CIS Amazon Linux 2 Benchmarks
290 articles
- Ensure Audit Logging of Network Environment Modification Events
- Ensure Audit Logging of Privileged Command Usage
- Ensure Audit Logging of Unsuccessful File Access Attempts
- Ensure Audit Logging of User and Group Modification Events
- Ensure Audit Logging of Discretionary Access Control Permission Modifications
- Ensure Audit Logging of Successful Filesystem Mount Events
- Disable cramfs Kernel Module to Reduce Linux Attack Surface
- Ensure Audit Logging of Session Initiation Events
- Disable freevxfs Kernel Module to Harden Linux Kernel
- Disable hfs Kernel Module to Harden Linux Kernel Security
- Ensure Audit Logging of Login and Logout Events
- Disable hfsplus Kernel Module to Strengthen Linux Kernel Security
- Disable jffs2 Kernel Module to Reduce Linux Attack Surface
- Ensure Audit Logging of File Deletion Events by Users
- Disable squashfs Kernel Module to Harden Linux Kernel
- Ensure Audit Logging of Mandatory Access Control (MAC) Modification Events
- Disable udf Kernel Module to Harden Linux Kernel Security
- Disable usb-storage Kernel Module to Prevent Unauthorized USB Device Access
- Ensure /tmp Directory is Mounted on a Separate Partition
- Ensure nodev Mount Option is Set on /tmp Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /tmp Partition to Prevent Privilege Escalation
- Ensure noexec Mount Option is Set on /tmp Partition to Prevent Execution of Binaries
- Ensure Audit Logging of All Attempts to Use the chcon Command
- Ensure Audit Logging of All Attempts to Use the setfacl Command
- Ensure Audit Logging of All Attempts to Use the chacl Command
- Ensure Audit Logging of All Attempts to Use the usermod Command
- Ensure /dev/shm is Mounted on a Separate Partition for Secure Shared Memory
- Ensure nodev Mount Option is Set on /dev/shm Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /dev/shm Partition to Prevent Privilege Escalation
- Ensure noexec Mount Option is Set on /dev/shm Partition to Prevent Execution of Binaries
- Ensure /home Directory is Mounted on a Separate Partition
- Ensure nodev Mount Option is Set on /home Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /home Partition to Prevent Privilege Escalation
- Ensure /var Directory is Mounted on a Separate Partition
- Ensure nodev Mount Option is Set on /var Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /var Partition to Prevent Privilege Escalation
- Ensure /var/tmp Directory is Mounted on a Separate Partition
- Ensure nodev Mount Option is Set on /var/tmp Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /var/tmp Partition to Prevent Privilege Escalation
- Ensure noexec Mount Option is Set on /var/tmp Partition to Prevent Execution of Binaries
- Ensure /var/log Directory is Mounted on a Separate Partition
- Ensure nodev Mount Option is Set on /var/log Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /var/log Partition to Prevent Privilege Escalation
- Ensure noexec Mount Option is Set on /var/log Partition to Prevent Execution of Binaries
- Ensure /var/log/audit Directory is Mounted on a Separate Partition
- Ensure Audit Logging of Kernel Module Load, Unload, and Modification Events
- Ensure nodev Mount Option is Set on /var/log/audit Partition to Enhance Security
- Ensure nosuid Mount Option is Set on /var/log/audit Partition to Prevent Privilege Escalation
- Ensure noexec Mount Option is Set on /var/log/audit Partition to Prevent Execution of Binaries
- Ensure Audit Configuration is Set to Immutable
- Ensure GPG Keys Are Configured to Verify Software Packages
- Ensure Consistency Between Running and On-Disk Configuration
- Ensure Global gpgcheck is Enabled for Package Verification
- Ensure Audit Log Directory Has Permissions Set to 0750 or More Restrictive
- Ensure Global repo_gpgcheck is Enabled for Repository Metadata Verification
- Ensure Package Manager Repositories Are Properly Configured
- Ensure System Updates, Patches, and Security Software Are Installed
- Ensure Authentication is Required for Single User Mode Access
- Ensure Address Space Layout Randomization (ASLR) is Enabled to Mitigate Memory Exploits
- Ensure ptrace_scope is Restricted to Enhance Process Security
- Ensure Core Dump Backtraces Are Disabled to Prevent Sensitive Data Exposure
- Ensure Core Dump Storage is Disabled to Protect Sensitive Information
- Ensure SELinux is Installed to Enforce Mandatory Access Control
- Ensure SELinux is Enabled in Bootloader Configuration
- Ensure SELinux Policy is Properly Configured and Enforced
- Ensure SELinux Mode is Enabled and Not Disabled
- Ensure SELinux Mode is Set to Enforcing
- Ensure No Unconfined Services Are Running on the System
- Ensure the MCS Translation Service (mcstrans) is Not Installed
- Ensure SETroubleshoot Package is Not Installed
- Ensure Message of the Day (MOTD) is Properly Configured
- Ensure Local Login Warning Banner is Properly Configured
- Ensure Remote Login Warning Banner is Properly Configured
- Ensure Proper Access Permissions are Set on /etc/motd
- Ensure Proper Access Permissions are Set on /etc/issue
- Ensure Proper Access Permissions are Set on /etc/issue.net
- Ensure Time Synchronization Service is Enabled and Running
- Ensure Chrony Time Synchronization Service is Properly Configured and Running
- Ensure Chrony Service Does Not Run as Root User
- Ensure autofs Services Are Not Enabled or Running
- Ensure Avahi Daemon Services Are Disabled and Not Running
- Ensure DHCP Server Services Are Disabled and Not Running
- Ensure DNS Server Services Are Disabled and Not Running
- Ensure dnsmasq Services Are Disabled and Not Running
- Ensure Samba File Server Services Are Disabled and Not Running
- Ensure FTP Server Services Are Disabled and Not Running
- Ensure Message Access Server Services Are Disabled and Not Running
- Ensure Network File System (NFS) Services Are Disabled and Not Running
- Ensure NIS Server Services Are Disabled and Not Running
- Ensure Print Server Services Are Disabled and Not Running
- Ensure rpcbind Services Are Disabled and Not Running
- Ensure rsync Services Are Disabled and Not Running
- Ensure SNMP Services Are Disabled and Not Running
- Ensure Telnet Server Services Are Disabled and Not Running
- Ensure TFTP Server Services Are Disabled and Not Running
- Ensure Web Proxy Server Services Are Disabled and Not Running
- Ensure Web Server Services Are Disabled and Not Running
- Ensure xinetd Services Are Disabled and Not Running
- Ensure X Window Server Services Are Disabled and Not Running
- Ensure Mail Transfer Agents Are Configured for Local-Only Mode
- Ensure Only Approved Services Are Listening on Network Interfaces
- Ensure FTP Client Is Not Installed
- Ensure LDAP Client Is Not Installed
- Ensure NIS Client Is Not Installed
- Ensure Telnet Client Is Not Installed
- Ensure TFTP Client Is Not Installed
- Ensure IPv6 Status Is Identified and Documented
- Ensure Wireless Network Interfaces Are Disabled
- Ensure Bluetooth Services Are Disabled and Not Running
- Ensure DCCP Kernel Module Is Not Available
- Ensure TIPC Kernel Module Is Not Available
- Ensure RDS Kernel Module Is Not Available
- Ensure SCTP Kernel Module Is Not Available
- Ensure IP Forwarding Is Disabled
- Ensure Packet Redirect Sending Is Disabled
- Ensure Bogus ICMP Responses Are Ignored
- Ensure Broadcast ICMP Requests Are Ignored
- Ensure ICMP Redirects Are Not Accepted
- Ensure Secure ICMP Redirects Are Not Accepted
- Ensure Reverse Path Filtering Is Enabled
- Ensure Source Routed Packets Are Not Accepted
- Ensure Suspicious Packets Are Logged
- Ensure TCP SYN Cookies Are Enabled
- Ensure IPv6 Router Advertisements Are Not Accepted
- Ensure iptables Is Installed
- Ensure Only One Firewall Configuration Utility Is In Use
- Ensure firewalld Is Installed
- Ensure firewalld Service Is Enabled and Running
- Ensure firewalld Drops Unnecessary Services and Ports
- Ensure Network Interfaces Are Assigned to Appropriate Zones
- Ensure nftables Is Installed
- Ensure iptables Rules Are Flushed When Using nftables
- Ensure an nftables Table Exists
- Ensure nftables Base Chains Exist
- Ensure nftables Loopback Traffic Is Properly Configured
- Ensure nftables Outbound and Established Connections Are Properly Configured
- Ensure nftables Default Deny Firewall Policy Is Configured
- Ensure nftables Service Is Enabled and Active
- Ensure nftables Rules Are Permanent
- Ensure iptables Packages Are Installed
- Ensure iptables Loopback Traffic Is Properly Configured
- Ensure iptables Outbound and Established Connections Are Properly Configured
- Ensure iptables Rules Exist for All Open Ports
- Ensure iptables Default Deny Firewall Policy Is Configured
- Ensure iptables Rules Are Saved
- Ensure iptables Service Is Enabled and Active
- Ensure ip6tables Loopback Traffic Is Properly Configured
- Ensure ip6tables Outbound and Established Connections Are Properly Configured
- Ensure ip6tables Firewall Rules Exist for All Open Ports
- Ensure ip6tables Default Deny Firewall Policy Is Configured
- Ensure ip6tables Rules Are Saved
- Ensure ip6tables Service Is Enabled and Active
- Ensure Cron Daemon Is Enabled and Active
- Ensure Permissions on /etc/crontab Are Configured
- Ensure Permissions on /etc/cron.hourly Are Configured
- Ensure Permissions on /etc/cron.daily Are Configured
- Ensure Permissions on /etc/cron.weekly Are Configured
- Ensure Proper Permissions on Local Interactive User Dot Files
- Ensure Proper Permissions on Local Interactive User Home Directories
- Ensure Root is the Only Account with UID 0
- Ensure Root User PATH Environment Variable Integrity
- Ensure No Duplicate Group Names Exist on the System
- Ensure No Duplicate User Names Exist on the System
- Ensure No Duplicate GIDs Exist on the System
- Ensure No Duplicate UIDs Exist on the System
- Ensure All Groups Referenced in /etc/passwd Exist in /etc/group
- Ensure Password Fields in /etc/shadow Are Not Empty
- Ensure Accounts in /etc/passwd Use Shadowed Passwords
- Audit and Verify System File Permissions for Security Compliance
- Ensure Permissions on /etc/cron.monthly Are Configured
- Ensure Regular Review of SUID and SGID Files to Prevent Privilege Escalation
- Ensure Permissions on /etc/cron.d Are Configured
- Ensure Crontab Is Restricted to Authorized Users
- Ensure No Unowned or Ungrouped Files or Directories Exist on the System
- Ensure At Is Restricted to Authorized Users
- Ensure Permissions on /etc/ssh/sshd_config Are Configured
- Ensure Permissions on SSH Private Host Key Files Are Configured
- Ensure World Writable Files and Directories Are Secured
- Ensure Proper Permissions on /etc/security/opasswd File
- Ensure sshd Access Is Properly Configured
- Ensure Proper Permissions on /etc/shells File
- Ensure sshd Access Is Properly Configured
- Ensure sshd Banner Is Configured
- Ensure Proper Permissions on /etc/gshadow- File
- Ensure sshd Ciphers Are Configured
- Ensure Proper Permissions on /etc/gshadow File
- Ensure sshd ClientAliveInterval and ClientAliveCountMax Are Configured
- Ensure Proper Permissions on /etc/shadow- File
- Ensure Proper Permissions on /etc/shadow File
- Ensure sshd ClientAliveInterval and ClientAliveCountMax Are Configured
- Ensure Proper Permissions on /etc/group- File
- Ensure Proper Permissions on /etc/group File
- Ensure Proper Permissions on /etc/passwd- File
- Ensure Proper Permissions on /etc/passwd File
- Ensure Regular Filesystem Integrity Checks Are Performed
- Ensure AIDE (Advanced Intrusion Detection Environment) is Installed
- Ensure Audit Tools Belong to Group Root
- Ensure Audit Tools Are Owned by Root
- Ensure Audit Tools Have Permissions Set to 755 or More Restrictive
- Ensure Audit Configuration Files Belong to Group Root
- Ensure Audit Configuration Files Are Owned by Root
- Ensure Audit Configuration Files Have Permissions Set to 640 or More Restrictive
- Ensure pam_pwquality Module Is Enabled
- Ensure Password Number of Changed Characters Is Configured
- Ensure Password Length Is Configured
- Ensure Password Complexity Is Configured
- Ensure Password Same Consecutive Characters Limit Is Configured
- Ensure Password Maximum Sequential Characters Is Configured
- Ensure Password Dictionary Check Is Enabled
- Ensure pam_pwhistory Module Is Enabled
- Ensure Password History Remember Is Configured
- Ensure Password History Is Enforced for the Root User
- Ensure pam_pwhistory Includes use_authtok Option
- Ensure pam_unix Module Does Not Include Nullok Option
- Ensure pam_unix Module Does Not Include Nullok Option
- Ensure pam_unix Includes a Strong Password Hashing Algorithm
- Ensure pam_unix Includes use_authtok Option
- Ensure Strong Password Hashing Algorithm Is Configured
- Ensure Password Expiration Is 365 Days or Less
- Ensure sshd DisableForwarding Is Enabled
- Ensure Password Expiration Warning Days Is 7 or More
- Ensure Inactive Password Lock Is 30 Days or Less
- Ensure All Users' Last Password Change Date Is in the Past
- Ensure Default Group for the Root Account Is GID 0
- Ensure Root User umask Is Configured
- Ensure System Accounts Are Secured
- Ensure Root Password Is Set
- Ensure nologin Is Not Listed in /etc/shells
- Ensure Audit Package Is Installed
- Ensure Default User Shell Timeout Is Configured
- Ensure Default User umask Is Configured
- Ensure rsyslog Is Installed
- Ensure rsyslog Service Is Enabled
- Ensure journald Is Configured to Send Logs to rsyslog
- Ensure Auditing for Processes That Start Prior to auditd Is Enabled
- Ensure audit_backlog_limit is sufficient (Automated)
- Ensure auditd service is enabled (Automated)
- Ensure audit log storage size is configured (Automated)
- Ensure audit logs are not automatically deleted (Automated)
- Ensure system is disabled when audit logs are full (Automated)
- Ensure System Warns When Audit Logs Are Low on Space (Automated)
- Ensure Changes to System Administration Scope (sudoers) Are Collected (Automated)
- Ensure Actions as Another User Are Always Logged (Automated)
- Ensure Events That Modify the Sudo Log File Are Collected (Automated)
- Ensure Events That Modify Date and Time Information Are Collected
- Ensure sshd GSSAPIAuthentication Is Disabled
- Ensure Audit Log Files Have Permissions Set to 0640 or More Restrictive
- Ensure sshd HostbasedAuthentication Is Disabled
- Ensure Only Authorized Users Own Audit Log Files
- Ensure sshd IgnoreRhosts Is Enabled
- Ensure Only Authorized Groups Own Audit Log Files
- Ensure All Logfiles Have Appropriate Access Permissions Configured
- Ensure Logrotate Is Properly Configured
- Ensure sshd KexAlgorithms Are Configured
- Ensure journald Log Rotation Is Configured Per Site Policy
- Ensure sshd LoginGraceTime Is Configured
- Ensure journald Is Not Configured to Forward Logs to rsyslog
- Ensure journald Is Configured to Write Logfiles to Persistent Disk
- Ensure sshd LogLevel Is Configured
- Ensure sshd MACs Are Configured
- Ensure sshd MaxAuthTries Is Configured
- Ensure sshd MaxSessions Is Configured
- Ensure sshd MaxStartups Is Configured
- Ensure journald Is Configured to Compress Large Log Files
- Ensure Latest Version of PAM Is Installed
- Ensure libpwquality Is Installed
- Ensure pam_faillock Module Is Enabled
- Ensure Password Failed Attempts Lockout Is Configured
- Ensure Password Unlock Time Is Configured
- Ensure Password Failed Attempts Lockout Includes Root Account
- Ensure sshd PermitEmptyPasswords Is Disabled
- Ensure sshd PermitRootLogin Is Disabled
- Ensure sshd PermitUserEnvironment Is Disabled
- Ensure sshd UsePAM Is Enabled
- Ensure Logging Is Configured
- Ensure sudo Is Installed
- Ensure sudo Commands Use pty
- Ensure rsyslog Is Configured to Send Logs to a Remote Log Host
- Ensure journald Is Configured to Compress Large Log Files
- Ensure sudo Log File Exists
- Ensure Access to the su Command Is Restricted
- Ensure sudo Authentication Timeout Is Configured Correctly
- Ensure systemd-journal-remote Is Installed
- Ensure Users Must Provide Password for Privilege Escalation
- Ensure Re-authentication for Privilege Escalation Is Enabled Globally
- Ensure systemd-journal-remote Is Configured
- Ensure systemd-journal-remote Service Is Enabled
- Ensure journald Is Not Configured to Receive Logs from Remote Clients
- Ensure journald Service Is Enabled
- Ensure journald Is Configured to Compress Large Log Files