CIS Ubuntu Linux 24.04 LTS Benchmark

This recommendation verifies that /tmp Is a Separate Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp
# Verify output shows /tmp is mounted as a separate partition

systemctl is-enabled tmp.mount

# Enable tmp.mount if not active
systemctl unmask tmp.mount
systemctl enable --now tmp.mount

# Or add to /etc/fstab:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0

This recommendation verifies that nodev Option Is Set on /tmp Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nodev
# Verify nodev option is set

# Edit /etc/fstab and add nodev to /tmp mount options:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0
mount -o remount /tmp

This recommendation verifies that nosuid Option Is Set on /tmp Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep nosuid
# Verify nosuid option is set

# Edit /etc/fstab and add nosuid to /tmp mount options:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0
mount -o remount /tmp

This recommendation verifies that noexec Option Is Set on /tmp Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /tmp | grep noexec
# Verify noexec option is set

# Edit /etc/fstab and add noexec to /tmp mount options:
# tmpfs /tmp tmpfs defaults,rw,nosuid,nodev,noexec,relatime,size=2G 0 0
mount -o remount /tmp

This recommendation verifies that /var Is a Separate Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var
# Verify /var is a separate partition

# Create a separate partition for /var during OS installation
# Or migrate an existing /var:
# 1. Create logical volume: lvcreate -L 10G -n var_lv vg0
# 2. Format: mkfs.ext4 /dev/vg0/var_lv
# 3. Copy data and update /etc/fstab:
# /dev/vg0/var_lv /var ext4 defaults 0 0

This recommendation verifies that /var/tmp Is a Separate Partition on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

findmnt --kernel /var/tmp
# Verify /var/tmp is a separate partition
findmnt --kernel /var/tmp | grep -E 'nodev|nosuid|noexec'

# Add to /etc/fstab:
# /dev/vg0/vartmp_lv /var/tmp ext4 defaults,nosuid,nodev,noexec 0 0
mount -o remount /var/tmp

This recommendation verifies that GPG Keys Are Configured for APT on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

apt-key list 2>/dev/null
# Verify Ubuntu archive signing keys are present

# Check for trusted GPG keys:
ls /etc/apt/trusted.gpg.d/
ls /usr/share/keyrings/

# Import the Ubuntu archive signing key if missing:
wget -qO - https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x871920D1991BC93C | gpg --dearmor -o /usr/share/keyrings/ubuntu-archive.gpg

# Remove untrusted third-party keys from trusted.gpg.d/

This recommendation verifies that Only Authenticated Repositories Are Used on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -r 'AllowUnauthenticated\|AllowInsecureRepositories' /etc/apt/
# Should return empty — no insecure repos allowed

apt-config dump | grep -i allow

# Remove any AllowUnauthenticated or AllowInsecureRepositories entries:
sed -i '/AllowUnauthenticated/d' /etc/apt/apt.conf.d/*
sed -i '/AllowInsecureRepositories/d' /etc/apt/apt.conf.d/*

This recommendation verifies that Automatic Updates Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

systemctl is-enabled unattended-upgrades
systemctl is-active unattended-upgrades

cat /etc/apt/apt.conf.d/20auto-upgrades

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# Verify /etc/apt/apt.conf.d/20auto-upgrades contains:
# APT::Periodic::Update-Package-Lists "1";
# APT::Periodic::Unattended-Upgrade "1";

This recommendation verifies that Package Integrity Is Verified on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg --verify | head -20
# Review any unexpected changes to installed packages

debsums -s 2>/dev/null | head -20

apt install -y debsums
debsums -s
# Investigate and reinstall any packages with verification failures:
apt reinstall <package_name>

This recommendation verifies that xinetd Is Not Installed on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

dpkg -l xinetd 2>/dev/null | grep ^ii
# Should return empty

apt purge -y xinetd

This recommendation verifies that Avahi Server Is Not Running on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active avahi-daemon
systemctl is-enabled avahi-daemon
# Both should return "inactive" / "disabled"

systemctl stop avahi-daemon
systemctl disable avahi-daemon
systemctl mask avahi-daemon
apt purge -y avahi-daemon

This recommendation verifies that CUPS Is Not Running Unless Required on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active cups
systemctl is-enabled cups
# Should be inactive/disabled unless print services are required

systemctl stop cups
systemctl disable cups
# If not needed at all:
apt purge -y cups

This recommendation verifies that DHCP Server Is Not Running Unless Required on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active isc-dhcp-server
systemctl is-enabled isc-dhcp-server
# Should be inactive unless this is a designated DHCP server

systemctl stop isc-dhcp-server
systemctl disable isc-dhcp-server
apt purge -y isc-dhcp-server

This recommendation verifies that DNS Server Is Not Running Unless Required on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

systemctl is-active named bind9
systemctl is-enabled named bind9
# Should be inactive unless this is a designated DNS server

systemctl stop bind9
systemctl disable bind9
apt purge -y bind9

This recommendation verifies that NIS Client Is Not Installed on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

dpkg -l nis 2>/dev/null | grep ^ii
# Should return empty (NIS/yp client not installed)

apt purge -y nis

This recommendation verifies that rsh Client Is Not Installed on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

dpkg -l rsh-client 2>/dev/null | grep ^ii
# Should return empty

apt purge -y rsh-client

This recommendation verifies that telnet Client Is Not Installed on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

dpkg -l telnet 2>/dev/null | grep ^ii
# Should return empty

apt purge -y telnet

This recommendation verifies that LDAP Client Is Not Installed Unless Required on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

dpkg -l ldap-utils 2>/dev/null | grep ^ii
# Should return empty unless LDAP is required

apt purge -y ldap-utils

This recommendation verifies that IP Forwarding Is Disabled on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.ip_forward
# Should return: net.ipv4.ip_forward = 0

sysctl net.ipv6.conf.all.forwarding
# Should return: net.ipv6.conf.all.forwarding = 0

# Set in /etc/sysctl.d/60-netipv4.conf:
printf 'net.ipv4.ip_forward = 0\n' >> /etc/sysctl.d/60-netipv4.conf
printf 'net.ipv6.conf.all.forwarding = 0\n' >> /etc/sysctl.d/60-netipv6.conf
sysctl -w net.ipv4.ip_forward=0
sysctl -w net.ipv6.conf.all.forwarding=0

This recommendation verifies that Packet Redirect Sending Is Disabled on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sysctl net.ipv4.conf.all.send_redirects
sysctl net.ipv4.conf.default.send_redirects
# Both should return 0

printf 'net.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.default.send_redirects = 0\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.send_redirects=0
sysctl -w net.ipv4.conf.default.send_redirects=0

This recommendation verifies that Source Routed Packets Are Not Accepted on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_source_route
sysctl net.ipv4.conf.default.accept_source_route
# Both should return 0

printf 'net.ipv4.conf.all.accept_source_route = 0\nnet.ipv4.conf.default.accept_source_route = 0\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv4.conf.default.accept_source_route=0

This recommendation verifies that ICMP Redirects Are Not Accepted on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.accept_redirects
sysctl net.ipv4.conf.default.accept_redirects
# Both should return 0

printf 'net.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.default.accept_redirects = 0\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.default.accept_redirects=0

This recommendation verifies that Secure ICMP Redirects Are Not Accepted on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sysctl net.ipv4.conf.all.secure_redirects
sysctl net.ipv4.conf.default.secure_redirects
# Both should return 0

printf 'net.ipv4.conf.all.secure_redirects = 0\nnet.ipv4.conf.default.secure_redirects = 0\n' >> /etc/sysctl.d/60-netipv4.conf
sysctl -w net.ipv4.conf.all.secure_redirects=0
sysctl -w net.ipv4.conf.default.secure_redirects=0

This recommendation verifies that UFW Is Installed and Running on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -l ufw | grep ^ii
systemctl is-active ufw
ufw status verbose

apt install -y ufw
ufw enable
systemctl enable ufw

This recommendation verifies that Default Deny Firewall Policy Is Set on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ufw status verbose | grep -i 'default'
# Verify default incoming: deny, default outgoing: allow

ufw default deny incoming
ufw default allow outgoing
ufw default deny routed

This recommendation verifies that Unnecessary Services Are Removed from Firewall Rules on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

ufw status numbered
# Review all rules — remove unnecessary open ports

# Delete unnecessary rules by number:
ufw delete <rule_number>

# Or by specification:
ufw delete allow 23/tcp
ufw delete allow Samba

This recommendation verifies that IPv6 Firewall Rules Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

cat /etc/default/ufw | grep IPV6
# Should show: IPV6=yes

sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
ufw disable && ufw enable

This recommendation verifies that auditd Is Installed and Enabled on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

dpkg -l auditd | grep ^ii
systemctl is-enabled auditd
systemctl is-active auditd

apt install -y auditd audispd-plugins
systemctl enable --now auditd

This recommendation verifies that Audit Log Storage Size Is Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^max_log_file\s*=' /etc/audit/auditd.conf
# Verify max_log_file is set (e.g., 8 MB or adequate for environment)

# Edit /etc/audit/auditd.conf:
sed -i 's/^max_log_file\s*=.*/max_log_file = 8/' /etc/audit/auditd.conf
sed -i 's/^max_log_file_action\s*=.*/max_log_file_action = keep_logs/' /etc/audit/auditd.conf
systemctl restart auditd

This recommendation verifies that System Administration Actions Are Audited on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'sudoers|sudo\.log'
# Verify rules log sudo and admin actions

grep -E '/etc/sudoers|/var/log/sudo' /etc/audit/rules.d/*.rules

# Add to /etc/audit/rules.d/50-system_admin.rules:
echo '-w /etc/sudoers -p wa -k scope' >> /etc/audit/rules.d/50-system_admin.rules
echo '-w /etc/sudoers.d/ -p wa -k scope' >> /etc/audit/rules.d/50-system_admin.rules
augenrules --load

This recommendation verifies that Login and Logout Events Are Collected on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'faillog|lastlog|tallylog'
# Verify login/logout events are audited

grep -E 'faillog|lastlog|tallylog' /etc/audit/rules.d/*.rules

# Add to /etc/audit/rules.d/50-login.rules:
echo '-w /var/log/faillog -p wa -k logins' >> /etc/audit/rules.d/50-login.rules
echo '-w /var/log/lastlog -p wa -k logins' >> /etc/audit/rules.d/50-login.rules
echo '-w /var/run/utmp -p wa -k session' >> /etc/audit/rules.d/50-login.rules
augenrules --load

This recommendation verifies that Session Initiation Information Is Collected on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

auditctl -l | grep -E 'utmp|wtmp|btmp'
# Verify session initiation info is collected

grep -E 'utmp|wtmp|btmp' /etc/audit/rules.d/*.rules

# Add to /etc/audit/rules.d/50-session.rules:
echo '-w /var/run/utmp -p wa -k session' >> /etc/audit/rules.d/50-session.rules
echo '-w /var/log/wtmp -p wa -k logins' >> /etc/audit/rules.d/50-session.rules
echo '-w /var/log/btmp -p wa -k logins' >> /etc/audit/rules.d/50-session.rules
augenrules --load

This recommendation verifies that journald Is Configured to Write to Persistent Storage on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^Storage=' /etc/systemd/journald.conf
# Should show: Storage=persistent

ls -la /var/log/journal/

# Edit /etc/systemd/journald.conf:
sed -i 's/^#\?Storage=.*/Storage=persistent/' /etc/systemd/journald.conf
systemctl restart systemd-journald

This recommendation verifies that journald Is Configured to Compress Large Log Files on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^Compress=' /etc/systemd/journald.conf
# Should show: Compress=yes

sed -i 's/^#\?Compress=.*/Compress=yes/' /etc/systemd/journald.conf
systemctl restart systemd-journald

This recommendation verifies that Remote Logging Is Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\*\.\*\s+@@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
# Verify remote log server is configured
# Expected: *.* @@loghost.example.com:514

# Edit /etc/rsyslog.d/50-remote.conf:
echo '*.* @@loghost.example.com:514' > /etc/rsyslog.d/50-remote.conf
systemctl restart rsyslog

This recommendation verifies that Log File Permissions Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /var/log/syslog
stat -c '%a %U %G' /var/log/auth.log
# Permissions should be 640 or more restrictive, owned by syslog:adm

find /var/log -type f -perm /037 -ls

chmod 640 /var/log/syslog
chmod 640 /var/log/auth.log
chown syslog:adm /var/log/syslog
chown syslog:adm /var/log/auth.log

# Fix any world-readable log files:
find /var/log -type f -perm /037 -exec chmod 640 {} \;

This recommendation verifies that SSH Protocol Is Set to 2 on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i '^Protocol' /etc/ssh/sshd_config
# SSH Protocol 2 is the default in OpenSSH >= 7.4
# If present, should show: Protocol 2

sshd -T | grep protocol

# Edit /etc/ssh/sshd_config:
sed -i 's/^#\?Protocol.*/Protocol 2/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Root Login Is Disabled on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitrootlogin
# Should return: permitrootlogin no

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep permitemptypasswords
# Should return: permitemptypasswords no

sed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep maxauthtries
# Should return: maxauthtries 4 (or less)

sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH Idle Timeout Interval Is Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

sshd -T | grep -E 'clientaliveinterval|clientalivecountmax'
# clientaliveinterval should be 300 or less
# clientalivecountmax should be 3 or less

sed -i 's/^#\?ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config
sed -i 's/^#\?ClientAliveCountMax.*/ClientAliveCountMax 3/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation verifies that SSH X11 Forwarding Is Disabled on the Ubuntu 24.04 LTS Linux operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Ubuntu 24.04 LTS Linux operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

sshd -T | grep x11forwarding
# Should return: x11forwarding no

sed -i 's/^#\?X11Forwarding.*/X11Forwarding no/' /etc/ssh/sshd_config
systemctl reload sshd

This recommendation ensures that Password Creation Requirements Are Configured on the Ubuntu 24.04 LTS Linux operating system. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Ubuntu 24.04 LTS Linux operating system may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

grep -E '^\s*minlen|dcredit|ucredit|ocredit|lcredit' /etc/security/pwquality.conf
# minlen should be >= 14
# dcredit, ucredit, ocredit, lcredit should be <= -1

# Edit /etc/security/pwquality.conf:
sed -i 's/^#\? *minlen.*/minlen = 14/' /etc/security/pwquality.conf
sed -i 's/^#\? *dcredit.*/dcredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ucredit.*/ucredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *ocredit.*/ocredit = -1/' /etc/security/pwquality.conf
sed -i 's/^#\? *lcredit.*/lcredit = -1/' /etc/security/pwquality.conf

This setting ensures that Password Reuse Is Limited on the Ubuntu 24.04 LTS Linux operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Ubuntu 24.04 LTS Linux operating system is essential for defense in depth.

grep -E '^\s*password.*remember' /etc/pam.d/common-password
# Verify remember is set to 5 or more

# Edit /etc/pam.d/common-password:
# Add or modify the pam_unix line:
# password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5
sed -i '/pam_unix.so/ s/$/& remember=5/' /etc/pam.d/common-password

This recommendation verifies that Password Hashing Algorithm Is Yescrypt or SHA-512 on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^\s*password.*pam_unix' /etc/pam.d/common-password | grep -E 'yescrypt|sha512'
# Should show yescrypt (preferred) or sha512

# Edit /etc/pam.d/common-password:
# Ensure pam_unix.so has yescrypt:
sed -i 's/pam_unix.so.*/pam_unix.so obscure use_authtok try_first_pass yescrypt remember=5/' /etc/pam.d/common-password

This recommendation verifies that Lockout for Failed Password Attempts Is Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E 'pam_faillock|pam_tally2' /etc/pam.d/common-auth
# Verify account lockout is configured

faillock --user <username>

# Install and configure pam_faillock:
apt install -y libpam-modules

# Add to /etc/pam.d/common-auth (before pam_unix):
# auth required pam_faillock.so preauth silent deny=5 unlock_time=900 fail_interval=900
# auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900 fail_interval=900

# Configure /etc/security/faillock.conf:
echo 'deny = 5' >> /etc/security/faillock.conf
echo 'unlock_time = 900' >> /etc/security/faillock.conf

This recommendation verifies that Permissions on /etc/passwd Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/passwd
# Should return: 644 root root

chmod 644 /etc/passwd
chown root:root /etc/passwd

This recommendation verifies that Permissions on /etc/shadow Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/shadow
# Should return: 640 root shadow

chmod 640 /etc/shadow
chown root:shadow /etc/shadow

This recommendation verifies that Permissions on /etc/group Are Configured on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

stat -c '%a %U %G' /etc/group
# Should return: 644 root root

chmod 644 /etc/group
chown root:root /etc/group

This recommendation verifies that No World-Writable Files Exist on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Should return empty — no world-writable files

# Remove world-writable permission from files:
find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

# Investigate each file before changing permissions

This recommendation verifies that No Accounts Have Empty Passwords on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($2 == "") {print $1}' /etc/shadow
# Should return empty — no accounts with empty passwords

# Lock accounts with empty passwords:
awk -F: '($2 == "") {print $1}' /etc/shadow | while read user; do
  passwd -l "$user"
done

This recommendation verifies that Root Is the Only UID 0 Account on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print $1}' /etc/passwd
# Should return only: root

# If non-root UID 0 accounts are found, change their UID:
usermod -u <new_uid> <username>
# Or remove the account if unnecessary:
userdel <username>

This recommendation verifies that All Users Home Directories Exist on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 >= 1000 && $7 != "/usr/sbin/nologin" && $7 != "/bin/false") {print $1":"$6}' /etc/passwd | \
  while IFS=: read user dir; do
    [ ! -d "$dir" ] && echo "Missing: $user -> $dir"
  done

# Create missing home directories:
mkhomedir_helper <username>

# Or manually:
mkdir -p /home/<username>
chown <username>:<group> /home/<username>
chmod 750 /home/<username>

This recommendation verifies that No Duplicate UIDs Exist on the Ubuntu 24.04 LTS Linux operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Ubuntu 24.04 LTS Linux operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

cut -d: -f3 /etc/passwd | sort -n | uniq -d
# Should return empty — no duplicate UIDs

# Change duplicate UIDs using usermod:
usermod -u <new_unique_uid> <username>

# Verify no duplicates remain:
cut -d: -f3 /etc/passwd | sort -n | uniq -d