CIS Debian Linux 11 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that nodev Option Set on /tmp on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nodev Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nodev Option Set on /tmp:

remediate_/tmp

This recommendation verifies that nosuid Option Set on /tmp on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nosuid Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure nosuid Option Set on /tmp:

remediate_/tmp

This recommendation verifies that noexec Option Set on /tmp on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that noexec Option Set on /tmp:

audit_check_/tmp

Apply the following configuration to ensure noexec Option Set on /tmp:

remediate_/tmp

This recommendation verifies that /var Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/tmp Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/tmp Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/tmp Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/log Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/log Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/log Is a Separate Partition:

remediate_partition

This recommendation verifies that /var/log/audit Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /var/log/audit Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /var/log/audit Is a Separate Partition:

remediate_partition

This recommendation verifies that /home Is a Separate Partition on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that /home Is a Separate Partition:

audit_check_partition

Apply the following configuration to ensure /home Is a Separate Partition:

remediate_partition

This recommendation verifies that Package Manager Repositories Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Package Manager Repositories Are Configured:

audit_check_configured

Apply the following configuration to ensure Package Manager Repositories Are Configured:

remediate_configured

This recommendation verifies that GPG Keys Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that GPG Keys Are Configured:

audit_check_configured

Apply the following configuration to ensure GPG Keys Are Configured:

remediate_configured

This recommendation verifies that Automatic Security Updates Are Enabled on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Automatic Security Updates Are Enabled:

audit_check_enabled

Apply the following configuration to ensure Automatic Security Updates Are Enabled:

remediate_enabled

This recommendation verifies that X Window System Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that X Window System Is Not Installed:

audit_check_installed

Apply the following configuration to ensure X Window System Is Not Installed:

remediate_installed

This recommendation verifies that Avahi Server Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Avahi Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Avahi Server Is Not Installed:

remediate_installed

This recommendation verifies that CUPS Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that CUPS Is Not Installed:

audit_check_installed

Apply the following configuration to ensure CUPS Is Not Installed:

remediate_installed

This recommendation verifies that DHCP Server Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DHCP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DHCP Server Is Not Installed:

remediate_installed

This recommendation verifies that LDAP Server Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that LDAP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure LDAP Server Is Not Installed:

remediate_installed

This recommendation verifies that NFS Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NFS Is Not Installed:

audit_check_installed

Apply the following configuration to ensure NFS Is Not Installed:

remediate_installed

This recommendation verifies that DNS Server Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that DNS Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure DNS Server Is Not Installed:

remediate_installed

This recommendation verifies that FTP Server Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that FTP Server Is Not Installed:

audit_check_installed

Apply the following configuration to ensure FTP Server Is Not Installed:

remediate_installed

This recommendation verifies that NIS Client Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that NIS Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure NIS Client Is Not Installed:

remediate_installed

This recommendation verifies that rsh Client Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that rsh Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure rsh Client Is Not Installed:

remediate_installed

This recommendation verifies that Talk Client Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Talk Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Talk Client Is Not Installed:

remediate_installed

This recommendation verifies that Telnet Client Is Not Installed on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Telnet Client Is Not Installed:

audit_check_installed

Apply the following configuration to ensure Telnet Client Is Not Installed:

remediate_installed

This recommendation verifies that IP Forwarding Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that IP Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure IP Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that Packet Redirect Sending Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that Packet Redirect Sending Is Disabled:

audit_check_disabled

Apply the following configuration to ensure Packet Redirect Sending Is Disabled:

remediate_disabled

This recommendation verifies that Source Routed Packets Are Not Accepted on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Source Routed Packets Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure Source Routed Packets Are Not Accepted:

remediate_accepted

This recommendation verifies that ICMP Redirects Are Not Accepted on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that ICMP Redirects Are Not Accepted:

audit_check_accepted

Apply the following configuration to ensure ICMP Redirects Are Not Accepted:

remediate_accepted

This recommendation verifies that Broadcast ICMP Requests Are Ignored on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Broadcast ICMP Requests Are Ignored:

audit_check_ignored

Apply the following configuration to ensure Broadcast ICMP Requests Are Ignored:

remediate_ignored

This recommendation verifies that nftables Is Installed on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that nftables Is Installed:

audit_check_installed

Apply the following configuration to ensure nftables Is Installed:

remediate_installed

This recommendation verifies that Default Deny Firewall Policy Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Default Deny Firewall Policy Is Configured:

audit_check_configured

Apply the following configuration to ensure Default Deny Firewall Policy Is Configured:

remediate_configured

This recommendation verifies that Loopback Traffic Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Loopback Traffic Is Configured:

audit_check_configured

Apply the following configuration to ensure Loopback Traffic Is Configured:

remediate_configured

This recommendation verifies that Outbound Traffic Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Outbound Traffic Is Configured:

audit_check_configured

Apply the following configuration to ensure Outbound Traffic Is Configured:

remediate_configured

This recommendation verifies that rsyslog Is Installed on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Is Installed:

audit_check_installed

Apply the following configuration to ensure rsyslog Is Installed:

remediate_installed

This recommendation verifies that rsyslog Service Is Enabled on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Service Is Enabled:

audit_check_enabled

Apply the following configuration to ensure rsyslog Service Is Enabled:

remediate_enabled

This recommendation verifies that rsyslog Default File Permissions Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Default File Permissions Are Configured:

audit_check_configured

Apply the following configuration to ensure rsyslog Default File Permissions Are Configured:

remediate_configured

This recommendation verifies that Logging Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Logging Is Configured:

audit_check_configured

Apply the following configuration to ensure Logging Is Configured:

remediate_configured

This recommendation verifies that rsyslog Is Configured to Send Logs to Remote Host on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that rsyslog Is Configured to Send Logs to Remote Host:

audit_check_host

Apply the following configuration to ensure rsyslog Is Configured to Send Logs to Remote Host:

remediate_host

This recommendation verifies that auditd Is Installed on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Is Installed:

audit_check_installed

Apply the following configuration to ensure auditd Is Installed:

remediate_installed

This recommendation verifies that auditd Service Is Enabled and Running on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that auditd Service Is Enabled and Running:

audit_check_running

Apply the following configuration to ensure auditd Service Is Enabled and Running:

remediate_running

This recommendation verifies that Audit Log Storage Size Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Audit Log Storage Size Is Configured:

audit_check_configured

Apply the following configuration to ensure Audit Log Storage Size Is Configured:

remediate_configured

This recommendation verifies that Events That Modify Date and Time Are Collected on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify Date and Time Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify Date and Time Are Collected:

remediate_collected

This recommendation verifies that Events That Modify User/Group Information Are Collected on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Events That Modify User/Group Information Are Collected:

audit_check_collected

Apply the following configuration to ensure Events That Modify User/Group Information Are Collected:

remediate_collected

This recommendation verifies that Successful and Unsuccessful Login Events Are Collected on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Successful and Unsuccessful Login Events Are Collected:

audit_check_collected

Apply the following configuration to ensure Successful and Unsuccessful Login Events Are Collected:

remediate_collected

This recommendation verifies that Session Initiation Information Is Collected on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Session Initiation Information Is Collected:

audit_check_collected

Apply the following configuration to ensure Session Initiation Information Is Collected:

remediate_collected

This recommendation verifies that SSH Root Login Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH Root Login Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH Root Login Is Disabled:

remediate_disabled

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH PermitEmptyPasswords Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH PermitEmptyPasswords Is Disabled:

remediate_disabled

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH MaxAuthTries Is Set to 4 or Less:

audit_check_less

Apply the following configuration to ensure SSH MaxAuthTries Is Set to 4 or Less:

remediate_less

This recommendation verifies that SSH Idle Timeout Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that SSH Idle Timeout Is Configured:

audit_check_configured

Apply the following configuration to ensure SSH Idle Timeout Is Configured:

remediate_configured

This recommendation verifies that SSH X11 Forwarding Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH X11 Forwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH X11 Forwarding Is Disabled:

remediate_disabled

This recommendation verifies that SSH AllowTcpForwarding Is Disabled on the Debian Linux 11 server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Debian Linux 11 server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Run the following command and verify that SSH AllowTcpForwarding Is Disabled:

audit_check_disabled

Apply the following configuration to ensure SSH AllowTcpForwarding Is Disabled:

remediate_disabled

This recommendation verifies that Password Quality Requirements Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Quality Requirements Are Configured:

audit_check_configured

Apply the following configuration to ensure Password Quality Requirements Are Configured:

remediate_configured

This recommendation verifies that Password Hashing Algorithm Is SHA-512 or Yescrypt on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Hashing Algorithm Is SHA-512 or Yescrypt:

audit_check_yescrypt

Apply the following configuration to ensure Password Hashing Algorithm Is SHA-512 or Yescrypt:

remediate_yescrypt

This setting ensures that Password Reuse Is Limited on the Debian Linux 11 server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Debian Linux 11 server is essential for defense in depth.

Run the following command and verify that Password Reuse Is Limited:

audit_check_limited

Apply the following configuration to ensure Password Reuse Is Limited:

remediate_limited

This recommendation verifies that Account Lockout Policy Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Account Lockout Policy Is Configured:

audit_check_configured

Apply the following configuration to ensure Account Lockout Policy Is Configured:

remediate_configured

This recommendation verifies that Password Expiration Is Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Password Expiration Is Configured:

audit_check_configured

Apply the following configuration to ensure Password Expiration Is Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/passwd Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/passwd Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/passwd Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/shadow Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/shadow Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/shadow Are Configured:

remediate_configured

This recommendation verifies that Permissions on /etc/group Are Configured on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that Permissions on /etc/group Are Configured:

audit_check_configured

Apply the following configuration to ensure Permissions on /etc/group Are Configured:

remediate_configured

This recommendation verifies that No World-Writable Files Exist on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No World-Writable Files Exist:

audit_check_exist

Apply the following configuration to ensure No World-Writable Files Exist:

remediate_exist

This recommendation verifies that No SUID Executables Exist on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No SUID Executables Exist:

audit_check_exist

Apply the following configuration to ensure No SUID Executables Exist:

remediate_exist

This recommendation verifies that root Is the Only UID 0 Account on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that root Is the Only UID 0 Account:

audit_check_account

Apply the following configuration to ensure root Is the Only UID 0 Account:

remediate_account

This recommendation verifies that No Legacy Entries Exist in /etc/passwd on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Legacy Entries Exist in /etc/passwd:

audit_check_/etc/passwd

Apply the following configuration to ensure No Legacy Entries Exist in /etc/passwd:

remediate_/etc/passwd

This recommendation verifies that All Users Have a Valid Home Directory on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that All Users Have a Valid Home Directory:

audit_check_directory

Apply the following configuration to ensure All Users Have a Valid Home Directory:

remediate_directory

This recommendation verifies that No Duplicate UIDs Exist on the Debian Linux 11 server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Debian Linux 11 server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Run the following command and verify that No Duplicate UIDs Exist:

audit_check_exist

Apply the following configuration to ensure No Duplicate UIDs Exist:

remediate_exist