CIS Pi-hole Benchmark

This recommendation verifies that Pi-hole is running the latest stable version on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Pi-hole version
pihole -v
pihole -up --check-only

# Update Pi-hole to latest stable
pihole -up
# Verify update:
pihole -v

This recommendation verifies that Pi-hole services run as dedicated users on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Pi-hole runs as dedicated user
ps -eo user,pid,comm | grep -E 'pihole|lighttpd|pihole-FTL'
grep 'PIHOLE_DNS_USER' /etc/pihole/pihole-FTL.conf 2>/dev/null

# Configure dedicated user
# Pi-hole FTL runs as pihole user by default
# Verify file ownership:
chown -R pihole:pihole /etc/pihole
chown pihole:pihole /var/log/pihole*
# Ensure web server runs as www-data:
grep 'server.username' /etc/lighttpd/lighttpd.conf

This recommendation verifies that a strong admin interface password is configured on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check admin interface password
grep 'WEBPASSWORD' /etc/pihole/setupVars.conf
curl -s http://localhost/admin/ | grep -c 'Login'

# Set strong admin password
pihole -a -p
# Or set from command line:
pihole -a -p "$(openssl rand -base64 24)"
# Verify password is set:
grep 'WEBPASSWORD' /etc/pihole/setupVars.conf | grep -v '=$'

This recommendation verifies that web interface uses HTTPS with TLS 1.2+ on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web interface HTTPS
grep -E 'ssl\.engine|ssl\.pemfile' /etc/lighttpd/external.conf 2>/dev/null
ss -tlnp | grep -E '443|lighttpd'

# Enable HTTPS for web interface
apt-get install lighttpd-mod-openssl
cat > /etc/lighttpd/external.conf << 'EOF'
server.modules += ("mod_openssl")
$SERVER["socket"] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/lighttpd/ssl/combined.pem"
  ssl.openssl.ssl-conf-cmd = ("Protocol" => "-ALL, TLSv1.2, TLSv1.3")
}
$HTTP["scheme"] == "http" {
  url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
}
EOF
systemctl restart lighttpd

This recommendation verifies that upstream DNS uses encrypted transport (DoH/DoT) on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check upstream DNS configuration
grep 'PIHOLE_DNS' /etc/pihole/setupVars.conf
grep 'server=' /etc/dnsmasq.d/01-pihole.conf

# Configure secure upstream DNS
# Use DNS-over-HTTPS with cloudflared/unbound:
apt-get install cloudflared
cloudflared proxy-dns --port 5053 --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query
# Point Pi-hole to local DoH proxy:
pihole -a setdns 127.0.0.1#5053
# Or use unbound as recursive resolver

This recommendation verifies that DNSSEC validation is enabled on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNSSEC configuration
grep 'DNSSEC' /etc/pihole/setupVars.conf
grep 'dnssec' /etc/dnsmasq.d/01-pihole.conf 2>/dev/null

# Enable DNSSEC validation
# In Pi-hole web interface: Settings > DNS > Use DNSSEC
# Or configure manually:
echo 'DNSSEC=true' >> /etc/pihole/setupVars.conf
echo 'dnssec' >> /etc/dnsmasq.d/02-pihole-custom.conf
echo 'trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D' >> /etc/dnsmasq.d/02-pihole-custom.conf
pihole restartdns

This recommendation verifies that query logging with appropriate privacy level is configured on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check query logging configuration
grep 'QUERY_LOGGING' /etc/pihole/setupVars.conf
grep 'PRIVACYLEVEL' /etc/pihole/pihole-FTL.conf 2>/dev/null
ls -la /var/log/pihole*

# Configure query logging with privacy
# In /etc/pihole/pihole-FTL.conf:
# PRIVACYLEVEL=0  (show everything)
# PRIVACYLEVEL=1  (hide domains)
# PRIVACYLEVEL=2  (hide domains and clients)
# PRIVACYLEVEL=3  (anonymous everything)
echo 'PRIVACYLEVEL=0' >> /etc/pihole/pihole-FTL.conf
echo 'MAXDBDAYS=90' >> /etc/pihole/pihole-FTL.conf
pihole restartdns

This recommendation verifies that log rotation and database retention limits are set on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check FTL database and log rotation
ls -la /etc/pihole/pihole-FTL.db
grep -E 'MAXDBDAYS|DBINTERVAL' /etc/pihole/pihole-FTL.conf 2>/dev/null
cat /etc/logrotate.d/pihole 2>/dev/null

# Configure log rotation and database limits
# In /etc/pihole/pihole-FTL.conf:
MAXDBDAYS=90
DBINTERVAL=1.0
DBFILE=/etc/pihole/pihole-FTL.db
# Configure log rotation:
cat > /etc/logrotate.d/pihole << 'EOF'
/var/log/pihole*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    postrotate
        pihole restartdns
    endscript
}
EOF

This setting ensures that DNS listening is restricted to specific interfaces on the Pi-hole DNS filtering platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Pi-hole DNS filtering platform is essential for defense in depth.

# Check listening interface restriction
grep 'DNSMASQ_LISTENING' /etc/pihole/setupVars.conf
grep 'interface=' /etc/dnsmasq.d/01-pihole.conf

# Restrict DNS to specific interfaces
# In /etc/pihole/setupVars.conf:
# DNSMASQ_LISTENING=local  (local subnets only)
# DNSMASQ_LISTENING=single (single interface)
# Do NOT use: DNSMASQ_LISTENING=all
pihole -a interface eth0
# Firewall:
ufw allow from 192.168.0.0/16 to any port 53
ufw deny 53

This recommendation verifies that query rate limiting is configured on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check rate limiting
grep 'RATE_LIMIT' /etc/pihole/pihole-FTL.conf 2>/dev/null
grep 'BLOCK_ICLOUD_PR' /etc/pihole/pihole-FTL.conf 2>/dev/null

# Configure rate limiting
# In /etc/pihole/pihole-FTL.conf:
RATE_LIMIT=1000/60
# Block iCloud Private Relay (bypass prevention):
BLOCK_ICLOUD_PR=true
# Limit reply types:
REPLY_WHEN_BUSY=ALLOW
BLOCK_ESNI=true
pihole restartdns

This recommendation verifies that comprehensive and maintained blocklists are configured on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check blocklist configuration
pihole -q -adlist
sqlite3 /etc/pihole/gravity.db 'SELECT address FROM adlist WHERE enabled=1;'

# Configure comprehensive blocklists
pihole -a adlist add https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
pihole -a adlist add https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt
# Update gravity:
pihole -g
# Review and whitelist false positives:
pihole -w required-domain.com

This recommendation verifies that regex blocking patterns are configured for malware domains on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check regex and wildcard blocking
sqlite3 /etc/pihole/gravity.db 'SELECT domain FROM domainlist WHERE type=3;'
pihole --regex --list

# Configure regex blocking patterns
pihole --regex '(^|\.)ads?[0-9]*\.'
pihole --regex '(^|\.)tracking\.'
pihole --regex '(^|\.)telemetry\.'
# Block known malware TLDs:
pihole --regex '\.(tk|ml|ga|cf|gq)$'
# Review regex performance:
pihole -t

This recommendation verifies that automated configuration backups are scheduled on the Pi-hole DNS filtering platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Pi-hole DNS filtering platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Pi-hole configuration backup
ls -la /etc/pihole/*.conf /etc/pihole/setupVars.conf
pihole -a teleporter

# Create configuration backup
# Via CLI:
pihole -a teleporter
# Backup key files:
tar czf /var/backups/pihole-$(date +%F).tar.gz \
  /etc/pihole/setupVars.conf \
  /etc/pihole/pihole-FTL.conf \
  /etc/pihole/custom.list \
  /etc/pihole/pihole-FTL.db \
  /etc/dnsmasq.d/
# Schedule automated backup:
0 3 * * 0 pihole -a teleporter /var/backups/pihole-weekly.tar.gz

This setting ensures that file and directory permissions are restricted on the Pi-hole DNS filtering platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Pi-hole DNS filtering platform is essential for defense in depth.

# Check file and directory permissions
stat -c '%a %U %G' /etc/pihole/setupVars.conf
find /etc/pihole -type f -perm /o=rwx -ls 2>/dev/null
stat -c '%a %U %G' /etc/pihole/pihole-FTL.db

# Restrict file permissions
chown -R pihole:pihole /etc/pihole
chmod 640 /etc/pihole/setupVars.conf
chmod 640 /etc/pihole/pihole-FTL.conf
chmod 664 /etc/pihole/pihole-FTL.db
chmod 750 /etc/pihole
chmod 640 /var/log/pihole*.log
chown pihole:pihole /var/log/pihole*.log