CIS OpenBSD 7 Benchmark

This recommendation verifies that SSH is configured with key-based authentication only on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check sshd configuration:
grep -E '^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|Protocol)' /etc/ssh/sshd_config

# Harden sshd_config:
cat >> /etc/ssh/sshd_config <<'EOF'
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 30
EOF
rcctl restart sshd

This recommendation verifies that doas is configured with least privilege on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check doas configuration:
cat /etc/doas.conf

# Verify no permit nopass for root:
grep -i 'permit nopass' /etc/doas.conf

# Configure doas with least privilege:
cat > /etc/doas.conf <<'EOF'
permit persist :wheel
permit nopass _pbuild
deny root
EOF
chmod 600 /etc/doas.conf

This recommendation verifies that login.conf enforces strong password policies on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check login.conf security settings:
grep -E '(minlen|localcipher|passwordcheck)' /etc/login.conf

# Harden login.conf password policies:
vi /etc/login.conf
# Under default:\
#   :minlen=12:\
#   :localcipher=blowfish,a:\
#   :passwordcheck=/usr/libexec/auth/login_passwd:

# Rebuild login.conf.db:
cap_mkdb /etc/login.conf

This recommendation verifies that unnecessary services are disabled on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List enabled services:
rcctl ls on

# Check inetd:
rcctl get inetd flags

# Disable unnecessary services:
rcctl disable inetd
rcctl disable snmpd
rcctl disable ntpd  # if using openntpd
rcctl stop inetd
rcctl stop snmpd

This recommendation verifies that httpd is configured with TLS 1.3 on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check httpd configuration:
httpd -n
cat /etc/httpd.conf | grep -v '^#' | grep -v '^$'

# Harden httpd.conf with TLS:
cat > /etc/httpd.conf <<'EOF'
server "www.example.com" {
  listen on * tls port 443
  tls {
    certificate "/etc/ssl/server.crt"
    key "/etc/ssl/private/server.key"
    protocols "TLSv1.3"
    ciphers "HIGH:!aNULL:!MD5"
  }
  root "/htdocs"
}
EOF
rcctl restart httpd

This recommendation verifies that OpenSMTPD is hardened with TLS on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check smtpd configuration:
smtpd -n
grep -v '^#' /etc/mail/smtpd.conf | grep -v '^$'

# Secure OpenSMTPD:
cat > /etc/mail/smtpd.conf <<'EOF'
table aliases file:/etc/mail/aliases
listen on lo0
listen on egress tls pki mail.example.com
action "local" mbox alias <aliases>
action "relay" relay host smtp+tls://relay.example.com
match from local for local action "local"
match from any for domain "example.com" action "local"
EOF
rcctl restart smtpd

This recommendation verifies that PF firewall is enabled with default-deny policy on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check PF firewall status and rules:
pfctl -s info | head -5
pfctl -s rules

# Verify pf is enabled:
rcctl get pf flags

# Configure PF with default-deny:
cat > /etc/pf.conf <<'EOF'
set skip on lo
block in log all
pass out quick
pass in on egress proto tcp from any to (egress) port {22, 443}
pass in on egress proto icmp from any to any icmp-type echoreq
EOF
pfctl -f /etc/pf.conf
rcctl enable pf

This recommendation verifies that network sysctls are hardened on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check sysctl network hardening:
sysctl net.inet.ip.forwarding
sysctl net.inet.ip.redirect
sysctl net.inet.icmp.rediraccept
sysctl net.inet.tcp.synuseithreshold

# Harden network sysctls:
cat >> /etc/sysctl.conf <<'EOF'
net.inet.ip.forwarding=0
net.inet.ip.redirect=0
net.inet.icmp.rediraccept=0
net.inet.ip.sourceroute=0
net.inet.tcp.synuseithreshold=1024
net.inet6.ip6.forwarding=0
EOF
sysctl net.inet.ip.forwarding=0
sysctl net.inet.ip.redirect=0

This recommendation verifies that partitions use nosuid, nodev, and noexec mount options on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check filesystem mount options:
mount | grep -E '(nosuid|nodev|noexec)'

# Verify /tmp mount:
grep '/tmp' /etc/fstab

# Add mount security options:
# Edit /etc/fstab:
# /dev/sd0d /tmp ffs rw,nodev,nosuid,noexec 1 2
# /dev/sd0e /var ffs rw,nodev,nosuid 1 2
# /dev/sd0f /usr ffs rw,nodev 1 2
# /dev/sd0g /home ffs rw,nodev,nosuid 1 2
mount -a

This recommendation verifies that no world-writable files or unnecessary SUID binaries exist on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Find world-writable files:
find / -xdev -type f -perm -0002 -ls 2>/dev/null

# Find SUID/SGID binaries:
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null

# Remove world-writable permissions:
find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

# Remove unnecessary SUID bits:
chmod u-s /usr/bin/chfn
chmod u-s /usr/bin/chsh
chmod u-s /usr/bin/chpass

This recommendation verifies that securelevel is set to 2 or higher on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check securelevel:
sysctl kern.securelevel

# Verify securelevel in rc.conf:
grep securelevel /etc/rc.conf.local

# Set securelevel to 2 (highly secure):
echo 'kern.securelevel=2' >> /etc/sysctl.conf
# In /etc/rc.conf.local:
echo 'kern.securelevel=2' >> /etc/rc.conf.local

This recommendation verifies that W^X enforcement is enabled on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check W^X enforcement:
sysctl kern.wxabort

# Check pledge/unveil usage:
ktrace -t + /usr/bin/program 2>&1 | grep -i pledge

# Enable W^X abort:
echo 'kern.wxabort=1' >> /etc/sysctl.conf
sysctl kern.wxabort=1

This recommendation verifies that system patches are applied with syspatch on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syspatch status:
syspatch -l
syspatch -c

# Check firmware updates:
fw_update -n

# Apply available patches:
syspatch

# Update firmware:
fw_update

# Schedule automatic patching (cron):
# 0 3 * * * /usr/sbin/syspatch >> /var/log/syspatch.log 2>&1

This recommendation verifies that package sources use HTTPS and signatures are verified on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check package signatures:
pkg_info -S

# Verify installurl:
cat /etc/installurl

# Configure trusted mirror:
echo 'https://cdn.openbsd.org/pub/OpenBSD' > /etc/installurl

# Verify package integrity:
pkg_check

This recommendation verifies that comprehensive syslog configuration is in place on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check system logging:
grep -v '^#' /etc/syslog.conf | grep -v '^$'

# Check newsyslog rotation:
cat /etc/newsyslog.conf | head -20

# Configure comprehensive syslog:
cat >> /etc/syslog.conf <<'EOF'
authpriv.*			/var/log/authlog
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail.none	/var/log/messages
security.*			/var/log/security
*.emerg				*
EOF
rcctl restart syslogd

This recommendation verifies that process accounting is enabled on the OpenBSD 7 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the OpenBSD 7 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check accounting:
rc.conf get accounting
ls -la /var/account/

# Enable process accounting:
rcctl enable accounting
rcctl start accounting

# Check daily security check:
cat /etc/daily.local
# Ensure daily security run output is reviewed