CIS XCP-ng Benchmark

This recommendation verifies that RBAC roles are assigned with least-privilege access on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check XAPI user management:
xe user-list 2>/dev/null

# Check RBAC roles (pool-level):
xe role-list

# Check current session:
xe session-list

# Configure role-based access for pool:
# Create RBAC subjects:
xe subject-add subject-name=vmadmin
xe subject-role-add uuid=$SUBJECT_UUID role='vm-operator'

# XCP-ng Center / XO user management:
# Xen Orchestra > Settings > Users > Add User
# Assign minimal permissions:
# - VM Operator: start/stop/console only
# - VM Admin: full VM management
# - Pool Admin: pool-level operations

# Disable default root password login:
# Use SSH key authentication:
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

This recommendation verifies that SSH is hardened with key authentication only on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check host SSH configuration:
grep -iE 'permit|password|pubkey' /etc/ssh/sshd_config

# Check active sessions:
who -a

# Check PAM configuration:
grep -r pam_tally /etc/pam.d/

# Harden SSH access on XCP-ng host:
cat > /etc/ssh/sshd_config.d/hardened.conf << 'EOF'
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 30
AllowTcpForwarding no
Banner /etc/issue.net
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
EOF
systemctl restart sshd

This recommendation verifies that management, storage, and VM networks are VLAN-isolated on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check network configuration:
xe network-list params=all

# Check VLAN tagging:
xe pif-list params=VLAN,device,network-name-label

# Check bonds:
xe bond-list

# Configure network isolation with VLANs:
# Get management network UUID:
MGMT_NET=$(xe network-list name-label='Pool-wide management' --minimal)

# Create storage VLAN:
xe network-create name-label='Storage-VLAN100'
PIF=$(xe pif-list device=eth1 --minimal)
xe vlan-create pif-uuid=$PIF network-uuid=$STORAGE_NET vlan=100

# Create VM traffic VLAN:
xe network-create name-label='VM-VLAN200'
xe vlan-create pif-uuid=$PIF network-uuid=$VM_NET vlan=200

# Separate management from VM traffic:
# Never attach VMs to the management network

This recommendation verifies that host firewall restricts access to management services on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check firewall rules:
iptables -L -n --line-numbers
ip6tables -L -n --line-numbers

# Check xapi firewall:
cat /etc/sysconfig/iptables 2>/dev/null

# Configure host firewall:
cat > /etc/sysconfig/iptables << 'EOF'
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Allow established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT

# Allow SSH from management network
-A INPUT -s 10.0.0.0/24 -p tcp --dport 22 -j ACCEPT

# Allow XAPI from management
-A INPUT -s 10.0.0.0/24 -p tcp --dport 443 -j ACCEPT
-A INPUT -s 10.0.0.0/24 -p tcp --dport 80 -j ACCEPT

# Allow XenMotion between hosts
-A INPUT -s 10.0.1.0/24 -p tcp --dport 1337 -j ACCEPT

# Allow storage traffic
-A INPUT -s 10.0.2.0/24 -p tcp --dport 3260 -j ACCEPT

# Drop everything else
-A INPUT -j DROP
COMMIT
EOF
service iptables restart

This recommendation verifies that iSCSI storage uses CHAP authentication and multipathing on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check storage repositories:
xe sr-list params=name-label,type,content-type

# Check shared storage:
xe sr-list content-type=disk type=nfs
xe sr-list content-type=disk type=lvmoiscsi

# Configure secure storage repositories:
# Use iSCSI with CHAP authentication:
xe sr-create type=lvmoiscsi name-label='Secure-iSCSI' \
  device-config:target=10.0.2.10 \
  device-config:targetIQN=iqn.2024-01.com.example:storage \
  device-config:chapuser=xcpng \
  device-config:chappassword=CHAP_SECRET \
  content-type=user shared=true

# For NFS storage, restrict exports:
# On NFS server: /etc/exports
# /exports/xcpng  10.0.2.0/24(rw,sync,no_subtree_check,no_root_squash)

# Enable storage multipathing:
xe host-param-set uuid=$HOST_UUID \
  other-config:multipathing=true \
  other-config:multipathhandle=dmp

This recommendation verifies that disk encryption is configured for sensitive VMs on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM disk encryption status:
xe vdi-list params=name-label,managed,on-boot

# Check host partitions:
lsblk -o NAME,FSTYPE,MOUNTPOINT,SIZE,TYPE
ls /dev/mapper/

# Enable disk encryption for VMs:
# Use LUKS inside VM (guest-level encryption):
# In guest:
sudo cryptsetup luksFormat /dev/xvdb
sudo cryptsetup open /dev/xvdb encrypted-data
sudo mkfs.ext4 /dev/mapper/encrypted-data
sudo mount /dev/mapper/encrypted-data /data

# XCP-ng host partition encryption:
# During installation, select encrypted partitions
# Or for existing:
sudo cryptsetup luksFormat /dev/sdb
sudo cryptsetup open /dev/sdb encrypted-sr
sudo mkfs.ext4 /dev/mapper/encrypted-sr

This recommendation verifies that VM CPU and memory limits are configured on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM resource limits:
xe vm-list params=name-label,VCPUs-max,memory-static-max

# Check resource pools:
xe pool-list params=all | head -20

# Set VM resource limits:
# Limit CPU:
xe vm-param-set uuid=$VM_UUID VCPUs-max=4
xe vm-param-set uuid=$VM_UUID VCPUs-at-startup=2

# Limit memory:
xe vm-param-set uuid=$VM_UUID \
  memory-static-max=8589934592 \
  memory-dynamic-max=8589934592 \
  memory-dynamic-min=4294967296 \
  memory-static-min=4294967296

# Set VM start order and delay:
xe vm-param-set uuid=$VM_UUID order=1
xe vm-param-set uuid=$VM_UUID start-delay=30

# Disable VM autostart unless needed:
xe pool-param-set uuid=$POOL_UUID \
  other-config:auto_poweron=false

This recommendation verifies that VM templates are hardened with minimal peripherals on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM security settings:
xe vm-list params=name-label,platform

# Check VM templates:
xe template-list is-a-template=true params=name-label | head -20

# Harden VM settings:
# Disable USB passthrough:
xe vm-param-set uuid=$VM_UUID \
  platform:usb=false

# Disable VM console clipboard:
xe vm-param-set uuid=$VM_UUID \
  platform:vga=cirrus

# Remove CD/DVD drives when not needed:
VBD=$(xe vbd-list vm-uuid=$VM_UUID type=CD --minimal)
xe vbd-destroy uuid=$VBD

# Create hardened VM template:
xe vm-clone uuid=$VM_UUID new-name-label='Hardened-Template'
xe template-param-set uuid=$TEMPLATE_UUID \
  is-a-template=true \
  other-config:install-distro=debianlike

This recommendation verifies that automated VM backups and pool database exports are configured on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
ls /var/backup/ 2>/dev/null

# Check snapshot status:
xe snapshot-list params=name-label,snapshot-time | head -20

# Configure automated VM backups:
# Using XO Backup:
# Xen Orchestra > Backup > New > Schedule
# Type: Delta Backup
# VMs: Select VMs
# Schedule: Daily at 02:00
# Retention: 7 daily, 4 weekly

# Manual snapshot for maintenance:
xe vm-snapshot vm=$VM_UUID new-name-label="pre-update-$(date +%Y%m%d)"

# Pool metadata backup:
xe pool-dump-database file-name=/var/backup/pool-db-$(date +%Y%m%d).xml

# Automate with cron:
cat > /etc/cron.d/xcpng-backup << 'EOF'
0 3 * * * root xe pool-dump-database \
  file-name=/var/backup/pool-db-$(date +\%Y\%m\%d).xml
find /var/backup/ -mtime +14 -delete
EOF

This recommendation verifies that high availability is enabled with proper restart priorities on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HA configuration:
xe pool-ha-get
xe pool-list params=ha-enabled,ha-host-failures-to-tolerate

# Check host status:
xe host-list params=name-label,enabled

# Configure high availability:
# Enable HA with heartbeat SR:
xe pool-ha-enable heartbeat-sr-uuids=$HEARTBEAT_SR_UUID
xe pool-ha-set-host-failures-to-tolerate value=1

# Set VM restart priorities:
xe vm-param-set uuid=$VM_UUID \
  ha-restart-priority=restart \
  ha-always-run=true

# Set less critical VMs:
xe vm-param-set uuid=$DEV_VM_UUID \
  ha-restart-priority=best-effort

# Verify HA status:
xe pool-ha-get

This recommendation verifies that centralized syslog forwarding includes XAPI logs on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
grep -r remote /etc/rsyslog.conf /etc/rsyslog.d/

# Check xapi logs:
ls -la /var/log/xensource.log*

# Configure centralized logging:
cat > /etc/rsyslog.d/remote.conf << 'EOF'
# Send all logs to SIEM
*.* @@siem.example.com:514

# Send XCP-ng specific logs
if $programname == 'xapi' then @@siem.example.com:514
if $programname == 'xenopsd' then @@siem.example.com:514
EOF

# Configure log rotation:
cat > /etc/logrotate.d/xensource << 'EOF'
/var/log/xensource.log {
    rotate 30
    daily
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}
EOF

systemctl restart rsyslog

This recommendation verifies that NTP is configured with authenticated time sources on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NTP configuration:
chronyc sources
chronyc tracking

# Check chrony config:
cat /etc/chrony.conf

# Configure NTP with authentication:
cat > /etc/chrony.conf << 'EOF'
server ntp1.example.com iburst
server ntp2.example.com iburst

driftfile /var/lib/chrony/drift
makestep 1.0 3
rtcsync

# Restrict access:
allow 10.0.0.0/24
deny all

# Log
logdir /var/log/chrony
log measurements statistics tracking
EOF
systemctl restart chronyd

# Verify:
chronyc sources -v

This recommendation verifies that rolling pool updates are applied regularly on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check installed patches:
xe patch-list

# Check XCP-ng version:
cat /etc/xcp-ng-release 2>/dev/null || cat /etc/xensource-inventory | grep PRODUCT_VERSION

# Apply security patches:
# Check for updates:
yum check-update

# Apply updates:
yum update -y

# For XCP-ng pool rolling update:
# 1. Backup pool database:
xe pool-dump-database file-name=/var/backup/pre-update.xml

# 2. Evacuate host:
xe host-evacuate uuid=$HOST_UUID

# 3. Apply updates:
yum update -y

# 4. Reboot:
reboot

# 5. Verify and move to next host:
xe host-list params=name-label,enabled,software-version

This recommendation verifies that XAPI TLS certificates are properly deployed on the XCP-ng virtualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the XCP-ng virtualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pool certificates:
xe pool-certificate-list

# Check SSL certificate:
openssl s_client -connect localhost:443 2>/dev/null | \
  openssl x509 -noout -dates -subject

# Install proper TLS certificate:
# Generate CSR:
openssl req -new -newkey rsa:4096 -nodes \
  -keyout /etc/xensource/xapi-ssl.key \
  -out /tmp/xapi.csr \
  -subj '/CN=xcpng.example.com'

# After getting signed certificate:
cp /tmp/signed-cert.pem /etc/xensource/xapi-ssl.pem
chmod 600 /etc/xensource/xapi-ssl.key
chmod 644 /etc/xensource/xapi-ssl.pem

# Install pool-wide:
xe pool-certificate-install filename=/etc/xensource/xapi-ssl.pem

# Restart xapi:
systemctl restart xapi