CIS InfluxDB 2 Benchmark

This recommendation verifies that InfluxDB is up to date on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check InfluxDB version:
influx version
influxd version
systemctl status influxdb

# Update InfluxDB to latest:
sudo apt-get update && sudo apt-get install -y influxdb2
# or
sudo yum update -y influxdb2
sudo systemctl restart influxdb

This recommendation verifies that secure default configuration is applied on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check InfluxDB configuration:
influxd print-config
cat /etc/influxdb/config.toml 2>/dev/null || cat /etc/influxdb/config.yml

# Configure InfluxDB with secure defaults:
# /etc/influxdb/config.toml:
bolt-path = "/var/lib/influxdb/influxd.bolt"
engine-path = "/var/lib/influxdb/engine"
http-bind-address = ":8086"
log-level = "info"
reporting-disabled = true
storage-no-validate-field-size = false

This recommendation verifies that proper file ownership and permissions on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check file ownership and permissions:
ls -la /var/lib/influxdb/
ls -la /etc/influxdb/
stat -c '%U:%G %a %n' /var/lib/influxdb/influxd.bolt

# Set correct ownership:
chown -R influxdb:influxdb /var/lib/influxdb/
chown -R influxdb:influxdb /etc/influxdb/
chmod 750 /var/lib/influxdb/
chmod 600 /var/lib/influxdb/influxd.bolt

This recommendation verifies that initial setup is completed with strong credentials on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check initial setup status:
influx setup --check
influx auth list --json | jq '.[].description'

# Run initial setup (creates admin user, org, bucket):
influx setup \
  --username admin \
  --password SecureP@ssw0rd \
  --org myorg \
  --bucket default \
  --retention 30d \
  --force

This recommendation verifies that API tokens follow least-privilege principle on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all API tokens:
influx auth list --json | jq '.[] | {id, description, status, permissions: (.permissions | length)}'

# Create scoped read-only token:
influx auth create \
  --org myorg \
  --description 'read-only-app' \
  --read-bucket $(influx bucket list --name mybucket --json | jq -r '.[0].id')

# Deactivate unused tokens:
influx auth inactive --id <TOKEN_ID>

This recommendation verifies that organization membership uses member role by default on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List organizations and members:
influx org list --json
influx org members list --org myorg --json | jq '.[] | {name: .name, role: .role}'

# Add user as member (not owner) for least privilege:
influx org members add \
  --org myorg \
  --member <USER_ID>

# Remove unnecessary owners:
influx org members remove --org myorg --member <USER_ID>

This recommendation verifies that TLS is enabled for all connections on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration:
influxd print-config | grep -i tls
curl -vk https://localhost:8086/health 2>&1 | grep -i 'ssl\|tls'

# Enable TLS in /etc/influxdb/config.toml:
tls-cert = "/etc/influxdb/ssl/cert.pem"
tls-key = "/etc/influxdb/ssl/key.pem"
tls-min-version = "1.2"

sudo systemctl restart influxdb

This recommendation verifies that InfluxDB binds to specific interfaces on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check bind address:
influxd print-config | grep http-bind-address
ss -tlnp | grep 8086

# Bind to specific interface in /etc/influxdb/config.toml:
http-bind-address = "10.0.1.100:8086"
# Not 0.0.0.0:8086

sudo systemctl restart influxdb

This recommendation verifies that bucket retention policies are configured on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List buckets and retention policies:
influx bucket list --json | jq '.[] | {name, id, retentionPeriod: .retentionRules[0].everySeconds}'

# Set appropriate retention period:
influx bucket update \
  --id <BUCKET_ID> \
  --retention 90d

# Create bucket with retention:
influx bucket create \
  --name metrics \
  --org myorg \
  --retention 365d

This recommendation verifies that 1.x compatibility mode is properly secured on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DBRP mappings (1.x compatibility):
influx v1 dbrp list --json
influx v1 auth list --json

# Remove unnecessary 1.x compatibility mappings:
influx v1 dbrp delete --id <DBRP_ID>

# If 1.x compat is needed, ensure passwords are set:
influx v1 auth set-password \
  --username compat_user

This recommendation verifies that unused tasks are disabled on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all tasks:
influx task list --json | jq '.[] | {name, status, every: .every, cron: .cron}'

# Disable unused tasks:
influx task update --id <TASK_ID> --status inactive

# Ensure tasks use scoped tokens:
influx task create \
  --org myorg \
  --file ./task.flux

This recommendation verifies that query concurrency limits are set on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check query concurrency and queue limits:
influxd print-config | grep -E 'query|concurrency|queue'

# Set query limits in /etc/influxdb/config.toml:
storage-max-concurrent-compactions = 2

# Use InfluxDB Cloud or OSS 2.x query limits:
# API rate limiting via reverse proxy:
# nginx: limit_req_zone $binary_remote_addr zone=influx:10m rate=100r/s;

This recommendation verifies that regular backups are scheduled on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup schedule:
influx backup --help
ls -la /var/backups/influxdb/ 2>/dev/null

# Create backup:
influx backup /var/backups/influxdb/$(date +%Y%m%d) \
  --org myorg

# Automate via cron:
# 0 2 * * * influx backup /var/backups/influxdb/$(date +\%Y\%m\%d) --org myorg

This recommendation verifies that backup integrity is verified on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify backup integrity:
ls -la /var/backups/influxdb/latest/
influx restore --dry-run /var/backups/influxdb/latest/

# Test restore to verify backup integrity:
influx restore /var/backups/influxdb/latest/ \
  --org myorg \
  --bucket test-restore \
  --new-bucket restore-test

# Clean up test restore:
influx bucket delete --name restore-test --org myorg

This recommendation verifies that appropriate logging level is configured on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check InfluxDB metrics:
curl -s http://localhost:8086/metrics | head -20
influxd print-config | grep log-level

# Set appropriate log level in /etc/influxdb/config.toml:
log-level = "info"
# For security auditing use "debug" temporarily

# Forward logs to syslog:
# systemd: journalctl -u influxdb -f

This recommendation verifies that health endpoints are monitored on the InfluxDB 2 time-series database. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the InfluxDB 2 time-series database vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check InfluxDB health:
curl -s http://localhost:8086/health | jq .
curl -s http://localhost:8086/ready | jq .

# Monitor InfluxDB with internal _monitoring bucket:
influx query 'from(bucket: "_monitoring") |> range(start: -1h) |> filter(fn: (r) => r._measurement == "qc_requests_total")'

# Set up alerting task:
# influx task create --file alert-task.flux