mgmt
ip vrf show

# Check management interface:
nv show interface eth0

# Enable management VRF:
nv set vrf mgmt
nv set interface eth0 ip vrf mgmt
nv set interface eth0 ip address 10.0.0.1/24
nv set vrf mgmt router static 0.0.0.0/0 via 10.0.0.254

# Ensure services bind to mgmt VRF:
nv set system ssh-server vrf mgmt
nv set service ntp mgmt server 10.0.0.10 iburst on
nv set service syslog mgmt server 10.0.0.20 port 514 protocol udp

nv config apply

This recommendation verifies that SNMPv3 is used with community strings removed on the Cumulus Linux network operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Cumulus Linux network operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check SNMP configuration:
nv show service snmp-server
nv show service snmp-server community

# Check SNMPv3:
nv show service snmp-server username

# Configure SNMPv3 (disable v1/v2c):
# Remove insecure community strings:
nv unset service snmp-server community public
nv unset service snmp-server community private

# Add SNMPv3 user:
nv set service snmp-server username snmpuser \
  auth-type sha auth-password AUTH_PASS \
  encrypt-type aes encrypt-password PRIV_PASS

# Restrict SNMP listening:
nv set service snmp-server listening-address 10.0.0.1 vrf mgmt

# Set system contact and location:
nv set service snmp-server system-contact 'noc@example.com'
nv set service snmp-server system-location 'DC1-Rack-A01'

nv config apply

This recommendation verifies that remote syslog with TCP transport is configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
nv show service syslog

# Check local logging:
ls -la /var/log/syslog*
grep -r 'server' /etc/rsyslog.d/

# Configure remote syslog:
nv set service syslog mgmt server 10.0.0.20 port 514 protocol tcp
nv set service syslog mgmt server 10.0.0.21 port 514 protocol tcp

# Configure log rotation:
cat > /etc/logrotate.d/cumulus << 'EOF'
/var/log/syslog {
    rotate 30
    daily
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}
EOF

nv config apply

This recommendation verifies that NTP with authentication and redundant sources is configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NTP configuration:
nv show service ntp
nv show service ntp server

# Verify NTP status:
sudo ntpq -p

# Configure NTP with authentication:
nv set service ntp mgmt server 10.0.0.10 iburst on
nv set service ntp mgmt server 10.0.0.11 iburst on

# Use NTP authentication:
nv set service ntp mgmt authentication-enable on
nv set service ntp mgmt trusted-key 1
nv set service ntp mgmt server 10.0.0.10 key 1

# Set timezone:
nv set system timezone America/New_York

nv config apply

# Verify synchronization:
ntpstat

This recommendation verifies that BPDU guard and root guard are configured on access ports on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check spanning tree:
nv show bridge domain br_default stp

# Check BPDU guard:
nv show interface swp1 bridge domain br_default stp

# Configure STP security:
nv set bridge domain br_default stp mode rstp
nv set bridge domain br_default stp priority 4096

# Enable BPDU guard on access ports:
for swp in swp1 swp2 swp3 swp4; do
  nv set interface $swp bridge domain br_default stp bpdu-guard on
  nv set interface $swp bridge domain br_default stp admin-edge on
done

# Configure root guard on trunk ports:
for swp in swp49 swp50; do
  nv set interface $swp bridge domain br_default stp root-guard on
done

nv config apply

This recommendation verifies that storm control and unused port shutdown are configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check port security:
nv show interface swp1 bridge domain br_default mac-filter

# Check storm control:
nv show interface swp1 link storm-control 2>/dev/null

# Configure port security:
# MAC address limiting:
nv set interface swp1 bridge domain br_default learning on
nv set interface swp1 bridge domain br_default mac-filter \
  aa:bb:cc:dd:ee:01 action allow

# Configure storm control:
nv set interface swp1 link storm-control broadcast level 10
nv set interface swp1 link storm-control multicast level 10
nv set interface swp1 link storm-control unknown-unicast level 10

# Disable unused ports:
for swp in swp10 swp11 swp12; do
  nv set interface $swp link state down
done

nv config apply

This recommendation verifies that BGP and OSPF use MD5 authentication with prefix limits on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check BGP authentication:
nv show router bgp neighbor
nv show vrf default router bgp neighbor 10.0.1.1

# Check OSPF authentication:
nv show interface swp1 router ospf authentication

# Configure BGP with MD5 authentication:
nv set vrf default router bgp neighbor 10.0.1.1 password BGP_SECRET
nv set vrf default router bgp neighbor 10.0.1.1 type external
nv set vrf default router bgp neighbor 10.0.1.1 remote-as 65002

# Configure BGP prefix limits:
nv set vrf default router bgp neighbor 10.0.1.1 \
  address-family ipv4-unicast prefix-limits inbound maximum 1000
nv set vrf default router bgp neighbor 10.0.1.1 \
  address-family ipv4-unicast prefix-limits inbound warning-threshold 80

# Configure OSPF authentication:
nv set interface swp1 router ospf authentication \
  type message-digest
nv set interface swp1 router ospf authentication \
  message-digest-key 1 md5-key OSPF_SECRET

nv config apply

This recommendation verifies that inbound route filtering blocks RFC 1918 and bogon prefixes on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check route filtering:
nv show router policy prefix-list
nv show router policy route-map

# Check community lists:
nv show router policy community-list

# Configure route filtering:
# Create prefix lists:
nv set router policy prefix-list ALLOW_DEFAULT rule 10 \
  match 0.0.0.0/0 max-prefix-len 0
nv set router policy prefix-list ALLOW_DEFAULT rule 10 action permit

nv set router policy prefix-list DENY_RFC1918 rule 10 \
  match 10.0.0.0/8 max-prefix-len 32
nv set router policy prefix-list DENY_RFC1918 rule 10 action deny
nv set router policy prefix-list DENY_RFC1918 rule 20 \
  match 172.16.0.0/12 max-prefix-len 32
nv set router policy prefix-list DENY_RFC1918 rule 20 action deny

# Apply via route map:
nv set router policy route-map INBOUND rule 10 \
  match ip-prefix-list DENY_RFC1918
nv set router policy route-map INBOUND rule 10 action deny
nv set router policy route-map INBOUND rule 999 action permit

nv set vrf default router bgp neighbor 10.0.1.1 \
  address-family ipv4-unicast policy inbound route-map INBOUND

nv config apply

This recommendation verifies that automated NVUE configuration backups are configured on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check configuration backup:
nv config diff
nv config history

# Check NVUE snapshots:
ls /etc/nvue.d/startup.yaml

# Configure automated configuration backup:
cat > /etc/cron.d/config-backup << 'EOF'
0 */4 * * * root nv config save && \
  cp /etc/nvue.d/startup.yaml \
  /var/backups/nvue-$(date +\%Y\%m\%d-\%H\%M).yaml
find /var/backups/nvue-*.yaml -mtime +30 -delete
EOF

mkdir -p /var/backups

# Export configuration:
nv config save
nv config diff empty applied > /var/backups/full-config.yaml

# Copy to remote backup:
scp /var/backups/full-config.yaml backup@10.0.0.100:/backups/

This recommendation verifies that Cumulus Linux firmware is kept up to date on the Cumulus Linux network operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Cumulus Linux network operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firmware version:
nv show platform firmware
cat /etc/os-release

# Check for available updates:
apt list --upgradable 2>/dev/null | head

# Update Cumulus Linux:
# Backup configuration first:
nv config save
cp /etc/nvue.d/startup.yaml /var/backups/pre-upgrade.yaml

# Install update image:
sudo onie-install -a -i http://repo.example.com/cumulus-linux-5.x.bin

# For package updates:
sudo apt-get update
sudo apt-get upgrade -y

# Verify after update:
nv show platform firmware
nv show system
ifreload -a
nv config apply