CIS Ubiquiti UniFi Benchmark

This recommendation verifies that UniFi Network Application is up to date on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check UniFi Controller version:
java -jar /usr/lib/unifi/lib/ace.jar info
cat /usr/lib/unifi/data/system.properties | grep -i version
dpkg -l unifi 2>/dev/null

# Update UniFi Network Application:
sudo apt-get update && sudo apt-get install -y unifi
# Or download latest:
# https://dl.ui.com/unifi/<version>/unifi_sysvinit_all.deb
sudo systemctl restart unifi

This recommendation verifies that a valid TLS certificate is installed on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check controller HTTPS certificate:
openssl s_client -connect localhost:8443 -brief 2>/dev/null | head -5
ls -la /usr/lib/unifi/data/keystore

# Replace self-signed certificate:
# Import custom certificate:
java -jar /usr/lib/unifi/lib/ace.jar import_cert \
  /etc/ssl/certs/unifi.crt \
  /etc/ssl/private/unifi.key \
  /etc/ssl/certs/chain.crt

sudo systemctl restart unifi

This recommendation verifies that separate admin accounts with least-privilege roles on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check admin accounts:
# Via UniFi API:
curl -sk -b /tmp/unifi_cookie -X POST \
  https://localhost:8443/api/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"password"}'

curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/cmd/sitemgr \
  -d '{"cmd":"get-admins"}'

# Create separate admin accounts with least-privilege:
# Settings > Admins > Add New Admin
# Assign role: Read Only, Limited Admin, or Full Management
# Remove default admin account after creating named accounts

# Enable 2FA for all admins:
# UI Account > Enable Two-Factor Authentication

This recommendation verifies that VLANs are used for network segmentation on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VLANs via API:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/networkconf | \
  python3 -c 'import sys,json; [print(n["name"],n.get("vlan_enabled",False),n.get("vlan","N/A")) for n in json.load(sys.stdin)["data"]]'

# Create VLANs for network segmentation:
# Settings > Networks > Create New Network
# - Network Name: IoT
# - VLAN ID: 30
# - Gateway/Subnet: 10.0.30.1/24
# - DHCP Mode: DHCP Server
# - Isolation: Enable

# Create separate VLANs for: Management, Servers, Users, IoT, Guest

This recommendation verifies that inter-VLAN firewall rules restrict traffic on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firewall rules:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/firewallrule | \
  python3 -c 'import sys,json; [print(r["name"],r["action"],r["ruleset"]) for r in json.load(sys.stdin)["data"]]'

# Create inter-VLAN firewall rules:
# Settings > Firewall & Security > Firewall Rules
# Rule: Block IoT to Management
#   Type: LAN In, Action: Drop
#   Source: IoT Network, Dest: Management Network

# Rule: Block Guest to all LAN
#   Type: LAN In, Action: Drop
#   Source: Guest Network, Dest: All LAN Networks

This recommendation verifies that UPnP is disabled on WAN interface on the Ubiquiti UniFi network management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubiquiti UniFi network management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check UPnP status:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/connectivity | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print("UPnP:",d.get("upnp_enabled","unknown"))'

# Disable UPnP:
# Settings > Internet > WAN > Advanced
# Disable: Enable UPnP

# Via API:
curl -sk -b /tmp/unifi_cookie -X PUT \
  https://localhost:8443/api/s/default/set/setting/connectivity \
  -H 'Content-Type: application/json' \
  -d '{"upnp_enabled":false}'

This recommendation verifies that WPA3 or WPA2/WPA3 transitional mode is used on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List wireless networks:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/wlanconf | \
  python3 -c 'import sys,json; [print(w["name"],w.get("security","unknown"),w.get("wpa_mode","unknown")) for w in json.load(sys.stdin)["data"]]'

# Configure WPA3 for wireless networks:
# Settings > WiFi > Select Network > Security
# Security Protocol: WPA3
# or WPA2/WPA3 for transitional

# Disable legacy protocols:
# Uncheck: WPA Personal, WEP

This recommendation verifies that guest network has client isolation enabled on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check guest network isolation:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/wlanconf | \
  python3 -c 'import sys,json; [print(w["name"],"guest:",w.get("is_guest",False),"l2isolate:",w.get("l2_isolation",False)) for w in json.load(sys.stdin)["data"]]'

# Enable guest network isolation:
# Settings > WiFi > Guest Network > Advanced
# Enable: Guest Policy (client isolation)
# Enable: L2 Isolation
# Set: VLAN to dedicated Guest VLAN
# Enable: Captive Portal (optional)

This recommendation verifies that Protected Management Frames (802.11w) is enabled on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check PMKID (management frame protection):
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/wlanconf | \
  python3 -c 'import sys,json; [print(w["name"],"pmf:",w.get("pmf_mode","unknown")) for w in json.load(sys.stdin)["data"]]'

# Enable Protected Management Frames (802.11w):
# Settings > WiFi > Select Network > Advanced
# PMF: Required (or Optional for backward compatibility)

# This protects against deauthentication attacks

This recommendation verifies that all devices run latest firmware on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check device firmware versions:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/stat/device | \
  python3 -c 'import sys,json; [print(d["name"],d["model"],d.get("version","unknown"),"upgradable:",d.get("upgradable",False)) for d in json.load(sys.stdin)["data"]]'

# Update all devices to latest firmware:
# Devices > Select Device > Settings > Manage > Firmware
# Click: Update

# Bulk update via API:
curl -sk -b /tmp/unifi_cookie -X POST \
  https://localhost:8443/api/s/default/cmd/devmgr \
  -H 'Content-Type: application/json' \
  -d '{"cmd":"upgrade","mac":"<DEVICE_MAC>"}'

This recommendation verifies that SSH access to devices is disabled in production on the Ubiquiti UniFi network management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubiquiti UniFi network management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check SSH access to devices:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/mgmt | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print("SSH:",d.get("advanced_feature_enabled","unknown"))'

# Disable SSH on managed devices for production:
# Settings > System > Advanced > Device SSH Authentication
# Disable unless needed for troubleshooting

# If SSH required, set strong credentials:
# Settings > System > Advanced > Device Authentication
# Set unique username/password (not default)

This recommendation verifies that IPS is enabled in blocking mode on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check IDS/IPS settings:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/ips | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print("IPS enabled:",d.get("ips_mode","off"))'

# Enable IPS in blocking mode:
# Settings > Firewall & Security > Threat Management
# Enable: Intrusion Prevention System
# Mode: IPS (not IDS)
# Level: 5 (maximum protection)

# Enable specific categories:
# Malware, Exploits, P2P, Emerging Threats

This recommendation verifies that DNS content filtering and DPI are enabled on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS filtering:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/dpi | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print("DPI:",d.get("dpi_enabled",False))'

# Enable content filtering:
# Settings > Firewall & Security > Content Filtering
# Enable: DNS Filtering
# Level: Security (blocks malware, phishing)
# Or: Family (blocks adult content too)

# Enable DPI (Deep Packet Inspection):
# Settings > Firewall & Security > Traffic & Device Identification
# Enable: Deep Packet Inspection

This recommendation verifies that cloud remote access is disabled if not required on the Ubiquiti UniFi network management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubiquiti UniFi network management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check remote access settings:
cat /usr/lib/unifi/data/system.properties | grep -i cloud
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/super_mgmt | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print(json.dumps(d,indent=2))' | head -20

# Disable cloud-based remote access if not needed:
# Settings > System > Remote Access
# Disable: Remote Access

# If needed, ensure UI SSO account has:
# - Strong unique password
# - 2FA enabled at https://account.ui.com
# - Restrict to known IP ranges via VPN

This recommendation verifies that remote syslog is configured on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/get/setting/mgmt | \
  python3 -c 'import sys,json; d=json.load(sys.stdin)["data"][0]; print("syslog:",d.get("syslog_enabled",False),d.get("syslog_ip","none"))'

# Enable remote syslog:
# Settings > System > Logs
# Enable: Remote Logging
# Syslog Host: syslog.example.com
# Port: 514
# Facility: Local0

This recommendation verifies that alert notifications are configured on the Ubiquiti UniFi network management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubiquiti UniFi network management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check alert notifications:
curl -sk -b /tmp/unifi_cookie \
  https://localhost:8443/api/s/default/rest/alarm | \
  python3 -c 'import sys,json; data=json.load(sys.stdin)["data"]; print(f"{len(data)} alerts"); [print(a.get("msg","unknown")[:80]) for a in data[:5]]'

# Configure alert notifications:
# Settings > System > Notifications
# Enable: Push Notifications
# Enable: Email Notifications
# Configure SMTP for email alerts
# Set alert thresholds for:
#   - New device detection
#   - Rogue AP detection
#   - Firmware updates available
#   - High CPU/memory usage