Ubuntu 16.04 — Implemented CIS Rules
This page lists every CIS Benchmark rule ImageFactory automates for Ubuntu 16.04, exactly as implemented by the hardening tasks. See CIS Benchmarks for background on Level 1 vs. Level 2, and CIS Hardening Exceptions for rules that are intentionally not automated.
Level 1 (101 rules)
Section 1 — Initial Setup
| Rule ID | Title |
|---|---|
| 1.1.1.1 | Ensure mounting of cramfs filesystems is disabled |
| 1.1.1.2 | Ensure mounting of freevxfs filesystems is disabled |
| 1.1.1.3 | Ensure mounting of jffs2 filesystems is disabled |
| 1.1.1.4 | Ensure mounting of hfs filesystems is disabled |
| 1.1.1.5 | Ensure mounting of hfsplus filesystems is disabled |
| 1.1.1.6 | Ensure mounting of squashfs filesystems is disabled |
| 1.1.3 | 1.1.3 - 1.1.4 | Ensure nodev,nosuid option set on /tmp partition |
| 1.1.4 | 1.1.3 - 1.1.4 | Ensure nodev,nosuid option set on /tmp partition |
| 1.1.7 | 1.1.7 - 1.1.9 | Ensure nodev, nosuid, noexec option set on /dev/shm partition |
| 1.1.8 | 1.1.7 - 1.1.9 | Ensure nodev, nosuid, noexec option set on /dev/shm partition |
| 1.1.9 | 1.1.7 - 1.1.9 | Ensure nodev, nosuid, noexec option set on /dev/shm partition |
| 1.1.12 | 1.1.12 - 1.1.14 | Ensure nodev,nosuid,noexec option set on /var/tmp partition |
| 1.1.13 | 1.1.12 - 1.1.14 | Ensure nodev,nosuid,noexec option set on /var/tmp partition |
| 1.1.14 | 1.1.12 - 1.1.14 | Ensure nodev,nosuid,noexec option set on /var/tmp partition |
| 1.1.18 | Ensure /home partition includes the nodev option |
| 1.1.22 | Ensure sticky bit is set on all world-writable directories |
| 1.1.23 | Disable Automounting |
| 1.3.1 | Ensure AIDE is installed |
| 1.3.2 | Ensure filesystem integrity is regularly checked |
| 1.5.1 | Ensure XD/NX support is enabled |
| 1.5.2 | Ensure address space layout randomization (ASLR) is enabled |
| 1.5.3 | Ensure prelink is disabled |
| 1.5.4 | Ensure core dumps are restricted |
| 1.7.1 | Ensure message of the day is configured properly |
| 1.7.2 | Ensure local login warning banner is configured properly |
| 1.7.3 | Ensure remote login warning banner is configured properly |
| 1.7.4 | Ensure permissions on /etc/motd are configured |
| 1.7.5 | Ensure permissions on /etc/issue are configured |
| 1.7.6 | Ensure permissions on /etc/issue.net are configured |
Section 2 — Services
| Rule ID | Title |
|---|---|
| 2.1.100 | Ensure chargen services are not enabled |
| 2.1.101 | Ensure daytime services are not enabled |
| 2.1.102 | Ensure discard services are not enabled |
| 2.1.103 | Ensure echo services are not enabled |
| 2.1.104 | Ensure time services are not enabled |
| 2.2.4 | Ensure telnet client is not installed |
| 2.2.16 | Ensure mail transfer agent is configured for local-only mode |
Section 3 — Network Configuration
| Rule ID | Title |
|---|---|
| 3.2.1 | Ensure packet redirect sending is disabled |
| 3.2.2 | Ensure IP forwarding is disabled |
| 3.3.1 | Ensure source routed packets are not accepted |
| 3.3.2 | Ensure ICMP redirects are not accepted |
| 3.3.3 | Ensure secure ICMP redirects are not accepted |
| 3.3.4 | Ensure suspicious packets are logged |
| 3.3.5 | Ensure broadcast ICMP requests are ignored |
| 3.3.6 | Ensure bogus ICMP responses are ignored |
| 3.3.7 | Ensure Reverse Path Filtering is enabled |
| 3.3.8 | Ensure TCP SYN Cookies is enabled |
| 3.4.2 | Ensure /etc/hosts.allow is configured |
| 3.4.100 | Ensure /etc/hosts.deny is configured |
| 3.4.101 | Ensure permissions on /etc/hosts.allow are configured |
| 3.4.102 | Ensure permissions on /etc/hosts.deny are 644 |
| 3.5.3.1.1 | Ensure iptables packages are installed |
| 3.5.3.2.1 | Ensure iptables default deny firewall policy |
| 3.5.3.3.1 | Ensure ip6tables default deny firewall policy |
| 3.5.100 | Ensure DCCP is disabled |
| 3.5.101 | Ensure SCTP is disabled |
| 3.5.102 | Ensure RDS is disabled |
| 3.5.103 | Ensure TIPC is disabled |
Section 4
| Rule ID | Title |
|---|---|
| 4.2.1.1 | Ensure rsyslog Service is enabled |
| 4.2.1.4 | Ensure rsyslog default file permissions configured |
| 4.2.3 | Ensure rsyslog is installed |
Section 5
| Rule ID | Title |
|---|---|
| 5.1.1 | Ensure cron daemon is enabled and running |
| 5.1.2 | Ensure permissions on /etc/crontab are configured |
| 5.1.3 | Ensure permissions on /etc/cron.hourly are configured |
| 5.1.4 | Ensure permissions on /etc/cron.daily are configured |
| 5.1.5 | Ensure permissions on /etc/cron.weekly are configured |
| 5.1.6 | Ensure permissions on /etc/cron.monthly are configured |
| 5.1.7 | Ensure permissions on /etc/cron.d are configured |
| 5.1.8 | Ensure cron is restricted to authorized users |
| 5.1.9 | Ensure at is restricted to authorized users |
| 5.2.100 | Ensure SSH KerberosAuthentication is enabled |
| 5.2.101 | Ensure SSH X11 forwarding is disabled |
| 5.3.1 | Ensure permissions on /etc/ssh/sshd_config are configured |
| 5.3.4 | Ensure SSH Protocol is set to 2 |
| 5.3.6 | Ensure SSH LogLevel is appropriate |
| 5.3.8 | Ensure SSH MaxAuthTries is set to 4 or less |
| 5.3.9 | Ensure SSH IgnoreRhosts is enabled |
| 5.3.10 | Ensure SSH HostbasedAuthentication is disabled |
| 5.3.11 | Ensure SSH root login is disabled |
| 5.3.12 | Ensure SSH PermitEmptyPasswords is disabled |
| 5.3.13 | Ensure SSH PermitUserEnvironment is disabled |
| 5.3.15 | Ensure only strong MAC algorithms are used |
| 5.3.17 | Ensure SSH Idle Timeout Interval is configured |
| 5.3.18 | Ensure SSH LoginGraceTime is set to one minute or less |
| 5.3.19 | Ensure SSH warning banner is configured |
| 5.4.1 | Ensure password creation requirements are configured |
| 5.4.3 | Ensure password reuse is limited |
| 5.4.4 | Ensure password hashing algorithm is SHA-512 |
| 5.5.1.1 | Ensure minimum days between password changes is configured |
| 5.5.1.2 | Ensure password expiration is 365 days or less |
| 5.5.1.3 | Ensure password expiration warning days is 7 or more |
| 5.5.1.4 | Ensure inactive password lock is 30 days or less |
| 5.5.3 | Ensure default group for the root account is GID 0 |
| 5.5.4 | Ensure default user umask is 027 or more restrictive |
| 5.5.100 | Fetch system account names |
| 5.5.101 | Ensure system accounts are non-login |
| 5.5.102 | Ensure default group for the root account is root |
| 5.6 | Ensure access to the su command is restricted |
Section 6
| Rule ID | Title |
|---|---|
| 6.2.12 | Ensure root PATH Integrity |
| 6.2.100 | Ensure no legacy '+' entries exist in /etc/passwd |
| 6.2.101 | Ensure no legacy '+' entries exist in /etc/shadow |
| 6.2.102 | Ensure no legacy '+' entries exist in /etc/group |