CIS RabbitMQ 3.13 Benchmark

This recommendation verifies that RabbitMQ is running the latest stable version on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RabbitMQ version:
rabbitmqctl version
rabbitmqctl status | grep -A2 'RabbitMQ'

# Check Erlang version:
erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell

# Update RabbitMQ to latest:
apt update && apt install -y rabbitmq-server
# Or RHEL:
dnf update -y rabbitmq-server

# Verify:
rabbitmqctl version

This recommendation ensures that only required plugins are enabled on the RabbitMQ 3.13 message broker. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the RabbitMQ 3.13 message broker may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check which plugins are enabled:
rabbitmq-plugins list -e

# Identify management plugins:
rabbitmq-plugins list -e | grep management

# Disable unnecessary plugins:
rabbitmq-plugins disable rabbitmq_mqtt
rabbitmq-plugins disable rabbitmq_stomp
rabbitmq-plugins disable rabbitmq_web_mqtt

# Enable only required plugins:
rabbitmq-plugins enable rabbitmq_management
rabbitmq-plugins enable rabbitmq_prometheus

This recommendation verifies that the default guest user is removed on the RabbitMQ 3.13 message broker. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the RabbitMQ 3.13 message broker increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check if default guest user exists:
rabbitmqctl list_users | grep guest

# Check guest user permissions:
rabbitmqctl list_user_permissions guest

# Delete default guest user:
rabbitmqctl delete_user guest

# Or restrict guest to localhost only in rabbitmq.conf:
# loopback_users.guest = true

This recommendation verifies that an appropriate authentication backend is configured on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication backends:
rabbitmqctl environment | grep auth

# Check rabbitmq.conf:
grep 'auth_backends\|auth_mechanisms' /etc/rabbitmq/rabbitmq.conf

# Configure LDAP or internal auth in /etc/rabbitmq/rabbitmq.conf:
auth_backends.1 = rabbit_auth_backend_internal
# auth_backends.2 = rabbit_auth_backend_ldap

# Disable AMQPLAIN:
auth_mechanisms.1 = PLAIN
auth_mechanisms.2 = EXTERNAL

This recommendation verifies that administrator tags are assigned minimally on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all users and their tags:
rabbitmqctl list_users

# Check for users with administrator tag:
rabbitmqctl list_users | grep administrator

# Create application-specific users with minimal tags:
rabbitmqctl add_user app_user 'SecureP@ss123!'
rabbitmqctl set_user_tags app_user monitoring

# Remove administrator tag from non-admin users:
rabbitmqctl set_user_tags app_user ''

This recommendation verifies that least privilege permissions are configured on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all permissions:
rabbitmqctl list_permissions -p /

# Check each vhost:
for vhost in $(rabbitmqctl list_vhosts -q); do
  echo "=== $vhost ==="
  rabbitmqctl list_permissions -p "$vhost"
done

# Set least-privilege permissions:
rabbitmqctl set_permissions -p /app app_user \
  '^app\..*' '^app\..*' '^app\..*'

# Clear excessive permissions:
rabbitmqctl clear_permissions -p / guest

This recommendation verifies that dedicated vhosts are used for isolation on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all vhosts:
rabbitmqctl list_vhosts

# Check vhost limits:
rabbitmqctl list_vhost_limits

# Create dedicated vhosts for applications:
rabbitmqctl add_vhost /production
rabbitmqctl add_vhost /staging

# Set vhost limits:
rabbitmqctl set_vhost_limits -p /production \
  '{"max-connections": 1000, "max-queues": 500}'

This recommendation verifies that TLS is enabled for AMQP connections on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration:
grep -E 'ssl_options|listeners.ssl' /etc/rabbitmq/rabbitmq.conf

# Check if plain AMQP is enabled:
rabbitmqctl status | grep -A5 'Listeners'
ss -tlnp | grep -E '5672|5671'

# Configure TLS in /etc/rabbitmq/rabbitmq.conf:
listeners.ssl.default = 5671

# Disable plain AMQP:
listeners.tcp = none

ssl_options.cacertfile = /etc/rabbitmq/ssl/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/ssl/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/ssl/server_key.pem
ssl_options.verify = verify_peer
ssl_options.fail_if_no_peer_cert = true

systemctl restart rabbitmq-server

This recommendation verifies that strong TLS versions and cipher suites are configured on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS versions allowed:
grep 'ssl_options.versions' /etc/rabbitmq/rabbitmq.conf

# Check ciphers:
grep 'ssl_options.ciphers' /etc/rabbitmq/rabbitmq.conf

# Configure strong TLS versions in /etc/rabbitmq/rabbitmq.conf:
ssl_options.versions.1 = tlsv1.3
ssl_options.versions.2 = tlsv1.2

# Configure strong ciphers:
ssl_options.ciphers.1 = TLS_AES_256_GCM_SHA384
ssl_options.ciphers.2 = TLS_AES_128_GCM_SHA256
ssl_options.ciphers.3 = ECDHE-RSA-AES256-GCM-SHA384

ssl_options.honor_cipher_order = true

systemctl restart rabbitmq-server

This recommendation verifies that management UI uses TLS on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check management UI bindings:
grep 'management.ssl' /etc/rabbitmq/rabbitmq.conf
grep 'management.listener' /etc/rabbitmq/rabbitmq.conf

# Check management port:
ss -tlnp | grep 15672

# Configure management UI TLS in /etc/rabbitmq/rabbitmq.conf:
management.ssl.port = 15671
management.ssl.cacertfile = /etc/rabbitmq/ssl/ca_certificate.pem
management.ssl.certfile = /etc/rabbitmq/ssl/server_certificate.pem
management.ssl.keyfile = /etc/rabbitmq/ssl/server_key.pem
management.ssl.versions.1 = tlsv1.3
management.ssl.versions.2 = tlsv1.2

# Disable HTTP management:
management.tcp.listener = none

systemctl restart rabbitmq-server

This recommendation verifies that memory and disk alarms are configured on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check memory and disk alarms:
rabbitmqctl status | grep -A5 'Memory\|Disk'

# Check limits:
grep 'vm_memory_high_watermark\|disk_free_limit' /etc/rabbitmq/rabbitmq.conf

# Set resource limits in /etc/rabbitmq/rabbitmq.conf:
vm_memory_high_watermark.relative = 0.6
vm_memory_high_watermark_paging_ratio = 0.5
disk_free_limit.relative = 2.0

# Set connection limits:
channel_max = 128
heartbeat = 60

systemctl restart rabbitmq-server

This recommendation verifies that queue policies define TTL and max-length on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check queue policies:
rabbitmqctl list_policies

# Check for queues without TTL or max-length:
rabbitmqctl list_queues name messages policy auto_delete

# Set default queue policies:
rabbitmqctl set_policy TTL '.*' \
  '{"message-ttl": 86400000}' --apply-to queues

rabbitmqctl set_policy DLX '.*' \
  '{"dead-letter-exchange": "dlx", "max-length": 1000000}' \
  --apply-to queues

This recommendation verifies that Erlang cookie has proper permissions on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Erlang cookie permissions:
ls -la /var/lib/rabbitmq/.erlang.cookie

# Verify cookie content (should be long and random):
wc -c /var/lib/rabbitmq/.erlang.cookie

# Check inter-node TLS:
grep 'cluster_formation\|ssl_dist' /etc/rabbitmq/rabbitmq.conf

# Secure Erlang cookie:
chmod 400 /var/lib/rabbitmq/.erlang.cookie
chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie

# Generate strong cookie:
openssl rand -hex 32 > /var/lib/rabbitmq/.erlang.cookie
chmod 400 /var/lib/rabbitmq/.erlang.cookie
chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie

This recommendation verifies that cluster partition handling is configured on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster partition handling:
grep 'cluster_partition_handling' /etc/rabbitmq/rabbitmq.conf

# Check cluster status:
rabbitmqctl cluster_status

# Configure partition handling in /etc/rabbitmq/rabbitmq.conf:
cluster_partition_handling = pause_minority

# For 2-node clusters:
# cluster_partition_handling = autoheal

systemctl restart rabbitmq-server

This recommendation verifies that logging is configured with appropriate levels on the RabbitMQ 3.13 message broker. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the RabbitMQ 3.13 message broker vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check log configuration:
grep 'log\.' /etc/rabbitmq/rabbitmq.conf

# Check log level:
rabbitmqctl log_tail -N 10

# Verify log file:
ls -la /var/log/rabbitmq/

# Configure logging in /etc/rabbitmq/rabbitmq.conf:
log.file.level = info
log.console = false
log.file = rabbit.log
log.file.rotation.date = $D0
log.file.rotation.size = 104857600
log.file.rotation.count = 10

# Enable connection logging:
log.connection.level = info
log.channel.level = info

systemctl restart rabbitmq-server