Skip to content
Log In

Guide to the Secure Configuration of Ubuntu 22.04

Rules, Groups, and Values defined within the XCCDF Benchmark

  • net.ipv4.conf.default.log_martians

    Disable so you don't Log Spoofed Packets, Source Routed Packets, Redirect Packets
    Value
    Show

  • net.ipv4.conf.default.rp_filter

    Enables source route verification
    Value
    Show

  • net.ipv4.conf.default.secure_redirects

    Enable to prevent hijacking of routing path by only allowing redirects from gateways known in routing table. Disable to refuse acceptance of secure ICMP redirected packages by default.
    Value
    Show

  • net.ipv4.conf.default.shared_media

    Controls whether the system can send(router) or accept(host) RFC1620 shared media redirects. <code>shared_media</code> for the interface will be enabled if at least one of conf/{all,interface}/shar...
    Value
    Show

  • net.ipv4.icmp_echo_ignore_broadcasts

    Ignore all ICMP ECHO and TIMESTAMP requests sent to it via broadcast/multicast
    Value
    Show

  • net.ipv4.icmp_ignore_bogus_error_responses

    Enable to prevent unnecessary logging
    Value
    Show

  • net.ipv4.tcp_syncookies

    Enable to turn on TCP SYN Cookie Protection
    Value
    Show

  • Configure ARP filtering for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.arp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.arp_filter=<xccdf-1.2:sub idref="xccd...
    Rule Medium Severity
    Show

  • Configure Response Mode of ARP Requests for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.arp_ignore</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.arp_ignore=<xccdf-1.2:sub idref="xccd...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.log_martians=1</pre> To make sure t...
    Rule Unknown Severity
    Show

  • Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.route_localnet</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.route_localnet=0</pre> To make su...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.rp_filter=1</pre> To make sure that th...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0</pre> To mak...
    Rule Medium Severity
    Show

  • Verify Group Who Owns gshadow File

    To properly set the group owner of /etc/gshadow, run the command: 
    $ sudo chgrp shadow /etc/gshadow
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0</pre...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.accept_source_route=...
    Rule Medium Severity
    Show

  • Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.log_martians=1</pre> To mak...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.rp_filter=1</pre> To make sure...
    Rule Medium Severity
    Show

  • Configure Kernel Parameter for Accepting Secure Redirects By Default

    To set the runtime status of the <code>net.ipv4.conf.default.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0</pre...
    Rule Medium Severity
    Show

  • Configure Sending and Accepting Shared Media Redirects by Default

    To set the runtime status of the <code>net.ipv4.conf.default.shared_media</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.default.shared_media=<xccdf-1.2:sub...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.icmp_echo_ignore_broadcasts</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1</pre> To...
    Rule Medium Severity
    Show

  • Network Parameters for Hosts Only

    If the system is not going to be used as a router, then setting certain kernel parameters ensure that the host will not perform routing of network traffic.
    Group
    Show

  • Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.conf.all.send_redirects=0</pre> To make su...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.ip_forward</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.ip_forward=0</pre> To make sure that the setting is per...
    Rule Medium Severity
    Show

  • nftables

    <code>If firewalld or iptables are being used in your environment, please follow the guidance in their respective section and pass-over the guidance in this section.</code><br><br> nftables is a su...
    Group
    Show

  • Nftables Base Chain Hooks

    The possible hooks which can be used to configure the base chain are: <code>ingress</code> (only in netdev family since Linux kernel 4.2, and inet family since Linux kernel 5.10): sees packets imm...
    Value
    Show

  • Nftables Chain Names

    The rules in nftables are attached to chains. Unlike in iptables, there are no predefined chains like INPUT, OUTPUT, etc. Instead, to filter packets at a particular processing step, a base chain ...
    Value
    Show

  • Nftables Base Chain Policies

    This is the default verdict that will be applied to packets reaching the end of the chain (i.e, no more rules to be evaluated against). Currently there are 2 policies: <code>accept</code> this ve...
    Value
    Show

  • Nftables Base Chain Priorities

    Each nftables base chain is assigned a priority that defines its ordering among other base chains, flowtables, and Netfilter internal operations at the same hook. For example, a chain on the prer...
    Value
    Show

  • Nftables Base Chain Types

    Base chains are those that are registered into the Netfilter hooks, i.e. these chains see packets flowing through the Linux TCP/IP stack. The possible chain types are: <code>filter</code>, which i...
    Value
    Show

  • Nftables Families

    Netfilter enables filtering at multiple networking levels. With iptables there is a separate tool for each level: iptables, ip6tables, arptables, ebtables. With nftables the multiple networking l...
    Value
    Show

  • Nftables Master configuration file

    The file which contains top level configuration for nftables service, and with which, the service is started.
    Value
    Show

  • Nftables Tables

    Tables in nftables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of six families.
    Value
    Show

  • Uninstall nftables package

    nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The <code>nftables</code> package can be rem...
    Rule Medium Severity
    Show

  • Verify nftables Service is Enabled

    The nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service The <code>nftables</code> service can be enabled with the following command: <pre>...
    Rule Medium Severity
    Show

  • Verify nftables Service is Disabled

    nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames and is the successor to iptables. The <code>nftables</code> service can be dis...
    Rule Medium Severity
    Show

  • Ensure nftables Rules are Permanent

    nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. The nftables service reads the <xccdf-1.2:sub xmlns:xccdf-1.2="http://checkli...
    Rule Medium Severity
    Show

  • Ensure Base Chains Exist for Nftables

    Tables in nftables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of six families. Chains are containers for rules. They exist i...
    Rule Medium Severity
    Show

  • Set nftables Configuration for Loopback Traffic

    Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.
    Rule Medium Severity
    Show

  • Uncomplicated Firewall (ufw)

    The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the iptables suite of commands. iptables provide a compl...
    Group
    Show

  • Install ufw Package

    The ufw package can be installed with the following command: 
    $ apt-get install ufw
    Rule Medium Severity
    Show

  • Remove ufw Package

    The ufw package can be removed with the following command: 
    $ apt-get remove ufw
    Rule Medium Severity
    Show

  • Verify ufw Enabled

    The ufw service can be enabled with the following command: 
    $ sudo systemctl enable ufw.service
    Rule Medium Severity
    Show

  • Ensure ufw Default Deny Firewall Policy

    A default deny policy on connections ensures that any unconfigured network usage will be rejected. Note: Any port or protocol without a explicit allow before the default deny will be blocked.
    Rule Medium Severity
    Show

  • Set UFW Loopback Traffic

    Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.
    Rule Medium Severity
    Show

  • Ensure ufw Firewall Rules Exist for All Open Ports

    Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.
    Rule Medium Severity
    Show

  • Uncommon Network Protocols

    The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code are not frequently discovered, the consequences ca...
    Group
    Show

  • Disable RDS Support

    The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications between nodes in a cluster. To configure the syst...
    Rule Low Severity
    Show

  • Disable SCTP Support

    The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with several streams of messages within one connection...
    Rule Medium Severity
    Show

  • Disable TIPC Support

    The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the system to prevent the <code>tipc</code> kernel module...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules