CIS Ubuntu Linux 22.04 LTS Benchmark

Mount /tmp as a separate partition (or via tmpfs) with nodev, nosuid, and noexec options. This prevents attacks that use /tmp for code execution or privilege escalation.

Failure to /tmp is a Separate Partition may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if /tmp is a separate mount:
findmnt -n /tmp
# Should show a dedicated partition or tmpfs

# Check mount options:
findmnt -n /tmp | grep -E 'nodev|nosuid|noexec'
# All three should be present

# Add to /etc/fstab:
tmpfs  /tmp  tmpfs  defaults,rw,nosuid,nodev,noexec,relatime  0 0

# Or configure via systemd:
systemctl enable tmp.mount

Mount /var/tmp with noexec, nodev, and nosuid options to prevent executable files from being run from this temporary directory.

Failure to /var/tmp Includes noexec Option may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt -n /var/tmp
# Should show noexec,nodev,nosuid in mount options

# Add to /etc/fstab (bind mount or separate partition):
/tmp  /var/tmp  none  bind,nosuid,nodev,noexec  0 0

Disable loading of unused filesystem kernel modules (cramfs, squashfs, udf, usb-storage) to reduce the attack surface of the system.

Leaving Unused Filesystems enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Ubuntu 22.04 operating system.

# Check each filesystem module:
for fs in cramfs squashfs udf; do
  echo "=== $fs ==="
  modprobe -n -v "$fs" 2>&1
  lsmod | grep "$fs"
done
# modprobe should show "install /bin/true" or "install /bin/false"
# lsmod should show nothing

# Create /etc/modprobe.d/cis-filesystems.conf:
install cramfs /bin/false
install squashfs /bin/false
install udf /bin/false

# Blacklist the modules:
echo "blacklist cramfs" >> /etc/modprobe.d/blacklist.conf
echo "blacklist squashfs" >> /etc/modprobe.d/blacklist.conf
echo "blacklist udf" >> /etc/modprobe.d/blacklist.conf

Ensure APT repositories are properly configured for the system. Repositories should include security updates and only trusted sources.

Misconfiguration of Package Manager Repositories can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

apt-cache policy
# Review configured sources and ensure security repositories are included

grep -r "^deb " /etc/apt/sources.list /etc/apt/sources.list.d/
# Verify only trusted repositories are configured

Configure appropriate Ubuntu repositories including jammy-security. Remove any untrusted third-party repositories.

Ensure GPG keys are configured for all APT repositories to verify package integrity and authenticity.

Misconfiguration of GPG Keys can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

apt-key list 2>/dev/null
# Or for newer systems:
ls /etc/apt/trusted.gpg.d/
# Review keys and ensure they correspond to configured repos

Import GPG keys for all configured repositories. Remove keys for repositories that are no longer in use.

AppArmor provides Mandatory Access Control that confines programs to a limited set of resources. It should be installed, enabled at boot, and all profiles should be in enforce or complain mode.

Failure to appArmor is Installed and Enabled may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if installed:
dpkg -s apparmor | grep Status
# Should be: install ok installed

# Check if enabled at boot:
grep "apparmor=1" /proc/cmdline
# Or:
systemctl is-enabled apparmor

# Check profile status:
aa-status
# All profiles should be in enforce mode

apt install apparmor apparmor-utils -y
systemctl enable apparmor
# Ensure GRUB_CMDLINE_LINUX includes "apparmor=1 security=apparmor"
# Then: update-grub

Set all AppArmor profiles to enforce mode. Complain mode logs violations but does not block them — enforce mode actively prevents unauthorized actions.

Failure to all AppArmor Profiles are in Enforce Mode may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

aa-status
# "profiles in complain mode" should be 0
# "processes unconfined" should be 0 (ideally)

# Set all profiles to enforce:
aa-enforce /etc/apparmor.d/*

Remove xinetd if installed. xinetd manages legacy network services (telnet, rsh, etc.) that are insecure and should not be used.

If xinetd remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s xinetd 2>/dev/null | grep Status
# Should not be installed

apt purge xinetd -y

Remove the Avahi mDNS/DNS-SD daemon. Avahi performs zero-configuration networking which is unnecessary on servers and expands the attack surface.

If Avahi Server remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s avahi-daemon 2>/dev/null | grep Status
# Should not be installed

systemctl is-enabled avahi-daemon 2>/dev/null
# Should fail or return disabled

systemctl stop avahi-daemon
apt purge avahi-daemon -y

Remove CUPS print server if not needed. CUPS listens on port 631 and has had multiple vulnerabilities. Only install on designated print servers.

If CUPS remains installed, it presents an unnecessary risk vector that attackers could exploit. Removing or disabling unused components is a fundamental principle of secure system hardening.

dpkg -s cups 2>/dev/null | grep Status
# Should not be installed

apt purge cups -y

Disable IP forwarding unless the server is a router. IP forwarding allows the system to act as a gateway, which could be exploited for lateral movement.

Leaving IP Forwarding enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Ubuntu 22.04 operating system.

sysctl net.ipv4.ip_forward
# Should be 0

sysctl net.ipv6.conf.all.forwarding
# Should be 0

# Add to /etc/sysctl.d/60-cis.conf:
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Apply:
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv6.conf.all.forwarding=0

Reject ICMP redirect messages. Malicious ICMP redirects can alter routing tables and redirect traffic through an attacker-controlled host (man-in-the-middle).

Failure to iCMP Redirects are Not Accepted may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
# Both should be 0

# /etc/sysctl.d/60-cis.conf:
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

sysctl --system

Reject source-routed packets. Source routing allows senders to specify the route, which can bypass network security measures.

Failure to source Routed Packets are Not Accepted may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route
# Both should be 0

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

Install and enable Uncomplicated Firewall (UFW) or nftables. A host-based firewall is essential for controlling inbound and outbound traffic.

Failure to uFW is Installed and Enabled may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s ufw | grep Status
# Should be installed

ufw status
# Should show: Status: active

apt install ufw -y
ufw allow ssh   # Allow SSH before enabling!
ufw enable

Set the default firewall policy to deny all incoming traffic. Only explicitly allowed services should be reachable.

Failure to uFW Default Deny Policy may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ufw status verbose | grep "Default:"
# Should show: Default: deny (incoming), allow (outgoing), deny (routed)

ufw default deny incoming
ufw default allow outgoing
ufw default deny routed

Configure journald to store logs persistently (under /var/log/journal/) instead of volatile storage. Persistent logs survive reboots and are essential for forensics.

Failure to journald is Configured to Write to Persistent Storage may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E "^Storage=" /etc/systemd/journald.conf
# Should be: Storage=persistent

ls /var/log/journal/
# Directory should exist and contain log data

# Edit /etc/systemd/journald.conf:
# [Journal]
# Storage=persistent

systemctl restart systemd-journald

Install and enable rsyslog for traditional syslog message handling, remote log forwarding, and granular log file management.

Failure to rsyslog is Installed and Enabled may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s rsyslog | grep Status
systemctl is-enabled rsyslog
# Should be enabled

apt install rsyslog -y
systemctl enable rsyslog
systemctl start rsyslog

Install and enable auditd for Linux kernel audit framework. auditd provides detailed auditing of system calls, file access, and security events.

Failure to auditd is Installed and Enabled may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -s auditd | grep Status
systemctl is-enabled auditd
# Should be enabled

apt install auditd audispd-plugins -y
systemctl enable auditd
systemctl start auditd

Configure the maximum audit log file size to ensure adequate storage. The log file size should be large enough to retain sufficient history for investigation.

Misconfiguration of Audit Log Storage Size can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep max_log_file /etc/audit/auditd.conf
# Should be set to an appropriate value (e.g., 8 MB or larger)

# Edit /etc/audit/auditd.conf:
max_log_file = 8
max_log_file_action = keep_logs

Disable direct root login via SSH. Administrators should log in with named accounts and use sudo. This provides accountability and prevents brute-force attacks against root.

Leaving SSH Root Login enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Ubuntu 22.04 operating system.

sshd -T | grep permitrootlogin
# Should be: permitrootlogin no

# Edit /etc/ssh/sshd_config:
PermitRootLogin no

systemctl reload sshd

Ensure only SSH protocol version 2 is used. SSH v1 has known cryptographic weaknesses and should never be enabled. Note: OpenSSH 7.4+ removed SSH v1 support entirely.

An improperly configured value for SSH Protocol could weaken security controls or allow unintended behavior. Setting this to 2 ensures the Ubuntu 22.04 operating system operates within a well-defined security boundary.

sshd -T | grep protocol
# Should not show protocol 1
# Modern OpenSSH only supports v2 by default

Ensure no Protocol 1 directive exists in sshd_config. OpenSSH 7.4+ uses v2 exclusively.

Limit SSH authentication attempts to 4 or fewer per connection to slow brute-force attacks and reduce audit log noise.

An improperly configured value for SSH MaxAuthTries could weaken security controls or allow unintended behavior. Setting this to 4 or Less ensures the Ubuntu 22.04 operating system operates within a well-defined security boundary.

sshd -T | grep maxauthtries
# Should be: maxauthtries 4 (or less)

# /etc/ssh/sshd_config:
MaxAuthTries 4

systemctl reload sshd

Disallow login to accounts with empty passwords via SSH. All accounts accessible via SSH must have passwords or key-based authentication configured.

Leaving SSH PermitEmptyPasswords enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Ubuntu 22.04 operating system.

sshd -T | grep permitemptypasswords
# Should be: permitemptypasswords no

# /etc/ssh/sshd_config:
PermitEmptyPasswords no

systemctl reload sshd

Configure password complexity requirements using pam_pwquality. Enforce minimum length, character diversity, and dictionary checks.

Misconfiguration of Password Creation Requirements can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

grep -E '^\s*minlen|^\s*minclass|^\s*dcredit|^\s*ucredit|^\s*lcredit|^\s*ocredit' /etc/security/pwquality.conf
# Minimum: minlen = 14, minclass = 4 (or individual credit settings)

# /etc/security/pwquality.conf:
minlen = 14
minclass = 4
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1

Configure pam_pwhistory or pam_unix to remember at least 5 previous passwords, preventing users from cycling through a small set of passwords.

Unrestricted Password Reuse could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Ubuntu 22.04 operating system is essential for defense in depth.

grep -E "pam_pwhistory|remember=" /etc/pam.d/common-password
# Should include: remember=5 (or higher)

# Edit /etc/pam.d/common-password:
password required pam_pwhistory.so remember=5 retry=3

Set the maximum password age to 365 days or less to ensure passwords are rotated periodically, limiting the window of exposure from compromised credentials.

Failure to password Expiration is 365 Days or Less may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep PASS_MAX_DAYS /etc/login.defs
# Should be: PASS_MAX_DAYS 365 (or less)

# Check individual users:
awk -F: '/^[^:]+:[^!*]/ {print $1,$5}' /etc/shadow

# /etc/login.defs:
PASS_MAX_DAYS 365

# For existing users:
chage --maxdays 365 <username>

Ensure no user accounts have empty password fields in /etc/shadow. Accounts with empty passwords can be logged into without any authentication.

Failure to no Accounts Have Empty Passwords may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow
# Should return no output (no empty passwords)

Lock any accounts with empty passwords: passwd -l <username>. Then set a proper password or disable the account.

Ensure only the root account has UID 0. Any other account with UID 0 has unrestricted superuser access, which violates the principle of least privilege and accountability.

Failure to root is the Only UID 0 Account may leave the Ubuntu 22.04 operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '$3 == 0 {print $1}' /etc/passwd
# Should only return: root

Remove or change the UID of any non-root account with UID 0. Use usermod -u <new-uid> <username>.

Ensure /etc/passwd is owned by root and has permissions 644 or more restrictive. This file contains user account information and must not be writable by non-root users.

Misconfiguration of Permissions on /etc/passwd can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

stat /etc/passwd
# Should show: Access: (0644/-rw-r--r--)  Uid: (0/root)   Gid: (0/root)

chown root:root /etc/passwd
chmod 644 /etc/passwd

Ensure /etc/shadow is owned by root, group shadow, with permissions 640 or more restrictive. This file contains password hashes and must be protected from unauthorized access.

Misconfiguration of Permissions on /etc/shadow can lead to security gaps that may be exploited by attackers. A properly configured Ubuntu 22.04 operating system reduces exposure to both known vulnerabilities and configuration drift.

stat /etc/shadow
# Should show: Access: (0640/-rw-r-----)  Uid: (0/root)   Gid: (42/shadow)

chown root:shadow /etc/shadow
chmod 640 /etc/shadow

Ensure no files on the system are world-writable. World-writable files can be modified by any user and are a common target for privilege escalation attacks.

The absence of No World-Writable Files leaves the Ubuntu 22.04 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Should return no results

Remove the world-writable bit from identified files: chmod o-w <file>. Investigate why each file was world-writable before changing.

Ensure no files are owned by non-existent users or groups. Unowned files can indicate leftover accounts from removed packages or security breaches.

The absence of No Unowned or Ungrouped Files leaves the Ubuntu 22.04 operating system without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

# Find unowned files:
find / -xdev -nouser -ls 2>/dev/null

# Find ungrouped files:
find / -xdev -nogroup -ls 2>/dev/null
# Both should return no results

Assign appropriate ownership to any unowned files or remove them if no longer needed: chown <user>:<group> <file>.