CIS Ubuntu 22.04 Level 1 Server Benchmark
Rules and Groups employed by this XCCDF Profile
-
Non-UEFI GRUB2 bootloader configuration
Non-UEFI GRUB2 bootloader configurationGroup -
Verify /boot/grub/grub.cfg User Ownership
The file <code>/boot/grub/grub.cfg</code> should be owned by the <code>root</code> user to prevent destruction or modification of the file. To pro...Rule Medium Severity -
Verify /boot/grub/grub.cfg Permissions
File permissions for <code>/boot/grub/grub.cfg</code> should be set to 600. To properly set the permissions of <code>/boot/grub/grub.cfg</code>, r...Rule Medium Severity -
Set Boot Loader Password in grub2
The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br><br> Since plaintext passw...Rule High Severity -
UEFI GRUB2 bootloader configuration
UEFI GRUB2 bootloader configurationGroup -
Set the UEFI Boot Loader Password
The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br><br> Since plaintext passw...Rule High Severity -
Configure Syslog
The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...Group -
Ensure rsyslog is Installed
Rsyslog is installed by default. Thersyslogpackage can be installed with the following command:$ apt-get install rsyslog
Rule Medium Severity -
Enable rsyslog Service
The <code>rsyslog</code> service provides syslog-style logging by default on Ubuntu 22.04. The <code>rsyslog</code> service can be enabled with th...Rule Medium Severity -
Ensure rsyslog Default File Permissions Configured
rsyslog will create logfiles that do not already exist on the system. This settings controls what permissions will be applied to these newly create...Rule Medium Severity -
systemd-journald
systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging ...Group -
Install systemd-journal-remote Package
Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote h...Rule Medium Severity -
Enable systemd-journald Service
The <code>systemd-journald</code> service is an essential component of systemd. The <code>systemd-journald</code> service can be enabled with the ...Rule Medium Severity -
Ensure journald is configured to compress large log files
The journald system can compress large log files to avoid fill the system disk.Rule Medium Severity -
Ensure journald is configured to write log files to persistent disk
The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will we lost upo...Rule Medium Severity -
Disable systemd-journal-remote Socket
Journald supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts....Rule Medium Severity -
Configure rsyslogd to Accept Remote Messages If Acting as a Log Server
By default, <code>rsyslog</code> does not listen over the network for log messages. If needed, modules can be enabled to allow the rsyslog daemon t...Group -
Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
The <code>rsyslog</code> daemon should not accept remote messages unless the system acts as a log server. To ensure that it is not listening on the...Rule Medium Severity -
Rsyslog Logs Sent To Remote Host
If system logs are to be useful in detecting malicious activities, it is necessary to send logs to a remote server. An intruder who has compromised...Group -
Ensure Logs Sent To Remote Host
To configure rsyslog to send logs to a remote log server, open <code>/etc/rsyslog.conf</code> and read and understand the last section of the file,...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.