CIS Ubuntu 20.04 Level 2 Workstation Benchmark
Rules and Groups employed by this XCCDF Profile
-
Record Information on Kernel Modules Loading and Unloading
To capture kernel module loading and unloading events, use following lines, setting ARCH to either b32 for 32-bit system, or having two lines for b...Group -
Ensure auditd Collects Information on Kernel Module Unloading - delete_module
To capture kernel module unloading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b...Rule Medium Severity -
Ensure auditd Collects Information on Kernel Module Loading - init_module
To capture kernel module loading events, use following line, setting ARCH to either b32 for 32-bit system, or having two lines for both b32 and b64...Rule Medium Severity -
Record Attempts to Alter Logon and Logout Events
The audit system already collects login information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...Group -
Record Attempts to Alter Logon and Logout Events - faillog
The audit system already collects login information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...Rule Medium Severity -
Record Attempts to Alter Logon and Logout Events - lastlog
The audit system already collects login information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...Rule Medium Severity -
Record Attempts to Alter Logon and Logout Events - tallylog
The audit system already collects login information for all users and root. If the <code>auditd</code> daemon is configured to use the <code>augenr...Rule Medium Severity -
Record Information on the Use of Privileged Commands
At a minimum, the audit system should collect the execution of privileged commands for all users and root.Group -
Ensure auditd Collects Information on the Use of Privileged Commands - at
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - chage
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - chfn
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - chsh
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - crontab
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - insmod
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - modprobe
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - mount
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity -
Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap
At a minimum, the audit system should collect the execution of privileged commands for all users and root. If the <code>auditd</code> daemon is con...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.