CIS SonarQube Benchmark

This recommendation verifies that forced authentication is enabled and default password is changed on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication settings:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/settings/values?keys=sonar.forceAuthentication'

# Check default admin password:
curl -s -u admin:admin 'http://sonarqube.example.com:9000/api/authentication/validate'

# Force authentication for all access:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/settings/set' \
  -d 'key=sonar.forceAuthentication&value=true'

# Change default admin password:
curl -s -u admin:admin -X POST \
  'http://sonarqube.example.com:9000/api/users/change_password' \
  -d 'login=admin&previousPassword=admin&password=NEW_STRONG_PASSWORD'

This recommendation verifies that LDAP or SAML authentication is configured on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check LDAP/SAML configuration:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/settings/values?keys=sonar.security.realm'

# List users:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/users/search' | python3 -m json.tool

# Configure LDAP authentication:
# sonar.properties:
sonar.security.realm=LDAP
sonar.authenticator.downcase=true

ldap.url=ldaps://ldap.example.com:636
ldap.bindDn=cn=sonar,ou=serviceaccounts,dc=example,dc=com
ldap.bindPassword=LDAP_BIND_PASSWORD
ldap.user.baseDn=ou=users,dc=example,dc=com
ldap.user.request=(&(objectClass=inetOrgPerson)(uid={login}))
ldap.user.realNameAttribute=cn
ldap.user.emailAttribute=mail
ldap.group.baseDn=ou=groups,dc=example,dc=com
ldap.group.request=(&(objectClass=groupOfNames)(member={dn}))

This recommendation verifies that project permission templates restrict anonymous access on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check project permissions:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/permissions/search_templates' | python3 -m json.tool

# Check global permissions:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/permissions/search_global_permissions' | python3 -m json.tool

# Create permission template with least privilege:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/create_template' \
  -d 'name=restricted-project&description=Least privilege template'

# Set permissions on template:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/add_group_to_template' \
  -d 'templateName=restricted-project&groupName=sonar-users&permission=user'

# Remove 'Anyone' group browse permission:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/remove_group' \
  -d 'groupName=Anyone&permission=user&projectKey=my-project'

This recommendation verifies that role-based groups with minimal permissions are configured on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check group memberships:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/user_groups/search' | python3 -m json.tool

# Check group members:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/user_groups/users?name=sonar-administrators'

# Create role-based groups:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/user_groups/create' \
  -d 'name=developers&description=Development team'

curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/user_groups/create' \
  -d 'name=security-team&description=Security reviewers'

# Assign minimal permissions:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/add_group' \
  -d 'groupName=developers&permission=user&projectKey=my-project'

curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/add_group' \
  -d 'groupName=security-team&permission=securityhotspotadmin&projectKey=my-project'

This recommendation verifies that quality gates enforce zero new vulnerabilities on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check quality gates:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/qualitygates/list' | python3 -m json.tool

# Get default quality gate:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/qualitygates/show?name=Sonar%20way'

# Create strict quality gate:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualitygates/create' \
  -d 'name=Security-Gate'

# Add security conditions:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualitygates/create_condition' \
  -d 'gateName=Security-Gate&metric=new_security_rating&op=GT&error=1'

curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualitygates/create_condition' \
  -d 'gateName=Security-Gate&metric=new_vulnerabilities&op=GT&error=0'

curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualitygates/create_condition' \
  -d 'gateName=Security-Gate&metric=new_security_hotspots_reviewed&op=LT&error=100'

# Set as default:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualitygates/set_as_default' \
  -d 'name=Security-Gate'

This recommendation verifies that quality profiles include OWASP Top 10 security rules on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check quality profiles:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/qualityprofiles/search' | python3 -m json.tool

# Check active security rules:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/rules/search?tags=security&activation=true&qprofile=YOUR_PROFILE' | \
  python3 -c "import sys,json; print(json.load(sys.stdin)['total'])"

# Create security-focused quality profile:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualityprofiles/create' \
  -d 'language=java&name=Security-Hardened'

# Inherit from built-in and add security rules:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualityprofiles/change_parent' \
  -d 'language=java&qualityProfile=Security-Hardened&parentQualityProfile=Sonar%20way'

# Activate OWASP Top 10 rules:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/qualityprofiles/activate_rules' \
  -d 'targetKey=YOUR_PROFILE_KEY&tags=owasp-top10'

This recommendation ensures that security hotspot review workflow is enforced on the SonarQube code quality platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the SonarQube code quality platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check for pending security hotspots:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/hotspots/search?projectKey=my-project&status=TO_REVIEW' | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print(f'Pending: {d[\"paging\"][\"total\"]}')"

# Check vulnerability count:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/issues/search?projectKeys=my-project&types=VULNERABILITY&statuses=OPEN'

# Configure security hotspot review workflow:
# Ensure security team reviews all hotspots:

# Assign security hotspot admin permission:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/permissions/add_group' \
  -d 'groupName=security-team&permission=securityhotspotadmin&projectKey=my-project'

# Configure webhook for CI/CD integration:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/webhooks/create' \
  -d 'name=ci-pipeline&project=my-project&url=https://ci.example.com/sonar-webhook&secret=WEBHOOK_SECRET'

This setting ensures that plugins are reviewed, updated, and restricted on the SonarQube code quality platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the SonarQube code quality platform is essential for defense in depth.

# Check installed plugins:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/plugins/installed' | \
  python3 -c "import sys,json; [print(p['key'], p['version']) for p in json.load(sys.stdin)['plugins']]"

# Check for plugin updates:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/plugins/updates'

# Review and restrict plugins:
# Remove unnecessary plugins:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/plugins/uninstall' \
  -d 'key=unnecessary-plugin'

# Update outdated plugins:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/plugins/update' \
  -d 'key=plugin-to-update'

# Restrict plugin installation (sonar.properties):
sonar.updatecenter.activate=false

# Restart to apply:
systemctl restart sonarqube

This recommendation verifies that PostgreSQL database with SSL encryption is used on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database backend:
grep sonar.jdbc /opt/sonarqube/conf/sonar.properties | grep -v '^#'

# Check database connection encryption:
grep -i ssl /opt/sonarqube/conf/sonar.properties

# Configure PostgreSQL with SSL:
# sonar.properties:
sonar.jdbc.url=jdbc:postgresql://db.example.com:5432/sonarqube?ssl=true&sslmode=verify-full&sslrootcert=/etc/sonarqube/certs/ca.pem
sonar.jdbc.username=sonarqube
sonar.jdbc.password=STRONG_DB_PASSWORD
sonar.jdbc.maxActive=60
sonar.jdbc.maxIdle=5

# Ensure H2 is NOT used in production:
# Verify: sonar.jdbc.url should NOT contain 'h2'

This recommendation verifies that SonarQube is behind a reverse proxy with HTTPS on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web server settings:
grep -E 'sonar.(web|path)' /opt/sonarqube/conf/sonar.properties | grep -v '^#'

# Check reverse proxy headers:
curl -sI https://sonarqube.example.com | head -10

# Configure secure web server settings:
# sonar.properties:
sonar.web.host=127.0.0.1
sonar.web.port=9000
sonar.web.context=/sonar

# Run behind reverse proxy with HTTPS:
# nginx configuration:
server {
    listen 443 ssl http2;
    server_name sonarqube.example.com;
    ssl_certificate /etc/ssl/sonarqube.crt;
    ssl_certificate_key /etc/ssl/sonarqube.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    location /sonar {
        proxy_pass http://127.0.0.1:9000/sonar;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

This recommendation verifies that SonarQube runs as a dedicated non-root user on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SonarQube process user:
ps aux | grep sonarqube | grep -v grep

# Check file permissions:
ls -la /opt/sonarqube/conf/sonar.properties
ls -la /opt/sonarqube/data/

# Run SonarQube as dedicated user:
useradd -r -s /bin/false sonarqube
chown -R sonarqube:sonarqube /opt/sonarqube
chmod 600 /opt/sonarqube/conf/sonar.properties
chmod 700 /opt/sonarqube/data /opt/sonarqube/logs

# Systemd service:
cat > /etc/systemd/system/sonarqube.service << 'EOF'
[Unit]
Description=SonarQube
After=network.target postgresql.service

[Service]
Type=forking
User=sonarqube
Group=sonarqube
ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop
Restart=on-failure
LimitNOFILE=131072
LimitNPROC=8192

[Install]
WantedBy=multi-user.target
EOF

This recommendation verifies that project-specific analysis tokens are used on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check token management:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/user_tokens/search' | python3 -m json.tool

# Check global analysis token setting:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/settings/values?keys=sonar.global.token'

# Create project-specific analysis tokens:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/user_tokens/generate' \
  -d 'name=ci-my-project&type=PROJECT_ANALYSIS_TOKEN&projectKey=my-project'

# Revoke old tokens:
curl -s -u admin:$SONAR_PASS -X POST \
  'http://sonarqube.example.com:9000/api/user_tokens/revoke' \
  -d 'name=old-token-name&login=username'

# Use token in CI/CD:
# sonar-scanner -Dsonar.token=$SONAR_TOKEN \
#   -Dsonar.projectKey=my-project \
#   -Dsonar.host.url=https://sonarqube.example.com

This recommendation verifies that automated database and configuration backups are configured on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup status:
ls -la /var/backups/sonarqube/

# Check database backup:
pg_dump --help > /dev/null 2>&1

# Configure automated backups:
cat > /etc/cron.d/sonarqube-backup << 'EOF'
0 2 * * * postgres pg_dump -Fc sonarqube > /var/backups/sonarqube/db-$(date +\%Y\%m\%d).dump
0 3 * * * root tar czf /var/backups/sonarqube/data-$(date +\%Y\%m\%d).tar.gz \
  /opt/sonarqube/conf /opt/sonarqube/extensions /opt/sonarqube/data/es7
find /var/backups/sonarqube/ -mtime +14 -delete
EOF

mkdir -p /var/backups/sonarqube
chmod 700 /var/backups/sonarqube

This recommendation verifies that SonarQube is kept up to date with latest releases on the SonarQube code quality platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the SonarQube code quality platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SonarQube version:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/system/info' | python3 -c "import sys,json; print(json.load(sys.stdin).get('System',{}).get('Version','unknown'))"

# Check system health:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/system/health'

# Maintain SonarQube updates:
# Check for upgrades:
curl -s -u admin:$SONAR_PASS \
  'http://sonarqube.example.com:9000/api/system/upgrades'

# Update procedure:
systemctl stop sonarqube
cp -a /opt/sonarqube /opt/sonarqube.bak
pg_dump -Fc sonarqube > /var/backups/sonarqube/pre-upgrade.dump

# Download and extract new version:
cd /opt && wget https://binaries.sonarsource.com/Distribution/sonarqube/sonarqube-VERSION.zip
unzip sonarqube-VERSION.zip
cp sonarqube.bak/conf/sonar.properties sonarqube-VERSION/conf/
cp -a sonarqube.bak/extensions/plugins/* sonarqube-VERSION/extensions/plugins/
chown -R sonarqube:sonarqube sonarqube-VERSION
ln -sfn sonarqube-VERSION sonarqube
systemctl start sonarqube