CIS Rocky Linux 9 Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /tmp Is a Separate Partition may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --target /tmp
# Should show a separate partition or tmpfs mount

# Option 1: tmpfs
systemctl unmask tmp.mount
systemctl enable --now tmp.mount

# Option 2: Separate partition in /etc/fstab
# /dev/sda2  /tmp  ext4  defaults,nodev,nosuid,noexec  0 0

This recommendation verifies that nodev,nosuid,noexec on /tmp on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nodev,nosuid,noexec on /tmp may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n --target /tmp | grep -E 'nodev|nosuid|noexec'

# Edit /etc/fstab or systemd tmp.mount:
# Options=mode=1777,strictatime,nosuid,nodev,noexec
systemctl daemon-reload
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to /var Is a Separate Partition may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --target /var

# Create separate partition during installation or migrate post-install

This setting controls whether Unused Filesystems is disabled on the Rocky Linux 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Unused Filesystems enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Rocky Linux 9 operating system.

modprobe -n -v cramfs 2>&1 | grep -i 'install /bin/true'
lsmod | grep cramfs

# Disable cramfs, squashfs, udf:
cat <<EOF > /etc/modprobe.d/cis-disable-fs.conf
install cramfs /bin/true
install squashfs /bin/true
install udf /bin/true
EOF
echo "blacklist cramfs" >> /etc/modprobe.d/cis-blacklist.conf
echo "blacklist squashfs" >> /etc/modprobe.d/cis-blacklist.conf
echo "blacklist udf" >> /etc/modprobe.d/cis-blacklist.conf

This recommendation addresses the proper configuration of GPG Keys on the Rocky Linux 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of GPG Keys can lead to security gaps that may be exploited by attackers. A properly configured Rocky Linux 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

rpm -qa gpg-pubkey*
# Should show Rocky Linux GPG keys installed

rpm --import https://dl.rockylinux.org/pub/rocky/RPM-GPG-KEY-Rocky-9

This recommendation verifies that gpgcheck Is Globally Activated on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to gpgcheck Is Globally Activated may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep ^gpgcheck /etc/dnf/dnf.conf
grep -r ^gpgcheck /etc/yum.repos.d/
# All should be gpgcheck=1

sed -i 's/^gpgcheck=0/gpgcheck=1/' /etc/dnf/dnf.conf

xinetd should not be installed on the Rocky Linux 9 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If xinetd remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

rpm -q xinetd
# Should be "package xinetd is not installed"

dnf remove xinetd

Avahi Server should not be running on the Rocky Linux 9 operating system. Removing or disabling this component reduces the attack surface and prevents potential exploitation of unnecessary services or features.

If Avahi Server remains running, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

systemctl is-active avahi-daemon
systemctl is-enabled avahi-daemon

systemctl stop avahi-daemon
systemctl disable avahi-daemon
systemctl mask avahi-daemon

This setting enforces that CUPS Is Not Running Unless is required on the Rocky Linux 9 operating system. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to cUPS Is Not Running Unless Required may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-active cups
rpm -q cups

systemctl stop cups
systemctl disable cups
dnf remove cups

This recommendation addresses the proper configuration of chrony on the Rocky Linux 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of chrony can lead to security gaps that may be exploited by attackers. A properly configured Rocky Linux 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

systemctl is-active chronyd
grep -E '^(server|pool)' /etc/chrony.conf

dnf install chrony
systemctl enable --now chronyd

# In /etc/chrony.conf:
pool 2.rocky.pool.ntp.org iburst

This recommendation verifies that chrony Runs as Non-Root on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to chrony Runs as Non-Root may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep ^OPTIONS /etc/sysconfig/chronyd
# Should contain "-u chrony"

echo 'OPTIONS="-u chrony"' > /etc/sysconfig/chronyd
systemctl restart chronyd

This setting controls whether IP Forwarding is disabled on the Rocky Linux 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving IP Forwarding enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Rocky Linux 9 operating system.

sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding
# Both should be 0

cat <<EOF > /etc/sysctl.d/60-cis-network.conf
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
EOF
sysctl --system

This recommendation verifies that ICMP Redirects Are Not Accepted on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to iCMP Redirects Are Not Accepted may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
# Both should be 0

cat <<EOF >> /etc/sysctl.d/60-cis-network.conf
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
EOF
sysctl --system

This setting controls whether TCP SYN Cookies is enabled on the Rocky Linux 9 operating system. Enabling this feature strengthens the security posture by enforcing the recommended configuration via system configuration files, sysctl, or systemd settings.

Without TCP SYN Cookies enabled, the Rocky Linux 9 operating system may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

sysctl net.ipv4.tcp_syncookies
# Should be 1

echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.d/60-cis-network.conf
sysctl --system

This recommendation verifies that firewalld Is Installed and Running on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to firewalld Is Installed and Running may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q firewalld
systemctl is-active firewalld
systemctl is-enabled firewalld

dnf install firewalld
systemctl enable --now firewalld

This recommendation configures Default Zone to drop on the Rocky Linux 9 operating system. Setting this value appropriately ensures the system operates within the security parameters defined by the CIS benchmark.

An improperly configured value for Default Zone could weaken security controls or allow unintended behavior. Setting this to drop ensures the Rocky Linux 9 operating system operates within a well-defined security boundary.

firewall-cmd --get-default-zone
# Should be "drop" or "block"

firewall-cmd --set-default-zone=drop

This recommendation verifies that rsyslog Is Installed and Running on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to rsyslog Is Installed and Running may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q rsyslog
systemctl is-active rsyslog

dnf install rsyslog
systemctl enable --now rsyslog

This recommendation verifies that journald Is Configured for Persistent Storage on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to journald Is Configured for Persistent Storage may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i '^Storage' /etc/systemd/journald.conf
# Should be Storage=persistent

sed -i 's/^#\?Storage=.*/Storage=persistent/' /etc/systemd/journald.conf
systemctl restart systemd-journald

This recommendation verifies that auditd Is Installed and Running on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to auditd Is Installed and Running may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q audit
systemctl is-active auditd

dnf install audit
systemctl enable --now auditd

This recommendation verifies that Audit Rules for Time Changes Are Set on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to audit Rules for Time Changes Are Set may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep time-change

cat <<EOF > /etc/audit/rules.d/cis-time-change.rules
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
EOF
augenrules --load

This recommendation verifies that Audit Rules for Identity Changes Are Set on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to audit Rules for Identity Changes Are Set may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep identity

cat <<EOF > /etc/audit/rules.d/cis-identity.rules
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
EOF
augenrules --load

File and directory permissions for sshd_config should be set to Correct. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the Rocky Linux 9 operating system.

Incorrect permissions on sshd_config could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

stat -c '%a %U:%G' /etc/ssh/sshd_config
# Should be 600 root:root

chown root:root /etc/ssh/sshd_config
chmod 600 /etc/ssh/sshd_config

This setting controls whether Root Login via SSH is disabled on the Rocky Linux 9 operating system. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Root Login via SSH enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Rocky Linux 9 operating system.

sshd -T | grep permitrootlogin
# Should be "permitrootlogin no"

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation configures the timeout for SSH Idle on the Rocky Linux 9 operating system. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to sSH Idle Timeout Is Set may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep -E 'clientaliveinterval|clientalivecountmax'

# In /etc/ssh/sshd_config:
ClientAliveInterval 300
ClientAliveCountMax 3
systemctl reload sshd

This recommendation verifies that Strong SSH Ciphers and MACs on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to strong SSH Ciphers and MACs may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep ciphers
sshd -T | grep macs

# In /etc/ssh/sshd_config:
Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
systemctl reload sshd

This recommendation verifies that Password Quality Requirements Are Set on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Quality Requirements Are Set may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^(minlen|minclass|dcredit|ucredit|ocredit|lcredit)' /etc/security/pwquality.conf

# In /etc/security/pwquality.conf:
minlen = 14
minclass = 4
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

This recommendation addresses the proper configuration of Password Lockout on the Rocky Linux 9 operating system. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Password Lockout can lead to security gaps that may be exploited by attackers. A properly configured Rocky Linux 9 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E 'pam_faillock' /etc/pam.d/system-auth /etc/pam.d/password-auth

# In /etc/security/faillock.conf:
deny = 5
unlock_time = 900
fail_interval = 900

This recommendation verifies that Password Hashing Algorithm Is SHA-512 on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Hashing Algorithm Is SHA-512 may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E 'pam_unix.*sha512' /etc/pam.d/system-auth
authselect current

authselect select sssd with-faillock with-mkhomedir --force
# Ensure sha512 is in pam_unix or authselect profile

This recommendation verifies that AIDE Is Installed on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aIDE Is Installed may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

rpm -q aide

dnf install aide
aide --init
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

This recommendation verifies that AIDE Runs on a Schedule on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to aIDE Runs on a Schedule may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-enabled aidecheck.timer 2>/dev/null || crontab -l | grep aide

# Option 1: systemd timer
systemctl enable --now aidecheck.timer

# Option 2: cron
echo "0 5 * * * /usr/sbin/aide --check" | crontab -

This recommendation verifies that No Accounts Have Empty Passwords on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Accounts Have Empty Passwords may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "" ) { print $1 }' /etc/shadow

# Lock accounts with empty passwords:
passwd -l <username>
# Or set a strong password

This recommendation verifies that Root Is the Only UID 0 Account on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to root Is the Only UID 0 Account may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '$3 == 0 { print $1 }' /etc/passwd
# Should only return "root"

# Remove or reassign UID for any non-root UID 0 accounts

This recommendation verifies that Default Umask Is 027 or More Restrictive on the Rocky Linux 9 operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Umask Is 027 or More Restrictive may leave the Rocky Linux 9 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^umask' /etc/profile /etc/bashrc /etc/profile.d/*.sh

# In /etc/profile and /etc/bashrc:
umask 027