Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide (STIG) V2R1
Rules and Groups employed by this XCCDF Profile
-
Configure a Sufficiently Large Partition for Audit Logs
The Ubuntu 22.04 operating system must allocate audit record storage capacity to store at least one weeks worth of audit records when audit records...Rule Medium Severity -
Configure auditd Disk Full Action when Disk Space Is Full
The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...Rule Medium Severity -
Configure auditd mail_acct Action on Low Disk Space
The <code>auditd</code> service can be configured to send email to a designated account in certain situations. Add or correct the following line in...Rule Medium Severity -
Configure auditd space_left Action on Low Disk Space
The <code>auditd</code> service can be configured to take an action when disk space <i>starts</i> to run low. Edit the file <code>/etc/audit/auditd...Rule Medium Severity -
Configure auditd space_left on Low Disk Space
The <code>auditd</code> service can be configured to take an action when disk space is running low but prior to running out of space completely. Ed...Rule Medium Severity -
Offload audit Logs to External Media
The operating system must have a crontab script running weekly to offload audit events of standalone systems.Rule Medium Severity -
AppArmor
Many security vulnerabilities result from bugs in trusted programs. A trusted program runs with privileges that attackers want to possess. The prog...Group -
Ensure AppArmor is installed
AppArmor provide Mandatory Access Controls.Rule Medium Severity -
Ensure AppArmor is Active and Configured
Verify that the Apparmor tool is configured to control whitelisted applications and user home directory access control.<br> <br> The <code>...Rule Medium Severity -
GRUB2 bootloader configuration
During the boot process, the boot loader is responsible for starting the execution of the kernel and passing options to it. The boot loader allows ...Group -
Non-UEFI GRUB2 bootloader configuration
Non-UEFI GRUB2 bootloader configurationGroup -
Set Boot Loader Password in grub2
The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br> <br> Since plaint...Rule High Severity -
UEFI GRUB2 bootloader configuration
UEFI GRUB2 bootloader configurationGroup -
Set the UEFI Boot Loader Password
The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. <br> <br> Since plaint...Rule High Severity -
Configure Syslog
The syslog service has been the default Unix logging mechanism for many years. It has a number of downsides, including inconsistent log format, lac...Group -
Enable rsyslog Service
The <code>rsyslog</code> service provides syslog-style logging by default on Ubuntu 22.04. The <code>rsyslog</code> service can be enabled with th...Rule Medium Severity -
Ensure real-time clock is set to UTC
Ensure that the system real-time clock (RTC) is set to Coordinated Universal Time (UTC).Rule High Severity -
Ensure Proper Configuration of Log Files
The file <code>/etc/rsyslog.conf</code> controls where log message are written. These are controlled by lines called <i>rules</i>, which consist of...Group -
Ensure remote access methods are monitored in Rsyslog
Logging of remote access methods must be implemented to help identify cyber attacks and ensure ongoing compliance with remote access policies are b...Rule Medium Severity -
systemd-journald
systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging ...Group -
Network Configuration and Firewalls
Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses th...Group -
Kernel Parameters Which Affect Networking
The <code>sysctl</code> utility is used to set parameters which affect the operation of the Linux kernel. Kernel parameters which affect networking...Group -
Network Related Kernel Runtime Parameters for Hosts and Routers
Certain kernel parameters should be set for systems which are acting as either hosts or routers to improve the system's ability defend against cert...Group -
Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
To set the runtime status of the <code>net.ipv4.tcp_syncookies</code> kernel parameter, run the following command: <pre>$ sudo sysctl -w net.ipv4.t...Rule Medium Severity -
Uncomplicated Firewall (ufw)
The Linux kernel in Ubuntu provides a packet filtering system called netfilter, and the traditional interface for manipulating netfilter are the ip...Group -
Install ufw Package
Theufwpackage can be installed with the following command:$ apt-get install ufw
Rule Medium Severity -
Verify ufw Enabled
Theufwservice can be enabled with the following command:$ sudo systemctl enable ufw.service
Rule Medium Severity -
Wireless Networking
Wireless networking, such as 802.11 (WiFi) and Bluetooth, can present a security risk to sensitive or classified systems and networks. Wireless net...Group -
Disable Wireless Through Software Configuration
If it is impossible to remove the wireless hardware from the device in question, disable as much of it as possible through software. The following ...Group -
Deactivate Wireless Network Interfaces
Deactivating wireless network interfaces should prevent normal usage of the wireless capability. <br> <br> Verify that there are no wirel...Rule Medium Severity -
Transport Layer Security Support
Support for Transport Layer Security (TLS), and its predecessor, the Secure Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the Ope...Group -
Only Allow DoD PKI-established CAs
The operating system must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sess...Rule Medium Severity -
File Permissions and Masks
Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which t...Group -
Verify Permissions on Important Files and Directories
Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses impo...Group -
Verify that All World-Writable Directories Have Sticky Bits Set
When the so-called 'sticky bit' is set on a directory, only the owner of a given file may remove that file from the directory. Without the sticky b...Rule Medium Severity -
Verify Permissions on /etc/audit/auditd.conf
To properly set the permissions of/etc/audit/auditd.conf, run the command:$ sudo chmod 0640 /etc/audit/auditd.conf
Rule Medium Severity -
Verify Permissions on /etc/audit/rules.d/*.rules
To properly set the permissions of <code>/etc/audit/rules.d/*.rules</code>, run the command: <pre>$ sudo chmod 0640 /etc/audit/rules.d/*.rules</pr...Rule Medium Severity -
Verify permissions of log files
Any operating system providing too much information in error messages risks compromising the data and security of the structure, and content of err...Rule Medium Severity -
Verify Permissions on Files within /var/log Directory
The/var/logdirectory contains files with logs of error messages in the system and should only be accessed by authorized personnel.Group -
Verify Group Who Owns /var/log Directory
To properly set the group owner of/var/log, run the command:$ sudo chgrp syslog /var/log
Rule Medium Severity -
Verify Group Who Owns /var/log/syslog File
To properly set the group owner of/var/log/syslog, run the command:$ sudo chgrp adm /var/log/syslog
Rule Medium Severity -
Verify User Who Owns /var/log Directory
To properly set the owner of/var/log, run the command:$ sudo chown root /var/log
Rule Medium Severity -
Verify User Who Owns /var/log/syslog File
To properly set the owner of/var/log/syslog, run the command:$ sudo chown syslog /var/log/syslog
Rule Medium Severity -
Verify Permissions on /var/log Directory
To properly set the permissions of/var/log, run the command:$ sudo chmod 0755 /var/log
Rule Medium Severity -
Verify Permissions on /var/log/syslog File
To properly set the permissions of/var/log/syslog, run the command:$ sudo chmod 0640 /var/log/syslog
Rule Medium Severity -
Verify File Permissions Within Some Important Directories
Some directories contain files whose confidentiality or integrity is notably important and may also be susceptible to misconfiguration over time, p...Group -
Verify that Shared Library Directories Have Root Group Ownership
System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by ...Rule Medium Severity -
Verify that system commands directories are group owned by root
System commands files are stored in the following directories by default: <pre>/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin </pre> ...Rule Medium Severity -
Verify that System Executable Have Root Ownership
<pre>/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin</pre> All these directories should be owned by the <code>root</code> user. If any...Rule Medium Severity -
Verify that Shared Library Directories Have Root Ownership
System-wide shared library files, which are linked to executables during process load time or run time, are stored in the following directories by ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.