Skip to content
ATO Pathways
  Log In

CIS Ubuntu 22.04 Level 2 Workstation Benchmark

Rules and Groups employed by this XCCDF Profile

  • Configure IPv6 Settings if Necessary

    A major feature of IPv6 is the extent to which systems implementing it can automatically configure their networking devices using information from ...
    Group
    Show

  • Configure Accepting Router Advertisements on All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_ra</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ip...
    Rule Medium Severity
    Show

  • Disable Accepting ICMP Redirects for All IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for IPv6 Forwarding

    To set the runtime status of the <code>net.ipv6.conf.all.forwarding</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.i...
    Rule Medium Severity
    Show

  • Disable Accepting Router Advertisements on all IPv6 Interfaces by Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_ra</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces

    To set the runtime status of the <code>net.ipv6.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default

    To set the runtime status of the <code>net.ipv6.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...
    Rule Medium Severity
    Show

  • Kernel Parameters Which Affect Networking

    The <code>sysctl</code> utility is used to set parameters which affect the operation of the Linux kernel. Kernel parameters which affect networking...
    Group
    Show

  • Network Related Kernel Runtime Parameters for Hosts and Routers

    Certain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against cert...
    Group
    Show

  • Disable Accepting ICMP Redirects for All IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sysctl...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ip...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.default.accept_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.accept_source_route</code> kernel parameter, run the following command: <pre>$ sudo sy...
    Rule Medium Severity
    Show

  • Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.log_martians</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.rp_filter</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w ne...
    Rule Medium Severity
    Show

  • Configure Kernel Parameter for Accepting Secure Redirects By Default

    To set the runtime status of the <code>net.ipv4.conf.default.secure_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysct...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.icmp_echo_ignore_broadcasts</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...
    Rule Medium Severity
    Show

  • Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.icmp_ignore_bogus_error_responses</code> kernel parameter, run the following command: <pre>$ sudo s...
    Rule Unknown Severity
    Show

  • Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces

    To set the runtime status of the <code>net.ipv4.tcp_syncookies</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.t...
    Rule Medium Severity
    Show

  • Network Parameters for Hosts Only

    If the system is not going to be used as a router, then setting certain kernel parameters ensure that the host will not perform routing of network ...
    Group
    Show

  • Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.conf.all.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w n...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default

    To set the runtime status of the <code>net.ipv4.conf.default.send_redirects</code> kernel parameter, run the following command: <pre>$ sudo sysctl ...
    Rule Medium Severity
    Show

  • Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces

    To set the runtime status of the <code>net.ipv4.ip_forward</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.ip_fo...
    Rule Medium Severity
    Show

  • nftables

    <code>If firewalld or iptables are being used in your environment, please follow the guidance in their respective section and pass-over the guidanc...
    Group
    Show

  • Install nftables Package

    nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace ...
    Rule Medium Severity
    Show

  • Verify nftables Service is Enabled

    The nftables service allows for the loading of nftables rulesets during boot, or starting on the nftables service The <code>nftables</code> servic...
    Rule Medium Severity
    Show

  • Ensure nftables Default Deny Firewall Policy

    Base chain policy is the default verdict that will be applied to packets reaching the end of the chain. There are two policies: accept (Default) an...
    Rule Medium Severity
    Show

  • Ensure nftables Rules are Permanent

    nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. The nftables service reads ...
    Rule Medium Severity
    Show

  • Ensure Base Chains Exist for Nftables

    Tables in nftables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of six famil...
    Rule Medium Severity
    Show

  • Set nftables Configuration for Loopback Traffic

    Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.
    Rule Medium Severity
    Show

  • Ensure a Table Exists for Nftables

    Tables in nftables hold chains. Each table only has one address family and only applies to packets of this family. Tables can have one of six famil...
    Rule Medium Severity
    Show

  • Uncomplicated Firewall (ufw)

    The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the ip...
    Group
    Show

  • Remove ufw Package

    The ufw package can be removed with the following command: 
    $ apt-get remove ufw
    Rule Medium Severity
    Show

  • Verify ufw Enabled

    The ufw service can be enabled with the following command: 
    $ sudo systemctl enable ufw.service
    Rule Medium Severity
    Show

  • Ensure ufw Default Deny Firewall Policy

    A default deny policy on connections ensures that any unconfigured network usage will be rejected. Note: Any port or protocol without a explicit a...
    Rule Medium Severity
    Show

  • Set UFW Loopback Traffic

    Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network.
    Rule Medium Severity
    Show

  • Ensure ufw Firewall Rules Exist for All Open Ports

    Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.
    Rule Medium Severity
    Show

  • Uncommon Network Protocols

    The system includes support for several network protocols which are not commonly used. Although security vulnerabilities in kernel networking code ...
    Group
    Show

  • Disable DCCP Support

    The Datagram Congestion Control Protocol (DCCP) is a relatively new transport layer protocol, designed to support streaming media and telephony. T...
    Rule Medium Severity
    Show

  • Disable RDS Support

    The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide reliable high-bandwidth, low-latency communications ...
    Rule Low Severity
    Show

  • Disable SCTP Support

    The Stream Control Transmission Protocol (SCTP) is a transport layer protocol, designed to support the idea of message-oriented communication, with...
    Rule Medium Severity
    Show

  • Disable TIPC Support

    The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communications between nodes in a cluster. To configure the sys...
    Rule Low Severity
    Show

  • Wireless Networking

    Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless net...
    Group
    Show

  • Disable Wireless Through Software Configuration

    If it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following ...
    Group
    Show

  • Deactivate Wireless Network Interfaces

    Deactivating wireless network interfaces should prevent normal usage of the wireless capability. <br><br> Configure the system to disable all wire...
    Rule Medium Severity
    Show

  • File Permissions and Masks

    Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which t...
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules