Definition of CIS Benchmark for Debian 13 for debian13

1.1.1.1: Ensure cramfs kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_cramfs_disabled: Disable Mounting of cramfs

1.1.1.2: Ensure freevxfs kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_freevxfs_disabled: Disable Mounting of freevxfs

1.1.1.3: Ensure hfs kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_hfs_disabled: Disable Mounting of hfs

1.1.1.4: Ensure hfsplus kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_hfsplus_disabled: Disable Mounting of hfsplus

1.1.1.5: Ensure jffs2 kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_jffs2_disabled: Disable Mounting of jffs2

1.1.1.6: Ensure overlayfs kernel module is not available (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• kernel_module_overlayfs_disabled: Ensure overlayfs kernel module is not available

1.1.1.7: Ensure squashfs kernel module is not available (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

No rules selected

1.1.1.8: Ensure udf kernel module is not available (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• kernel_module_udf_disabled: Disable Mounting of udf

1.1.1.9: Ensure firewire-core kernel module is not available (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• kernel_module_firewire-core_disabled: Disable IEEE 1394 (FireWire) Support

1.1.1.10: Ensure usb-storage kernel module is not available (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• kernel_module_usb-storage_disabled: Disable Modprobe Loading of USB Storage Driver

1.1.1.11: Ensure unused filesystems kernel modules are not available (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.1.2.1.1: Ensure /tmp is a separate partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• partition_for_tmp: Ensure /tmp Located On Separate Partition

1.1.2.1.2: Ensure nodev option set on /tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_tmp_nodev: Add nodev Option to /tmp

1.1.2.1.3: Ensure nosuid option set on /tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_tmp_nosuid: Add nosuid Option to /tmp

1.1.2.1.4: Ensure noexec option set on /tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_tmp_noexec: Add noexec Option to /tmp

1.1.2.2.1: Ensure /dev/shm is tmpfs or a separate partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• partition_for_dev_shm: Ensure /dev/shm is configured

1.1.2.2.2: Ensure nodev option set on /dev/shm partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_dev_shm_nodev: Add nodev Option to /dev/shm

1.1.2.2.3: Ensure nosuid option set on /dev/shm partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_dev_shm_nosuid: Add nosuid Option to /dev/shm

1.1.2.2.4: Ensure noexec option set on /dev/shm partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_dev_shm_noexec: Add noexec Option to /dev/shm

1.1.2.3.1: Ensure separate partition exists for /home (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• partition_for_home: Ensure /home Located On Separate Partition

1.1.2.3.2: Ensure nodev option set on /home partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_home_nodev: Add nodev Option to /home

1.1.2.3.3: Ensure nosuid option set on /home partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_home_nosuid: Add nosuid Option to /home

1.1.2.4.1: Ensure separate partition exists for /var (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• partition_for_var: Ensure /var Located On Separate Partition

1.1.2.4.2: Ensure nodev option set on /var partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_nodev: Add nodev Option to /var

1.1.2.4.3: Ensure nosuid option set on /var partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_nosuid: Add nosuid Option to /var

1.1.2.5.1: Ensure separate partition exists for /var/tmp (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• partition_for_var_tmp: Ensure /var/tmp Located On Separate Partition

1.1.2.5.2: Ensure nodev option set on /var/tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_tmp_nodev: Add nodev Option to /var/tmp

1.1.2.5.3: Ensure nosuid option set on /var/tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_tmp_nosuid: Add nosuid Option to /var/tmp

1.1.2.5.4: Ensure noexec option set on /var/tmp partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_tmp_noexec: Add noexec Option to /var/tmp

1.1.2.6.1: Ensure separate partition exists for /var/log (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• partition_for_var_log: Ensure /var/log Located On Separate Partition

1.1.2.6.2: Ensure nodev option set on /var/log partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_nodev: Add nodev Option to /var/log

1.1.2.6.3: Ensure nosuid option set on /var/log partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_nosuid: Add nosuid Option to /var/log

1.1.2.6.4: Ensure noexec option set on /var/log partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_noexec: Add noexec Option to /var/log

1.1.2.7.1: Ensure separate partition exists for /var/log/audit (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• partition_for_var_log_audit: Ensure /var/log/audit Located On Separate Partition

1.1.2.7.2: Ensure nodev option set on /var/log/audit partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_audit_nodev: Add nodev Option to /var/log/audit

1.1.2.7.3: Ensure nosuid option set on /var/log/audit partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_audit_nosuid: Add nosuid Option to /var/log/audit

1.1.2.7.4: Ensure noexec option set on /var/log/audit partition (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• mount_option_var_log_audit_noexec: Add noexec Option to /var/log/audit

1.2.1.1: Ensure the source.list and .source files use the Signed-By option (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.2.1.2: Ensure weak dependencies are configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• apt_conf_disable_recommends: Ensure that apt Recommends weak dependencies are disabled
• apt_conf_disable_suggests: Ensure that apt Suggests weak dependencies are disabled

1.2.1.3: Ensure access to gpg key files are configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.1.4: Ensure access to /etc/apt/trusted.gpg.d directory is configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.1.5: Ensure access to /etc/apt/auth.conf.d directory is configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.1.6: Ensure access to files in the /etc/apt/auth.conf.d/ directory is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.2.1.7: Ensure access to /usr/share/keyrings directory is configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.1.8: Ensure access to /etc/apt/sources.list.d directory is configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.1.9: Ensure access to files in /etc/apt/sources.list.d are configured (Automated)

Description: None

• l1_server
• l2_server

Automated: no

No rules selected

1.2.2.1: Ensure updates, patches, and additional security software are installed (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.3.1.1: Ensure AppArmor packages are installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_apparmor-utils_installed: Ensure AppArmor Utils is installed
• package_apparmor_installed: Ensure AppArmor is installed

1.3.1.2: Ensure AppArmor is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• grub2_enable_apparmor: Ensure AppArmor is enabled in the bootloader configuration

1.3.1.3: Ensure all AppArmor Profiles are enforcing (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• all_apparmor_profiles_enforced: Enforce all AppArmor Profiles

1.3.1.4: Ensure apparmor_restrict_unprivileged_unconfined is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.4.1: Ensure bootloader password is set (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• grub2_password: Set Boot Loader Password in grub2
• grub2_uefi_password: Set the UEFI Boot Loader Password

1.4.2: Ensure access to bootloader config is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_owner_grub2_cfg: Verify /boot/grub/grub.cfg User Ownership
• file_permissions_grub2_cfg: Verify /boot/grub/grub.cfg Permissions

1.5.1: Ensure fs.protected_hardlinks is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_fs_protected_hardlinks: Enable Kernel Parameter to Enforce DAC on Hardlinks

1.5.2: Ensure fs.protected_symlinks is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• sysctl_fs_protected_symlinks: Enable Kernel Parameter to Enforce DAC on Symlinks

1.5.3: Ensure kernel.yama.ptrace_scope is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
• sysctl_kernel_yama_ptrace_scope_value = 1

1.5.4: Ensure fs.suid_dumpable is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_fs_suid_dumpable: Disable Core Dumps for SUID programs

1.5.5: Ensure kernel.dmesg_restrict is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_kernel_dmesg_restrict: Restrict Access to Kernel Message Buffer

1.5.6: Ensure prelink is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• disable_prelink: Disable Prelinking

1.5.7: Ensure Automatic Error Reporting is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

1.5.8: Ensure kernel.kptr_restrict is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_kernel_kptr_restrict: Restrict Exposed Kernel Pointer Addresses Access

1.5.9: Ensure kernel.randomize_va_space is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_kernel_randomize_va_space: Enable Randomized Layout of Virtual Address Space

1.5.10: Ensure kernel.yama.ptrace_scope is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_kernel_yama_ptrace_scope: Restrict usage of ptrace to descendant processes
• sysctl_kernel_yama_ptrace_scope_value = 1

1.5.11: Ensure core file size is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

• disable_users_coredumps: Disable Core Dumps for All Users

1.5.12: Ensure systemd-coredump ProcessSizeMax is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• coredump_disable_backtraces: Disable core dump backtraces

1.5.13: Ensure systemd-coredump Storage is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• coredump_disable_storage: Disable storing core dump

1.6.1: Ensure /etc/motd is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• banner_etc_motd_cis: Ensure Message Of The Day Is Configured Properly
• cis_banner_text = cis

1.6.2: Ensure /etc/issue is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• banner_etc_issue_cis: Ensure Local Login Warning Banner Is Configured Properly
• cis_banner_text = cis

1.6.3: Ensure /etc/issue.net is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• banner_etc_issue_net_cis: Ensure Remote Login Warning Banner Is Configured Properly
• cis_banner_text = cis

1.6.4: Ensure access to /etc/motd is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_motd: Verify Group Ownership of Message of the Day Banner
• file_owner_etc_motd: Verify ownership of Message of the Day Banner
• file_permissions_etc_motd: Verify permissions on Message of the Day Banner

1.6.5: Ensure access to /etc/issue is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_issue: Verify Group Ownership of System Login Banner
• file_owner_etc_issue: Verify ownership of System Login Banner
• file_permissions_etc_issue: Verify permissions on System Login Banner

1.6.6: Ensure access to /etc/issue.net is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_issue_net: Verify Group Ownership of System Login Banner for Remote Connections
• file_owner_etc_issue_net: Verify ownership of System Login Banner for Remote Connections
• file_permissions_etc_issue_net: Verify permissions on System Login Banner for Remote Connections

1.7.1: Ensure GDM is removed (Automated)

Description: None

• l2_server

Automated: yes

• package_gdm_removed: Remove the GDM Package Group

1.7.2: Ensure GDM login banner is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_banner_enabled: Enable GNOME3 Login Warning Banner
• dconf_gnome_login_banner_text: Set the GNOME3 Login Warning Banner Text
• login_banner_text = cis_default

1.7.3: Ensure GDM disable-user-list option is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_disable_user_list: Disable the GNOME3 Login User List

1.7.4: Ensure GDM screen locks when the user is idle (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
• dconf_gnome_screensaver_lock_enabled: Enable GNOME3 Screensaver Lock After Idle Period
• inactivity_timeout_value = 15_minutes
• var_screensaver_lock_delay = 5_seconds

1.7.5: Ensure GDM screen locks cannot be overridden (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_screensaver_idle_delay: Set GNOME3 Screensaver Inactivity Timeout
• dconf_gnome_screensaver_lock_delay: Set GNOME3 Screensaver Lock Delay After Activation Period
• dconf_gnome_screensaver_lock_enabled: Enable GNOME3 Screensaver Lock After Idle Period

1.7.6: Ensure GDM automatic mounting of removable media is disabled (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening

1.7.7: Ensure GDM disabling automatic mounting of removable media is not overridden (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• dconf_gnome_disable_automount: Disable GNOME3 Automounting
• dconf_gnome_disable_automount_open: Disable GNOME3 Automount Opening

1.7.8: Ensure GDM autorun-never is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running

1.7.9: Ensure GDM autorun-never is not overridden (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• dconf_gnome_disable_autorun: Disable GNOME3 Automount running

1.7.10: Ensure XDMCP is not enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• gnome_gdm_disable_xdmcp: Disable XDMCP in GDM

1.7.11: Ensure Xwayland is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: no

No rules selected

2.1.1: Ensure autofs services are not in use (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• package_autofs_removed: Remove autofs Package
• service_autofs_disabled: Disable the Automounter

2.1.2: Ensure avahi daemon services are not in use (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• package_avahi_removed: Uninstall avahi Server Package
• service_avahi-daemon_disabled: Disable Avahi Server Software

2.1.3: Ensure dhcp server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_kea_removed: Uninstall kea Package
• service_kea_dhcp4_server_disabled: Disable kea-dhcp4-server Service
• service_kea_dhcp6_server_disabled: Disable kea-dhcp6-server Service
• service_kea_dhcp_ddns_server_disabled: Disable kea-dhcp-ddns-server Service

2.1.4: Ensure dns server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_bind_removed: Uninstall bind Package
• service_named_disabled: Disable named Service

2.1.5: Ensure dnsmasq services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_dnsmasq_removed: Uninstall dnsmasq Package
• service_dnsmasq_disabled: Disable dnsmasq Service

2.1.6: Ensure ftp server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_vsftpd_removed: Uninstall vsftpd Package
• service_vsftpd_disabled: Disable vsftpd Service

2.1.7: Ensure ldap server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_openldap-servers_removed: Uninstall slapd Package
• service_slapd_disabled: Disable LDAP Server (slapd)

2.1.8: Ensure message access server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_dovecot_removed: Uninstall dovecot Package
• service_dovecot_disabled: Disable Dovecot Service

2.1.9: Ensure network file system services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_nfs-kernel-server_removed: Uninstall nfs-kernel-server Package
• service_nfs_disabled: Disable Network File System (nfs)

2.1.10: Ensure nis server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_ypserv_removed: Uninstall ypserv Package
• service_ypserv_disabled: Disable ypserv Service

2.1.11: Ensure print server services are not in use (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• package_cups_removed: Uninstall CUPS Package
• service_cups_disabled: Disable the CUPS Service

2.1.12: Ensure rpcbind services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_rpcbind_removed: Uninstall rpcbind Package
• service_rpcbind_disabled: Disable rpcbind Service

2.1.13: Ensure rsync services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_rsync_removed: Uninstall rsync Package
• service_rsyncd_disabled: Ensure rsyncd service is disabled

2.1.14: Ensure samba file server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_samba_removed: Uninstall Samba Package
• service_smb_disabled: Disable Samba

2.1.15: Ensure snmp services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_net-snmp_removed: Uninstall net-snmp Package
• service_snmpd_disabled: Disable snmpd Service

2.1.16: Ensure telnet-server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_inetutils-telnetd_removed: Uninstall the inet-based telnet server
• package_telnetd_removed: Uninstall the telnet server

2.1.17: Ensure tftp server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_tftp-server_removed: Uninstall tftpd-hpa Package
• service_tftp_disabled: Disable tftpd-hpa Service

2.1.18: Ensure web proxy server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_squid_removed: Uninstall squid Package
• service_squid_disabled: Disable Squid

2.1.19: Ensure web server services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_httpd_removed: Uninstall apache2 Package
• package_nginx_removed: Uninstall nginx Package
• service_httpd_disabled: Disable apache2 Service
• service_nginx_disabled: Disable nginx Service

2.1.20: Ensure xinetd services are not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_xinetd_removed: Uninstall xinetd package if not used by network services
• service_xinetd_disabled: Disable xinetd Service

2.1.21: Ensure X window server services are not in use (Automated)

Description: None

• l2_server

Automated: yes

• package_xorg-x11-server-common_removed: Remove the X Windows Package Group

2.1.22: Ensure mail transfer agents are configured for local-only mode (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• has_nonlocal_mta: Ensure Mail Transfer Agent is not Listening on any non-loopback Address
• postfix_network_listening_disabled: Disable Postfix Network Listening
• var_postfix_inet_interfaces = loopback-only

2.1.23: Ensure only approved services are listening on a network interface (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

2.2.1: Ensure nis client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_nis_removed: Uninstall the nis package

2.2.2: Ensure rsh client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_rsh_removed: Uninstall rsh Package

2.2.3: Ensure talk client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_talk_removed: Uninstall talk Package

2.2.4: Ensure telnet client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_inetutils-telnet_removed: Remove telnet Clients
• package_telnet_removed: Remove telnet Clients

2.2.5: Ensure ldap client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_openldap-clients_removed: Ensure LDAP client is not installed

2.2.6: Ensure ftp client is not installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_ftp_removed: Remove ftp Package
• package_tnftp_removed: Remove tnftp Package

2.3.1.1: Ensure a single time synchronization daemon is in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ntp_single_service_active: Ensure a Single Time Synchronization Service is in Use
• package_chrony_installed: The Chrony package is installed
• package_timesyncd_installed: Install the systemd_timesyncd Service
• service_chronyd_disabled: The Chronyd service is disabled
• service_chronyd_enabled: The Chronyd service is enabled
• service_timesyncd_disabled: Disable systemd_timesyncd Service
• service_timesyncd_enabled: Enable systemd_timesyncd Service
• var_timesync_service = systemd-timesyncd

2.3.2.1: Ensure systemd-timesyncd configured with authorized timeserver (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• service_timesyncd_configured: Configure Systemd Timesyncd Servers
• var_multiple_time_servers = debian

2.3.2.2: Ensure systemd-timesyncd is enabled and running (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

No rules selected

2.3.3.1: Ensure chrony is configured with authorized timeserver (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

• chronyd_configure_pool_and_server: Chrony Configure Pool and Server
• var_multiple_time_pools = debian
• var_multiple_time_servers = debian

2.3.3.2: Ensure chrony is running as user _chrony (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• chronyd_run_as_chrony_user: Ensure that chronyd is running under chrony user account

2.3.3.3: Ensure chrony is enabled and running (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

No rules selected

2.4.1.1: Ensure cron daemon is enabled and active (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_cron_installed: Install the cron service
• service_cron_enabled: Enable cron Service

2.4.1.2: Ensure access to /etc/crontab is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_crontab: Verify Group Who Owns Crontab
• file_owner_crontab: Verify Owner on crontab
• file_permissions_crontab: Verify Permissions on crontab

2.4.1.3: Ensure access to /etc/cron.hourly is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_hourly: Verify Group Who Owns cron.hourly
• file_owner_cron_hourly: Verify Owner on cron.hourly
• file_permissions_cron_hourly: Verify Permissions on cron.hourly

2.4.1.4: Ensure access to /etc/cron.daily is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_daily: Verify Group Who Owns cron.daily
• file_owner_cron_daily: Verify Owner on cron.daily
• file_permissions_cron_daily: Verify Permissions on cron.daily

2.4.1.5: Ensure access to /etc/cron.weekly is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_weekly: Verify Group Who Owns cron.weekly
• file_owner_cron_weekly: Verify Owner on cron.weekly
• file_permissions_cron_weekly: Verify Permissions on cron.weekly

2.4.1.6: Ensure access to /etc/cron.monthly is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_monthly: Verify Group Who Owns cron.monthly
• file_owner_cron_monthly: Verify Owner on cron.monthly
• file_permissions_cron_monthly: Verify Permissions on cron.monthly

2.4.1.7: Ensure access to /etc/cron.yearly is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_yearly: Verify Group Who Owns cron.yearly
• file_owner_cron_yearly: Verify Owner on cron.yearly
• file_permissions_cron_yearly: Verify Permissions on cron.yearly

2.4.1.8: Ensure access to /etc/cron.d is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_cron_d: Verify Group Who Owns cron.d
• file_owner_cron_d: Verify Owner on cron.d
• file_permissions_cron_d: Verify Permissions on cron.d

2.4.1.9: Ensure access to crontab is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_cron_allow_exists: Ensure that /etc/cron.allow exists
• file_cron_deny_not_exist: Ensure that /etc/cron.deny does not exist
• file_groupowner_cron_allow: Verify Group Who Owns /etc/cron.allow file
• file_owner_cron_allow: Verify User Who Owns /etc/cron.allow file
• file_permissions_cron_allow: Verify Permissions on /etc/cron.allow file

2.4.2.1: Ensure access to at is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_at_allow_exists: Ensure that /etc/at.allow exists
• file_groupowner_at_allow: Verify Group Who Owns /etc/at.allow file
• file_groupowner_at_deny: Verify Group Who Owns /etc/at.deny file
• file_owner_at_allow: Verify User Who Owns /etc/at.allow file
• file_owner_at_deny: Verify User Who Owns /etc/at.deny file
• file_permissions_at_allow: Verify Permissions on /etc/at.allow file
• file_permissions_at_deny: Verify Permissions on /etc/at.deny file

3.1.1: Ensure IPv6 status is identified (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

3.1.2: Ensure wireless interfaces are not available (Automated)

Description: None

• l1_server

Automated: yes

• wireless_disable_interfaces: Deactivate Wireless Network Interfaces

3.1.3: Ensure bluetooth services are not in use (Automated)

Description: None

• l1_server
• l2_workstation

Automated: yes

• service_bluetooth_disabled: Disable Bluetooth Service

3.2.1: Ensure atm kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_atm_disabled: Disable ATM Support

3.2.2: Ensure can kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_can_disabled: Disable CAN Support

3.2.3: Ensure dccp kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_dccp_disabled: Disable DCCP Support

3.2.4: Ensure rds kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_rds_disabled: Disable RDS Support

3.2.5: Ensure sctp kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_sctp_disabled: Disable SCTP Support

3.2.6: Ensure tipc kernel module is not available (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• kernel_module_tipc_disabled: Disable TIPC Support

3.3.1.1: Ensure net.ipv4.ip_forward is configured (Automated)

Description: None

• l2_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_ip_forward: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

3.3.1.2: Ensure net.ipv4.conf.all.forwarding is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_forwarding: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces

3.3.1.3: Ensure net.ipv4.conf.default.forwarding is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_forwarding: Disable Kernel Parameter for IPv4 Forwarding By Default

3.3.1.4: Ensure net.ipv4.conf.all.send_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

3.3.1.5: Ensure net.ipv4.conf.default.send_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_send_redirects: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

3.3.1.6: Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_icmp_ignore_bogus_error_responses: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

3.3.1.7: Ensure net.ipv4.icmp_echo_ignore_broadcasts is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_icmp_echo_ignore_broadcasts: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

3.3.1.8: Ensure net.ipv4.conf.all.accept_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv4 Interfaces

3.3.1.9: Ensure net.ipv4.conf.default.accept_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

3.3.1.10: Ensure net.ipv4.conf.all.secure_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_secure_redirects: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

3.3.1.11: Ensure net.ipv4.conf.default.secure_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_secure_redirects: Configure Kernel Parameter for Accepting Secure Redirects By Default

3.3.1.12: Ensure net.ipv4.conf.all.rp_filter is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

3.3.1.13: Ensure net.ipv4.conf.default.rp_filter is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_rp_filter: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

3.3.1.14: Ensure net.ipv4.conf.all.accept_source_route is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

3.3.1.15: Ensure net.ipv4.conf.default.accept_source_route is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

3.3.1.16: Ensure net.ipv4.conf.all.log_martians is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_all_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
• sysctl_reapply_after_network: Ensure sysctl network settings are re-applied after network interfaces come up

3.3.1.17: Ensure net.ipv4.conf.default.log_martians is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_conf_default_log_martians: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces by Default
• sysctl_reapply_after_network: Ensure sysctl network settings are re-applied after network interfaces come up

3.3.1.18: Ensure net.ipv4.tcp_syncookies is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv4_tcp_syncookies: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

3.3.2.1: Ensure net.ipv6.conf.all.forwarding is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_all_forwarding: Disable Kernel Parameter for IPv6 Forwarding

3.3.2.2: Ensure net.ipv6.conf.default.forwarding is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_default_forwarding: Disable Kernel Parameter for IPv6 Forwarding by default

3.3.2.3: Ensure net.ipv6.conf.all.accept_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_all_accept_redirects: Disable Accepting ICMP Redirects for All IPv6 Interfaces

3.3.2.4: Ensure net.ipv6.conf.default.accept_redirects is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_default_accept_redirects: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

3.3.2.5: Ensure net.ipv6.conf.all.accept_source_route is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_all_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

3.3.2.6: Ensure net.ipv6.conf.default.accept_source_route is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_default_accept_source_route: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

3.3.2.7: Ensure net.ipv6.conf.all.accept_ra is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_all_accept_ra: Configure Accepting Router Advertisements on All IPv6 Interfaces

3.3.2.8: Ensure net.ipv6.conf.default.accept_ra is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sysctl_net_ipv6_conf_default_accept_ra: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

4.1.1: Ensure ufw is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_ufw_installed: Install ufw Package

4.1.2: Ensure ufw service is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• check_ufw_active: Verify ufw Active
• service_ufw_enabled: Verify ufw Enabled

4.1.3: Ensure ufw incoming default is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ufw_default_incoming_rule: Ensure ufw Default Deny Policy for Incoming Connections

4.1.4: Ensure ufw outgoing default is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• ufw_default_outgoing_rule: Ensure ufw Default Deny Policy for Outgoing Connections

4.1.5: Ensure ufw routed default is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ufw_disabled_routed: Ensure ufw Default Policy for Routed (Forwarded) Traffic is Disabled

5.1.1: Ensure access_to /etc/ssh/sshd_config is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_sshd_config: Verify Group Who Owns SSH Server config file
• file_owner_sshd_config: Verify Owner on SSH Server config file
• file_permissions_sshd_config: Verify Permissions on SSH Server config file

5.1.2: Ensure access to SSH private host key files is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_permissions_sshd_private_key: Verify Permissions on SSH Server Private *_key Key Files

5.1.3: Ensure access to SSH public host key files is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_permissions_sshd_pub_key: Verify Permissions on SSH Server Public *.pub Key Files

5.1.4: Ensure sshd access is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_limit_user_access: Limit Users' SSH Access

5.1.5: Ensure sshd Banner is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_enable_warning_banner_net: Enable SSH Warning Banner

5.1.6: Ensure sshd Ciphers are configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_use_strong_ciphers: Use Only Strong Ciphers

5.1.7: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

• sshd_idle_timeout_value = 5_minutes
• sshd_set_idle_timeout: Set SSH Client Alive Interval
• sshd_set_keepalive: Set SSH Client Alive Count Max
• var_sshd_set_keepalive = 3

5.1.8: Ensure sshd DisableForwarding is enabled (Automated)

Description: None

• l1_workstation
• l2_server

Automated: yes

• sshd_disable_forwarding: Disable SSH Forwarding

5.1.9: Ensure sshd GSSAPIAuthentication is disabled (Automated)

Description: None

• l1_workstation
• l2_server

Automated: yes

• sshd_disable_gssapi_auth: Disable GSSAPI Authentication

5.1.10: Ensure sshd HostbasedAuthentication is disabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• disable_host_auth: Disable Host-Based Authentication

5.1.11: Ensure sshd IgnoreRhosts is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_disable_rhosts: Disable SSH Support for .rhosts Files

5.1.12: Ensure sshd KexAlgorithms is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_strong_kex = cis_debian13
• sshd_use_strong_kex: Use Only Strong Key Exchange algorithms

5.1.13: Ensure sshd post-quantum cryptography key exchange algorithms are configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

5.1.14: Ensure sshd LoginGraceTime is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_set_login_grace_time: Ensure SSH LoginGraceTime is configured
• var_sshd_set_login_grace_time = 60

5.1.15: Ensure sshd LogLevel is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_set_loglevel_info: Set LogLevel to INFO

5.1.16: Ensure sshd MACs are configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_strong_macs = cis_debian13
• sshd_use_strong_macs: Use Only Strong MACs

5.1.17: Ensure sshd MaxAuthTries is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_max_auth_tries_value = 4
• sshd_set_max_auth_tries: Set SSH authentication attempt limit

5.1.18: Ensure sshd MaxSessions is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_set_max_sessions: Set SSH MaxSessions limit
• var_sshd_max_sessions = 10

5.1.19: Ensure sshd MaxStartups is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_set_maxstartups: Ensure SSH MaxStartups is configured
• var_sshd_set_maxstartups = 10:30:60

5.1.20: Ensure sshd PermitEmptyPasswords is disabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_disable_empty_passwords: Disable SSH Access via Empty Passwords

5.1.21: Ensure sshd PermitRootLogin is disabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_disable_root_login: Disable SSH Root Login

5.1.22: Ensure sshd PermitUserEnvironment is disabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_do_not_permit_user_env: Do Not Allow SSH Environment Options

5.1.23: Ensure sshd UsePAM is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sshd_enable_pam: Enable PAM

5.2.1: Ensure sudo is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_sudo_installed: Install sudo Package

5.2.2: Ensure sudo commands use pty (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sudo_add_use_pty: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty

5.2.3: Ensure sudo log file exists (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sudo_custom_logfile: Ensure Sudo Logfile Exists - sudo logfile

5.2.4: Ensure users must provide password for escalation (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• sudo_require_authentication: Ensure Users Re-Authenticate for Privilege Escalation - sudo

5.2.5: Ensure re-authentication for privilege escalation is not disabled globally (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sudo_remove_no_authenticate: Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate

5.2.6: Ensure sudo authentication timeout is configured correctly (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• sudo_require_reauthentication: Require Re-Authentication When Using the sudo Command
• var_sudo_timestamp_timeout = 15_minutes

5.2.7: Ensure access to the su command is restricted (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ensure_pam_wheel_group_empty: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
• use_pam_wheel_group_for_su: Enforce Usage of pam_wheel with Group Parameter for su Authentication
• var_pam_wheel_group_for_su = cis

5.3.1.1: Ensure latest version of pam is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_pam_runtime_installed: Install pam-runtime Package

5.3.1.2: Ensure latest version of libpam-modules is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_pam_modules_installed: Install pam-modules Package

5.3.1.3: Ensure latest version of libpam-pwquality is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_pam_pwquality_installed: Install pam_pwquality Package

5.3.2.1: Ensure pam_unix module is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_unix_enabled: Verify pam_unix module is activated

5.3.2.2: Ensure pam_faillock module is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_passwords_pam_faillock_enabled: Ensure pam_faillock module is enabled

5.3.2.3: Ensure pam_pwquality module is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_pwquality_enabled: Verify pam_pwquality module is activated

5.3.2.4: Ensure pam_pwhistory module is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_pwhistory_enabled: Verify pam_pwhistory module is activated

5.3.3.1.1: Ensure password failed attempts lockout is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_passwords_pam_faillock_deny: Lock Accounts After Failed Password Attempts
• var_accounts_passwords_pam_faillock_deny = 4

5.3.3.1.2: Ensure password unlock time is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_passwords_pam_faillock_unlock_time: Set Lockout Time for Failed Password Attempts
• var_accounts_passwords_pam_faillock_unlock_time = 900

5.3.3.1.3: Ensure password failed attempts lockout includes root account (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• accounts_passwords_pam_faillock_root_unlock_time: Set Root Lockout Time for Failed Password Attempts
• var_accounts_passwords_pam_faillock_root_unlock_time = 900

5.3.3.2.1: Ensure password number of changed characters is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_difok: Ensure PAM Enforces Password Requirements - Minimum Different Characters
• var_password_pam_difok = 2

5.3.3.2.2: Ensure minimum password length is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_minlen: Ensure PAM Enforces Password Requirements - Minimum Length
• var_password_pam_minlen = 14

5.3.3.2.3: Ensure password complexity is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_dcredit: Ensure PAM Enforces Password Requirements - Minimum Digit Characters
• accounts_password_pam_lcredit: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
• accounts_password_pam_minclass: Ensure PAM Enforces Password Requirements - Minimum Different Categories
• accounts_password_pam_ocredit: Ensure PAM Enforces Password Requirements - Minimum Special Characters
• accounts_password_pam_ucredit: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
• var_password_pam_dcredit = 1
• var_password_pam_lcredit = 1
• var_password_pam_minclass = 4
• var_password_pam_ocredit = 1
• var_password_pam_ucredit = 1

5.3.3.2.4: Ensure password same consecutive characters is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_maxrepeat: Set Password Maximum Consecutive Repeating Characters
• var_password_pam_maxrepeat = 3

5.3.3.2.5: Ensure password maximum sequential characters is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_maxsequence: Limit the maximum number of sequential characters in passwords

5.3.3.2.6: Ensure password dictionary check is enabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_dictcheck: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
• var_password_pam_dictcheck = 1

5.3.3.2.7: Ensure password quality checking is enforced (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_enforcing: Ensure PAM Enforces Password Requirements - Enforcing
• var_password_pam_enforcing = 1

5.3.3.2.8: Ensure password quality is enforced for the root user (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_enforce_root: Ensure PAM Enforces Password Requirements - Enforce for root User

5.3.3.3.1: Ensure password history remember is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_pwhistory_remember: Limit Password Reuse
• var_password_pam_remember = 24

5.3.3.3.2: Ensure password history is enforced for the root user (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_pwhistory_enforce_root: Limit Password Reuse

5.3.3.3.3: Ensure pam_pwhistory includes use_authtok (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_pwhistory_use_authtok: Enforce Password History with use_authtok

5.3.3.4.1: Ensure pam_unix does not include nullok (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• no_empty_passwords_unix: Prevent Login to Accounts With Empty Password

5.3.3.4.2: Ensure pam_unix does not include remember (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_unix_no_remember: Avoid using remember in pam_unix module

5.3.3.4.3: Ensure pam_unix includes a strong password hashing algorithm (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• set_password_hashing_algorithm_systemauth: Set PAM Password Hashing Algorithm - system-auth
• var_password_hashing_algorithm_pam = cis_debian13

5.3.3.4.4: Ensure pam_unix includes use_authtok (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_pam_unix_authtok: Require use_authtok for pam_unix.so

5.4.1.1: Ensure password expiration is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_maximum_age_login_defs: Set Password Maximum Age
• accounts_password_set_max_life_existing: Set Existing Passwords Maximum Age
• var_accounts_maximum_age_login_defs = 365

5.4.1.2: Ensure minimum password days is configured (Manual)

Description: None

• l2_server
• l2_workstation

Automated: yes

• accounts_minimum_age_login_defs: Set Password Minimum Age
• accounts_password_set_min_life_existing: Set Existing Passwords Minimum Age
• var_accounts_minimum_age_login_defs = 1

5.4.1.3: Ensure password expiration warning days is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_warn_age_login_defs: Set Password Warning Age
• var_accounts_password_warn_age_login_defs = 7

5.4.1.4: Ensure strong password hashing algorithm is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• set_password_hashing_algorithm_logindefs: Set Password Hashing Algorithm in /etc/login.defs
• var_password_hashing_algorithm = cis_debian13

5.4.1.5: Ensure inactive password lock is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• account_disable_post_pw_expiration: Set Account Expiration Following Inactivity
• accounts_set_post_pw_existing: Set existing passwords a period of inactivity before they been locked
• var_account_disable_post_pw_expiration = 45

5.4.1.6: Ensure all users last password change date is in the past (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_last_change_is_in_past: Ensure all users last password change date is in the past

5.4.2.1: Ensure root is the only UID 0 account (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_no_uid_except_zero: Verify Only Root Has UID 0

5.4.2.2: Ensure root is the only GID 0 account (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_root_gid_zero: Verify Root Has A Primary GID 0

5.4.2.3: Ensure group root is the only GID 0 group (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• groups_no_zero_gid_except_root: Verify Only Group Root Has GID 0

5.4.2.4: Ensure root account access is controlled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ensure_root_access_controlled: Ensure root account access is controlled

5.4.2.5: Ensure root path integrity (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_root_path_dirs_no_write: Ensure that Root's Path Does Not Include World or Group-Writable Directories
• no_dirs_unowned_by_root: Ensure that All Root's Path Directories Are Owned by Root
• root_path_all_dirs: Ensure that All Entries in The Path of Root Are Directories
• root_path_no_dot: Ensure that Root's Path Does Not Include Relative Paths or Null Directories

5.4.2.6: Ensure root user umask is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_umask_root: Ensure the Root Bash Umask is Set Correctly

5.4.2.7: Ensure system accounts do not have a valid login shell (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• no_shelllogin_for_systemaccounts: Ensure that System Accounts Do Not Run a Shell Upon Login

5.4.2.8: Ensure accounts without a valid login shell are locked (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• no_invalid_shell_accounts_unlocked: Verify Non-Interactive Accounts Are Locked

5.4.3.1: Ensure nologin is not listed in /etc/shells (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• no_nologin_in_shells: Ensure nologin Shell is Not Listed in /etc/shells

5.4.3.2: Ensure default user shell timeout is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_tmout: Set Interactive Session Timeout
• var_accounts_tmout = 15_min

5.4.3.3: Ensure default user umask is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_umask_etc_bashrc: Ensure the Default Bash Umask is Set Correctly
• accounts_umask_etc_login_defs: Ensure the Default Umask is Set Correctly in login.defs
• accounts_umask_etc_profile: Ensure the Default Umask is Set Correctly in /etc/profile
• var_accounts_user_umask = 027

6.1.1.1.1: Ensure journald service is active (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• service_systemd-journald_enabled: Enable systemd-journald Service

6.1.1.1.2: Ensure journald log file access is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

6.1.1.1.3: Ensure journald log file rotation is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

6.1.1.1.4: Ensure journald ForwardToSyslog is disabled (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• journald_disable_forward_to_syslog: Ensure journald ForwardToSyslog is disabled

6.1.1.1.5: Ensure journald Storage is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• journald_storage: Ensure journald is configured to write log files to persistent disk

6.1.1.1.6: Ensure journald Compress is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• journald_compress: Ensure journald is configured to compress large log files

6.1.1.2.1: Ensure systemd-journal-remote is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_systemd-journal-remote_installed: Install systemd-journal-remote Package

6.1.1.2.2: Ensure systemd-journal-upload authentication is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: yes

• systemd_journal_upload_server_tls: Configure systemd-journal-upload TLS parameters: ServerKeyFile, ServerCertificateFile and TrustedCertificateFile
• systemd_journal_upload_url: Configure systemd-journal-upload URL

6.1.1.2.3: Ensure systemd-journal-upload is enabled and active (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• service_systemd-journal-upload_enabled: Enable systemd-journal-upload Service

6.1.1.2.4: Ensure systemd-journal-remote service is not in use (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• socket_systemd-journal-remote_disabled: Disable systemd-journal-remote Socket

6.1.2.1: Ensure rsyslog is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• package_rsyslog_installed: Ensure rsyslog is Installed

6.1.2.2: Ensure rsyslog service is enabled and active (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• service_rsyslog_enabled: Enable rsyslog Service

6.1.2.3: Ensure journald is configured to send logs to rsyslog (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• journald_forward_to_syslog: Ensure journald is configured to send logs to rsyslog

6.1.2.4: Ensure rsyslog log file creation mode is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• rsyslog_filecreatemode: Ensure rsyslog Default File Permissions Configured

6.1.2.5: Ensure rsyslog logging is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

6.1.2.6: Ensure rsyslog is configured to send logs to a remote log host (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

6.1.2.7: Ensure rsyslog is not configured to receive logs from a remote client (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• rsyslog_nolisten: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server

6.1.2.8: Ensure logrotate is configured (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

6.1.2.9: Ensure rsyslog-gnutls is installed (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• package_rsyslog-gnutls_installed: Ensure rsyslog-gnutls is installed

6.1.2.10: Ensure rsyslog forwarding uses gtls (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• rsyslog_remote_tls: Configure TLS for rsyslog remote logging

6.1.2.11: Ensure rsyslog CA certificates are configured (Manual)

Description: None

• l2_server
• l2_workstation

Automated: no

No rules selected

6.1.3.1: Ensure access to all logfiles has been configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_var_log_auth: Verify Group Who Owns /var/log/auth.log File
• file_groupowner_var_log_cloud_init: Verify Group Who Owns /var/log/cloud-init.log* File
• file_groupowner_var_log_journal: Verify Group Who Owns /var/log/*.journal(~) File
• file_groupowner_var_log_lastlog: Verify Group Who Owns /var/log/lastlog File
• file_groupowner_var_log_localmessages: Verify Group Who Owns /var/log/localmessages* File
• file_groupowner_var_log_messages: Verify Group Who Owns /var/log/messages File
• file_groupowner_var_log_secure: Verify Group Who Owns /var/log/secure File
• file_groupowner_var_log_syslog: Verify Group Who Owns /var/log/syslog File
• file_groupowner_var_log_waagent: Verify Group Who Owns /var/log/waagent.log File
• file_groupowner_var_log_wbtmp: Verify Group Who Owns /var/log/(b|w)tmp(.*|-*) File
• file_groupownerships_var_log: Verify ownership of log files
• file_groupownerships_var_log_apt: Verify Groupownership of Files in /var/log/apt
• file_groupownerships_var_log_gdm: Verify Groupownership of Files in /var/log/gdm
• file_groupownerships_var_log_gdm3: Verify Groupownership of Files in /var/log/gdm3
• file_groupownerships_var_log_landscape: Verify Groupownership of Files in /var/log/landscape
• file_groupownerships_var_log_sssd: Verify Grouponwership of Files in /var/log/sssd
• file_owner_var_log_auth: Verify User Who Owns /var/log/auth.log File
• file_owner_var_log_cloud_init: Verify User Who Owns /var/log/cloud-init.log File
• file_owner_var_log_journal: Verify User Who Owns /var/log/*.journal(~) Files
• file_owner_var_log_lastlog: Verify User Who Owns /var/log/lastlog File
• file_owner_var_log_localmessages: Verify User Who Owns /var/log/localmessages File
• file_owner_var_log_messages: Verify User Who Owns /var/log/messages File
• file_owner_var_log_secure: Verify User Who Owns /var/log/secure File
• file_owner_var_log_syslog: Verify User Who Owns /var/log/syslog File
• file_owner_var_log_waagent: Verify User Who Owns /var/log/waagent.log File
• file_owner_var_log_wbtmp: Verify User Who Owns /var/log/(b|w)tmp(.*|-*) File
• file_ownerships_var_log: Verify ownership of log files
• file_ownerships_var_log_apt: Verify Ownership of Files in /var/log/apt
• file_ownerships_var_log_gdm: Verify Ownership of Files in /var/log/gdm
• file_ownerships_var_log_gdm3: Verify Ownership of Files in /var/log/gdm3
• file_ownerships_var_log_landscape: Verify Ownership of Files in /var/log/landscape
• file_ownerships_var_log_sssd: Verify Ownership of Files in /var/log/sssd
• file_permissions_var_log_apt: Verify Permissions on files in the /var/log/apt/.* directory
• file_permissions_var_log_auth: Verify Permissions on /var/log/auth.log File
• file_permissions_var_log_cloud-init: Verify Permissions on /var/log/cloud-init.log(.*) Files
• file_permissions_var_log_gdm: Verify Permissions of Files in /var/log/gdm
• file_permissions_var_log_gdm3: Verify Permissions of Files in /var/log/gdm3
• file_permissions_var_log_lastlog: Verify Permissions on /var/log/lastlog(.*) Files
• file_permissions_var_log_localmessages: Verify Permissions on /var/log/localmessages(.*) Files
• file_permissions_var_log_messages: Verify Permissions on /var/log/messages File
• file_permissions_var_log_secure: Verify Permissions on /var/log/secure File
• file_permissions_var_log_sssd: Verify Permissions of Files in /var/log/sssd
• file_permissions_var_log_syslog: Verify Permissions on /var/log/syslog File
• file_permissions_var_log_waagent: Verify Permissions on /var/log/waagent.log(.*) Files
• file_permissions_var_log_wbtmp: Verify Permissions on /var/log/wtmp(.*) Files
• permissions_local_var_log: Verify permissions of log files

6.2.1.1: Ensure auditd packages are installed (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• package_audit-audispd-plugins_installed: Ensure the default plugins for the audit dispatcher are Installed
• package_audit_installed: Ensure the audit Subsystem is Installed

6.2.1.2: Ensure auditd service is enabled and active (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• service_auditd_enabled: Enable auditd Service

6.2.1.3: Ensure auditing for processes that start prior to auditd is enabled (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• grub2_audit_argument: Enable Auditing for Processes Which Start Prior to the Audit Daemon
• zipl_audit_argument: Enable Auditing to Start Prior to the Audit Daemon in zIPL

6.2.1.4: Ensure audit_backlog_limit is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• grub2_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon
• var_audit_backlog_limit = 8192
• zipl_audit_backlog_limit_argument: Extend Audit Backlog Limit for the Audit Daemon in zIPL

6.2.2.1: Ensure audit log storage size is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• auditd_data_retention_max_log_file: Configure auditd Max Log File Size
• var_auditd_max_log_file = 6

6.2.2.2: Ensure audit logs are not automatically deleted (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• auditd_data_retention_max_log_file_action: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
• var_auditd_max_log_file_action = keep_logs

6.2.2.3: Ensure system is disabled when audit logs are full (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• auditd_data_disk_error_action: Configure auditd Disk Error Action on Disk Error
• auditd_data_disk_full_action: Configure auditd Disk Full Action when Disk Space Is Full
• var_auditd_disk_error_action = cis_debian13
• var_auditd_disk_full_action = cis_debian13

6.2.2.4: Ensure system warns when audit logs are low on space (Automated)

Description: None

• l2_server
• l2_workstation

Automated: no

• auditd_data_retention_action_mail_acct: Configure auditd mail_acct Action on Low Disk Space
• auditd_data_retention_admin_space_left_action: Configure auditd admin_space_left Action on Low Disk Space
• auditd_data_retention_space_left_action: Configure auditd space_left Action on Low Disk Space
• var_auditd_action_mail_acct = root
• var_auditd_admin_space_left_action = halt
• var_auditd_space_left_action = email

6.2.3.1: Ensure modification of the /etc/sudoers file is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_sysadmin_actions: Ensure auditd Collects System Administrator Actions

6.2.3.2: Ensure actions as another user are always logged (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_suid_auid_privilege_function: Record Events When Executables Are Run As Another User

6.2.3.3: Ensure events that modify the sudo log file are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_sudo_log_events: Record Attempts to perform maintenance activities

6.2.3.4: Ensure events that modify date and time information are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_time_adjtimex: Record attempts to alter time through adjtimex
• audit_rules_time_clock_settime: Record Attempts to Alter Time Through clock_settime
• audit_rules_time_settimeofday: Record attempts to alter time through settimeofday
• audit_rules_time_watch_localtime: Record Attempts to Alter the localtime File

6.2.3.5: Ensure events that modify sethostname and setdomainname are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_networkconfig_modification_setdomainname: Record Events that Modify the System's Network Environment - setdomainname
• audit_rules_networkconfig_modification_sethostname: Record Events that Modify the System's Network Environment - sethostname

6.2.3.6: Ensure events that modify /etc/issue and /etc/issue.net are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_networkconfig_modification_etc_issue: Record Events that Modify the System's Network Environment - /etc/issue
• audit_rules_networkconfig_modification_etc_issue_net: Record Events that Modify the System's Network Environment - /etc/issue.net

6.2.3.7: Ensure events that modify /etc/hosts and /etc/hostname are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_networkconfig_modification_etc_hosts: Record Events that Modify the System's Network Environment - /etc/hosts
• audit_rules_networkconfig_modification_hostname_file: Record Events that Modify the System's Network Environment - /etc/hostname

6.2.3.8: Ensure events that modify the system's network environment are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_networkconfig_modification: Record Events that Modify the System's Network Environment

6.2.3.9: Ensure events that modify /etc/NetworkManager directory are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_networkconfig_modification_networkmanager: Record Events that Modify the System's Network Environment - /etc/NetworkManager/

6.2.3.10: Ensure use of privileged commands are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_privileged_commands: Ensure auditd Collects Information on the Use of Privileged Commands

6.2.3.11: Ensure unsuccessful file access attempts are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_unsuccessful_file_modification_creat: Record Unsuccessful Access Attempts to Files - creat
• audit_rules_unsuccessful_file_modification_ftruncate: Record Unsuccessful Access Attempts to Files - ftruncate
• audit_rules_unsuccessful_file_modification_open: Record Unsuccessful Access Attempts to Files - open
• audit_rules_unsuccessful_file_modification_openat: Record Unsuccessful Access Attempts to Files - openat
• audit_rules_unsuccessful_file_modification_truncate: Record Unsuccessful Access Attempts to Files - truncate

6.2.3.12: Ensure events that modify /etc/group information are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_group: Record Events that Modify User/Group Information - /etc/group

6.2.3.13: Ensure events that modify /etc/passwd information are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_passwd: Record Events that Modify User/Group Information - /etc/passwd

6.2.3.14: Ensure events that modify /etc/shadow and /etc/gshadow are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_gshadow: Record Events that Modify User/Group Information - /etc/gshadow
• audit_rules_usergroup_modification_shadow: Record Events that Modify User/Group Information - /etc/shadow

6.2.3.15: Ensure events that modify /etc/security/opasswd are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_opasswd: Record Events that Modify User/Group Information - /etc/security/opasswd

6.2.3.16: Ensure events that modify /etc/nsswitch.conf file are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_nsswitch_conf: Record Events that Modify User/Group Information - /etc/nsswitch.conf

6.2.3.17: Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_usergroup_modification_pam_conf: Record Events that Modify User/Group Information - /etc/pam.conf
• audit_rules_usergroup_modification_pamd: Record Events that Modify User/Group Information - /etc/pam.d/

6.2.3.18: Ensure discretionary access control permission modification events chmod,fchmod,fchmodat,fchmodat2 are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_dac_modification_chmod: Record Events that Modify the System's Discretionary Access Controls - chmod
• audit_rules_dac_modification_fchmod: Record Events that Modify the System's Discretionary Access Controls - fchmod
• audit_rules_dac_modification_fchmodat: Record Events that Modify the System's Discretionary Access Controls - fchmodat
• audit_rules_dac_modification_fchmodat2: Record Events that Modify the System's Discretionary Access Controls - fchmodat2

6.2.3.19: Ensure discretionary access control permission modification events chown,fchown,lchown,fchownat are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_dac_modification_chown: Record Events that Modify the System's Discretionary Access Controls - chown
• audit_rules_dac_modification_fchown: Record Events that Modify the System's Discretionary Access Controls - fchown
• audit_rules_dac_modification_fchownat: Record Events that Modify the System's Discretionary Access Controls - fchownat
• audit_rules_dac_modification_lchown: Record Events that Modify the System's Discretionary Access Controls - lchown

6.2.3.20: Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_dac_modification_fremovexattr: Record Events that Modify the System's Discretionary Access Controls - fremovexattr
• audit_rules_dac_modification_fsetxattr: Record Events that Modify the System's Discretionary Access Controls - fsetxattr
• audit_rules_dac_modification_lremovexattr: Record Events that Modify the System's Discretionary Access Controls - lremovexattr
• audit_rules_dac_modification_lsetxattr: Record Events that Modify the System's Discretionary Access Controls - lsetxattr
• audit_rules_dac_modification_removexattr: Record Events that Modify the System's Discretionary Access Controls - removexattr
• audit_rules_dac_modification_setxattr: Record Events that Modify the System's Discretionary Access Controls - setxattr

6.2.3.21: Ensure successful file system mounts are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_media_export: Ensure auditd Collects Information on Exporting to Media (successful)

6.2.3.22: Ensure session initiation information is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_session_events: Record Attempts to Alter Process and Session Initiation Information

6.2.3.23: Ensure login and logout events are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_login_events_faillock: Record Attempts to Alter Logon and Logout Events - faillock
• audit_rules_login_events_lastlog: Record Attempts to Alter Logon and Logout Events - lastlog
• var_accounts_passwords_pam_faillock_dir = run

6.2.3.24: Ensure unlink file deletion events by users are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_file_deletion_events_unlink: Ensure auditd Collects File Deletion Events by User - unlink
• audit_rules_file_deletion_events_unlinkat: Ensure auditd Collects File Deletion Events by User - unlinkat

6.2.3.25: Ensure rename file deletion events by users are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_file_deletion_events_rename: Ensure auditd Collects File Deletion Events by User - rename
• audit_rules_file_deletion_events_renameat: Ensure auditd Collects File Deletion Events by User - renameat
• audit_rules_file_deletion_events_renameat2: Ensure auditd Collects File Deletion Events by User - renameat2

6.2.3.26: Ensure events that modify the system's Mandatory Access Controls are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_mac_modification_etc_apparmor: Record Events that Modify the System's Mandatory Access Controls (/etc/apparmor)
• audit_rules_mac_modification_etc_apparmor_d: Record Events that Modify the System's Mandatory Access Controls (/etc/apparmor.d)

6.2.3.27: Ensure successful and unsuccessful attempts to use the chcon command are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_execution_chcon: Record Any Attempts to Run chcon

6.2.3.28: Ensure successful and unsuccessful attempts to use the setfacl command are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_execution_setfacl: Record Any Attempts to Run setfacl

6.2.3.29: Ensure successful and unsuccessful attempts to use the chacl command are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_execution_chacl: Record Any Attempts to Run chacl

6.2.3.30: Ensure successful and unsuccessful attempts to use the usermod command are collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_privileged_commands_usermod: Ensure auditd Collects Information on the Use of Privileged Commands - usermod

6.2.3.31: Ensure kernel module loading unloading and modification is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_privileged_commands_kmod: Ensure auditd Collects Information on the Use of Privileged Commands - kmod

6.2.3.32: Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_kernel_module_loading_finit: Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module
• audit_rules_kernel_module_loading_init: Ensure auditd Collects Information on Kernel Module Loading - init_module

6.2.3.33: Ensure kernel "delete_module" loading unloading and modification is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_kernel_module_loading_delete: Ensure auditd Collects Information on Kernel Module Unloading - delete_module

6.2.3.34: Ensure kernel query_module loading unloading and modification is collected (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_kernel_module_loading_create: Ensure auditd Collects Information on Kernel Module Unloading - create_module
• audit_rules_kernel_module_loading_query: Ensure auditd Collects Information on Kernel Module Loading and Unloading - query_module

6.2.3.35: Ensure the audit configuration is loaded regardless of errors (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_continue_loading: Ensure the Audit Configuration is Loaded Regardless of Errors

6.2.3.36: Ensure the audit configuration is immutable (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• audit_rules_immutable: Make the auditd Configuration Immutable

6.2.3.37: Ensure the running and on disk configuration is the same (Manual)

Description: None

• l2_server
• l2_workstation

Automated: no

No rules selected

6.2.4.1: Ensure audit log files mode is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_permissions_var_log_audit: System Audit Logs Must Have Mode 0640 or Less Permissive

6.2.4.2: Ensure audit log files owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_ownership_var_log_audit_stig: System Audit Logs Must Be Owned By Root

6.2.4.3: Ensure audit log files group owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_group_ownership_var_log_audit: System Audit Logs Must Be Group Owned By Root

6.2.4.4: Ensure the audit log file directory mode is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• directory_permissions_var_log_audit: System Audit Logs Must Have Mode 0750 or Less Permissive

6.2.4.5: Ensure audit configuration files mode is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_permissions_etc_audit_auditd: Verify Permissions on /etc/audit/auditd.conf
• file_permissions_etc_audit_rules: Verify Permissions on /etc/audit/audit.rules
• file_permissions_etc_audit_rulesd: Verify Permissions on /etc/audit/rules.d/*.rules

6.2.4.6: Ensure audit configuration files owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_ownership_audit_configuration: Audit Configuration Files Must Be Owned By Root

6.2.4.7: Ensure audit configuration files group owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_groupownership_audit_configuration: Audit Configuration Files Must Be Owned By Group root

6.2.4.8: Ensure audit tools mode is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_permissions_audit_binaries: Verify that audit tools Have Mode 0755 or less

6.2.4.9: Ensure audit tools owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_ownership_audit_binaries: Verify that audit tools are owned by root

6.2.4.10: Ensure audit tools group owner is configured (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• file_groupownership_audit_binaries: Verify that audit tools are owned by group root

6.3.1: Ensure AIDE is installed (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• aide_build_database: Build and Test AIDE Database
• package_aide_installed: Install AIDE

6.3.2: Ensure filesystem integrity is regularly checked (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• aide_periodic_checking_systemd_timer: Configure Systemd Timer Execution of AIDE

6.3.3: Ensure cryptographic mechanisms are used to protect the integrity of audit tools (Automated)

Description: None

• l2_server
• l2_workstation

Automated: yes

• aide_check_audit_tools: Configure AIDE to Verify the Audit Tools

7.1.1: Ensure access to /etc/passwd is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_passwd: Verify Group Who Owns passwd File
• file_owner_etc_passwd: Verify User Who Owns passwd File
• file_permissions_etc_passwd: Verify Permissions on passwd File

7.1.2: Ensure access to /etc/passwd- is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_backup_etc_passwd: Verify Group Who Owns Backup passwd File
• file_owner_backup_etc_passwd: Verify User Who Owns Backup passwd File
• file_permissions_backup_etc_passwd: Verify Permissions on Backup passwd File

7.1.3: Ensure access to /etc/group is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_group: Verify Group Who Owns group File
• file_owner_etc_group: Verify User Who Owns group File
• file_permissions_etc_group: Verify Permissions on group File

7.1.4: Ensure access to /etc/group- is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_backup_etc_group: Verify Group Who Owns Backup group File
• file_owner_backup_etc_group: Verify User Who Owns Backup group File
• file_permissions_backup_etc_group: Verify Permissions on Backup group File

7.1.5: Ensure access to /etc/shadow is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_shadow: Verify Group Who Owns shadow File
• file_owner_etc_shadow: Verify User Who Owns shadow File
• file_permissions_etc_shadow: Verify Permissions on shadow File

7.1.6: Ensure access to /etc/shadow- is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_backup_etc_shadow: Verify User Who Owns Backup shadow File
• file_owner_backup_etc_shadow: Verify Group Who Owns Backup shadow File
• file_permissions_backup_etc_shadow: Verify Permissions on Backup shadow File

7.1.7: Ensure access to /etc/gshadow is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_gshadow: Verify Group Who Owns gshadow File
• file_owner_etc_gshadow: Verify User Who Owns gshadow File
• file_permissions_etc_gshadow: Verify Permissions on gshadow File

7.1.8: Ensure access to /etc/gshadow- is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_backup_etc_gshadow: Verify Group Who Owns Backup gshadow File
• file_owner_backup_etc_gshadow: Verify User Who Owns Backup gshadow File
• file_permissions_backup_etc_gshadow: Verify Permissions on Backup gshadow File

7.1.9: Ensure access to /etc/shells is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_shells: Verify Group Who Owns /etc/shells File
• file_owner_etc_shells: Verify Who Owns /etc/shells File
• file_permissions_etc_shells: Verify Permissions on /etc/shells File

7.1.10: Ensure access to /etc/security/opasswd is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_groupowner_etc_security_opasswd: Verify Group Who Owns /etc/security/opasswd File
• file_groupowner_etc_security_opasswd_old: Verify Group Who Owns /etc/security/opasswd.old File
• file_owner_etc_security_opasswd: Verify User Who Owns /etc/security/opasswd File
• file_owner_etc_security_opasswd_old: Verify User Who Owns /etc/security/opasswd.old File
• file_permissions_etc_security_opasswd: Verify Permissions on /etc/security/opasswd File
• file_permissions_etc_security_opasswd_old: Verify Permissions on /etc/security/opasswd.old File

7.1.11: Ensure world writable files and directories are secured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_permissions_unauthorized_world_writable: Ensure No World-Writable Files Exist

7.1.12: Ensure no files or directories without an owner and a group exist (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• file_permissions_ungroupowned: Ensure All Files Are Owned by a Group
• no_files_unowned_by_user: Ensure All Files Are Owned by a User

7.1.13: Ensure SUID and SGID files are reviewed (Manual)

Description: None

• l1_server
• l1_workstation

Automated: no

No rules selected

7.2.1: Ensure accounts in /etc/passwd use shadowed passwords (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_password_all_shadowed: Verify All Account Password Hashes are Shadowed

7.2.2: Ensure /etc/shadow password fields are not empty (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• no_empty_passwords_etc_shadow: Ensure There Are No Accounts With Blank or Null Passwords

7.2.3: Ensure all groups in /etc/passwd exist in /etc/group (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• gid_passwd_group_same: All GIDs referenced in /etc/passwd must be defined in /etc/group

7.2.4: Ensure shadow group is empty (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• ensure_shadow_group_empty: Ensure shadow Group is Empty

7.2.5: Ensure no duplicate UIDs exist (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• account_unique_id: Ensure All Accounts on the System Have Unique User IDs

7.2.6: Ensure no duplicate GIDs exist (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• group_unique_id: Ensure All Groups on the System Have Unique Group ID

7.2.7: Ensure no duplicate user names exist (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• account_unique_name: Ensure All Accounts on the System Have Unique Names

7.2.8: Ensure no duplicate group names exist (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• group_unique_name: Ensure All Groups on the System Have Unique Group Names

7.2.9: Ensure local interactive user home directories are configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_user_interactive_home_directory_exists: All Interactive Users Home Directories Must Exist
• file_groupownership_home_directories: All Interactive User Home Directories Must Be Group-Owned By The Primary Group
• file_ownership_home_directories: All Interactive User Home Directories Must Be Owned By The Primary User
• file_permissions_home_directories: All Interactive User Home Directories Must Have mode 0750 Or Less Permissive

7.2.10: Ensure local interactive user dot files access is configured (Automated)

Description: None

• l1_server
• l1_workstation

Automated: yes

• accounts_user_dot_group_ownership: User Initialization Files Must Be Group-Owned By The Primary Group
• accounts_user_dot_user_ownership: User Initialization Files Must Be Owned By the Primary User
• file_permission_user_bash_history: Ensure User Bash History File Has Correct Permissions
• file_permission_user_init_files: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
• no_forward_files: Verify No .forward Files Exist
• no_netrc_files: Verify No netrc Files Exist
• no_rsh_trust_files: Remove Rsh Trust Files
• var_user_initialization_files_regex = all_dotfiles