CIS Debian Linux 12 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /tmp Is a Separate Partition may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp
# Should show a dedicated mount point

# Configure /tmp as tmpfs in /etc/fstab:
tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0
systemctl unmask tmp.mount

This recommendation verifies that nodev,nosuid,noexec Options Set on /tmp on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nodev,nosuid,noexec Options Set on /tmp may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep -E 'nodev|nosuid|noexec'

Add nodev,nosuid,noexec to the /tmp mount options in /etc/fstab.

This recommendation verifies that /var Is a Separate Partition on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /var Is a Separate Partition may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var

Create a separate partition for /var during OS installation or migrate during maintenance.

This recommendation verifies that /home Is a Separate Partition on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /home Is a Separate Partition may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /home

Create a separate partition for /home with nodev mount option.

This recommendation verifies that Sticky Bit Is Set on All World-Writable Dirs on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sticky Bit Is Set on All World-Writable Dirs may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

df --local -P 2>/dev/null | awk '{if (NR!=1) print $6}' | \
xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null
# Should return empty

df --local -P | awk '{if (NR!=1) print $6}' | \
xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | \
xargs -I '{}' chmod a+t '{}'

This recommendation addresses the proper configuration of APT GPG Keys on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of APT GPG Keys can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

apt-key list 2>/dev/null
# Review keys for authenticity

Ensure only official Debian repository keys are present. Remove untrusted keys.

This recommendation addresses the proper configuration of APT Package Sources on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of APT Package Sources can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

cat /etc/apt/sources.list
ls /etc/apt/sources.list.d/

Configure only official Debian repositories with security updates enabled.

This recommendation verifies that AppArmor Is Installed and Enforcing on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to appArmor Is Installed and Enforcing may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s apparmor | grep Status
aa-status 2>/dev/null | head -5
# Loaded profiles should show 'enforce' mode

apt install apparmor apparmor-utils
# Enable at boot in /etc/default/grub:
# GRUB_CMDLINE_LINUX="apparmor=1 security=apparmor"
update-grub
aa-enforce /etc/apparmor.d/*

This recommendation verifies that GRUB Bootloader Password Is Set on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to gRUB Bootloader Password Is Set may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*set\s+superusers' /boot/grub/grub.cfg
grep -E '^\s*password_pbkdf2' /boot/grub/grub.cfg

grub-mkpasswd-pbkdf2
# Add to /etc/grub.d/40_custom:
# set superusers="grubadmin"
# password_pbkdf2 grubadmin grub.pbkdf2.sha512...
update-grub

File and directory permissions for GRUB Config File should be set to Correct. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Debian 12 operating system.

Incorrect permissions on GRUB Config File could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

stat -c '%a %U %G' /boot/grub/grub.cfg
# Should be 600 root root (or 400)

chmod 600 /boot/grub/grub.cfg
chown root:root /boot/grub/grub.cfg

This recommendation addresses the proper configuration of systemd-timesyncd or chrony on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of systemd-timesyncd or chrony can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

timedatectl status | grep 'NTP service'
# or
systemctl is-enabled chrony 2>/dev/null
chronyc tracking 2>/dev/null

# Using systemd-timesyncd:
timedatectl set-ntp true
# Configure servers in /etc/systemd/timesyncd.conf:
# [Time]
# NTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org

X Window System should not be installed on the Debian 12 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If X Window System remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -l xserver-xorg* 2>/dev/null | grep -E '^ii'
# Should return empty on servers

apt purge xserver-xorg*

Avahi Server should not be installed on the Debian 12 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If Avahi Server remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s avahi-daemon 2>/dev/null | grep Status

systemctl stop avahi-daemon
apt purge avahi-daemon

CUPS should not be installed on the Debian 12 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If CUPS remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s cups 2>/dev/null | grep Status

apt purge cups

SNMP Server should not be installed on the Debian 12 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If SNMP Server remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s snmpd 2>/dev/null | grep Status

apt purge snmpd

This setting controls whether IP Forwarding is disabled on the Debian 12 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Forwarding enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Debian 12 operating system.

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding
# Both should be 0

# /etc/sysctl.d/60-cis.conf:
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv6.conf.all.forwarding=0

This recommendation verifies that Source Routed Packets Are Rejected on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to source Routed Packets Are Rejected may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route
# Both should be 0

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

This recommendation verifies that ICMP Redirects Are Rejected on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iCMP Redirects Are Rejected may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
# Both should be 0

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

This recommendation verifies that nftables Is Installed on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nftables Is Installed may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s nftables | grep Status
nft list ruleset

apt install nftables
systemctl enable nftables

This recommendation verifies that Default Deny Firewall Policy on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Deny Firewall Policy may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

nft list ruleset | grep 'policy drop'

nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
nft add chain inet filter forward '{ type filter hook forward priority 0; policy drop; }'
nft add chain inet filter output '{ type filter hook output priority 0; policy drop; }'

This recommendation verifies that Loopback Traffic Is Allowed on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to loopback Traffic Is Allowed may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

nft list ruleset | grep 'iif "lo"'

nft add rule inet filter input iif lo accept
nft add rule inet filter output oif lo accept
nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop

This recommendation verifies that rsyslog Is Installed on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rsyslog Is Installed may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s rsyslog | grep Status

apt install rsyslog
systemctl enable rsyslog

This recommendation verifies that journald Is Configured to Persist Logs on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to journald Is Configured to Persist Logs may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*Storage' /etc/systemd/journald.conf
# Should be Storage=persistent

# /etc/systemd/journald.conf:
[Journal]
Storage=persistent
systemctl restart systemd-journald

This recommendation verifies that auditd Is Installed and Enabled on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to auditd Is Installed and Enabled may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s auditd | grep Status
systemctl is-enabled auditd

apt install auditd audispd-plugins
systemctl enable auditd

This recommendation addresses the proper configuration of Audit Log Storage Size on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Audit Log Storage Size can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep max_log_file /etc/audit/auditd.conf

# /etc/audit/auditd.conf:
max_log_file = 256
max_log_file_action = keep_logs

This recommendation verifies that Changes to System Administration Scope Are Collected on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to changes to System Administration Scope Are Collected may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep scope

# /etc/audit/rules.d/50-scope.rules:
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d/ -p wa -k scope

This setting controls whether SSH Root Login is disabled on the Debian 12 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH Root Login enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Debian 12 operating system.

sshd -T | grep permitrootlogin
# Should be: permitrootlogin no

# /etc/ssh/sshd_config:
PermitRootLogin no
systemctl restart sshd

This recommendation configures SSH Protocol to 2 on the Debian 12 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for SSH Protocol could weaken security controls or allow unintended behavior. Setting this to 2 ensures the Debian 12 operating system operates within a well-defined security boundary.

sshd -T | grep protocol
# Debian 12 OpenSSH defaults to protocol 2

# /etc/ssh/sshd_config:
Protocol 2

This recommendation configures SSH MaxAuthTries to 4 or Less on the Debian 12 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for SSH MaxAuthTries could weaken security controls or allow unintended behavior. Setting this to 4 or Less ensures the Debian 12 operating system operates within a well-defined security boundary.

sshd -T | grep maxauthtries
# Should be 4 or less

MaxAuthTries 4

This setting controls whether SSH PermitEmptyPasswords is disabled on the Debian 12 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving SSH PermitEmptyPasswords enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Debian 12 operating system.

sshd -T | grep permitemptypasswords
# Should be: permitemptypasswords no

PermitEmptyPasswords no

This recommendation verifies that Only Strong SSH Ciphers Are Used on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to only Strong SSH Ciphers Are Used may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep ciphers

# /etc/ssh/sshd_config:
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

This recommendation verifies that Password Minimum Length Is 14 or More on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Minimum Length Is 14 or More may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*minlen' /etc/security/pwquality.conf
# Should be minlen = 14 or greater

# /etc/security/pwquality.conf:
minlen = 14

This recommendation addresses the proper configuration of Password Complexity on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Complexity can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E '^\s*(dcredit|ucredit|lcredit|ocredit)' /etc/security/pwquality.conf

# /etc/security/pwquality.conf:
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

This recommendation addresses the proper configuration of Account Lockout on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Account Lockout can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E 'pam_faillock' /etc/pam.d/common-auth

# /etc/security/faillock.conf:
deny = 5
unlock_time = 900
fail_interval = 900

This recommendation addresses the proper configuration of Password Expiration on the Debian 12 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Expiration can lead to security gaps that may be exploited by attackers. A properly configured Debian 12 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep PASS_MAX_DAYS /etc/login.defs
# Should be 365 or less

# /etc/login.defs:
PASS_MAX_DAYS 365
PASS_MIN_DAYS 1
PASS_WARN_AGE 7

This recommendation verifies that Root Is the Only UID 0 Account on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to root Is the Only UID 0 Account may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '$3 == 0 {print $1}' /etc/passwd
# Should only return "root"

Remove or change the UID of any non-root account with UID 0.

This recommendation verifies that Permissions on /etc/passwd Are Correct on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to permissions on /etc/passwd Are Correct may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/passwd
# Should be 644 root root

chmod 644 /etc/passwd
chown root:root /etc/passwd

This recommendation verifies that Permissions on /etc/shadow Are Correct on the Debian 12 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to permissions on /etc/shadow Are Correct may leave the Debian 12 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/shadow
# Should be 640 root shadow

chmod 640 /etc/shadow
chown root:shadow /etc/shadow

This recommendation verifies that No World-Writable Files is present on the Debian 12 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No World-Writable Files leaves the Debian 12 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

df --local -P | awk '{if (NR!=1) print $6}' | \
xargs -I '{}' find '{}' -xdev -type f -perm -0002 2>/dev/null
# Should return empty

Remove world-writable permission from identified files: chmod o-w <file>

This recommendation verifies that No Unowned Files or Directories is present on the Debian 12 operating system. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of No Unowned Files or Directories leaves the Debian 12 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

df --local -P | awk '{if (NR!=1) print $6}' | \
xargs -I '{}' find '{}' -xdev -nouser 2>/dev/null
# Should return empty

Assign ownership to each unowned file or remove it if unnecessary.