Operating systems · UBU · v0.1.0 · draft
Ubuntu
Secure configuration baseline for Ubuntu LTS systems, servers and desktops. Version-specific differences are handled per control with applicability.versions.
Release v0.1.0 (beta), tag ubuntu/v0.1.0: the active and deprecated controls it shipped. A beta published for testing: it may still change before a final release. Current state.
01
Controls
| ID | Control | Severity | Assessment | Profiles |
|---|---|---|---|---|
CB-UBU-AUDIT-001 | Keep the systemd journal running, persistent, compressed and bounded in sizeSystem logs may be lost at reboot or fill the disk | medium | automatedautomated fix | core |
CB-UBU-AUDIT-002 | Forward the journal to rsyslog only when rsyslog is the chosen loggerThe journal forwarding setting does not match the logging system in use | low | automatedautomated fix | core |
CB-UBU-AUDIT-003 | Do not accept logs from other hostsThe system listens for log messages from the network | medium | automatedautomated fix | core |
CB-UBU-AUDIT-004 | Restrict access to log filesLog files are readable or writable by too many users | medium | automatedautomated fix | core |
CB-UBU-AUDIT-005 | Run rsyslog and create its log files with restricted permissionsrsyslog is installed but does not run, or writes logs readable by everyone | low | automatedautomated fix | core |
CB-UBU-AUDIT-006 | Review which messages rsyslog writes and whereThe rsyslog rules have not been reviewed against the site logging needs | low | manual | core |
CB-UBU-AUDIT-007 | Rotate log files with logrotateText log files are never rotated | low | automatedautomated fix | core |
CB-UBU-AUDIT-008 | Send system logs to a remote log serverSystem logs are only stored on the system that produced them | medium | manual | core |
CB-UBU-AUDIT-009 | Encrypt and authenticate the rsyslog connection to the log serverLogs are sent to the log server without TLS | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-010 | Give each exposed service its own activity logService activity is mixed into general logs or not logged at all | low | manual | server-hardened |
CB-UBU-AUDIT-011 | Install and run the audit daemonThe kernel audit records are not collected | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-012 | Enable auditing from boot with a large enough backlogProcesses started before auditd are not audited | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-013 | Keep audit logs instead of rotating them awayOld audit logs are deleted automatically | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-014 | Decide and configure what happens when the audit disk fills upThe system keeps running without recording audit events when the audit log space runs out | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-015 | Send audit records to a remote serverAudit records are only stored on the audited system | medium | automated | server-hardened |
CB-UBU-AUDIT-016 | Audit changes to sudo rights and commands run as another userChanges to administrator rights and use of other identities are not recorded | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-017 | Audit changes to the system clock and time zoneChanges to the system time are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-018 | Audit changes to the host name and network configurationChanges to the host identity and network settings are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-019 | Audit changes to accounts, groups and authentication settingsChanges to accounts and authentication settings are not recorded | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-020 | Audit changes to file permissions, owners and extended attributesChanges to file permissions and ownership are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-021 | Audit denied attempts to open or truncate filesFailed attempts to access files are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-022 | Audit file system mounts and unmounts by usersFile system mounts by users are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-023 | Audit file deletions and renames by usersFile deletions and renames by users are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-024 | Audit changes to the AppArmor configurationChanges to the mandatory access control policy are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-025 | Audit kernel module loading and unloadingKernel modules can be loaded or removed without a record | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-026 | Audit every use of setuid and setgid programsUse of privileged programs is not recorded | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-027 | Audit login records and session filesTampering with login records is not detected | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-028 | Audit changes to scheduled tasks and to the systemd journalChanges to scheduled tasks and journal files are not recorded | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-029 | Lock the audit configuration and load every valid ruleThe audit rules can be changed or disabled on the running system | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-030 | Restrict access to the audit logsAudit logs can be read or changed by users other than root | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-031 | Restrict access to the audit configuration and toolsAudit configuration or tools can be changed by users other than root | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-032 | Install the AIDE file integrity checkerNo file integrity checker is installed | medium | automatedautomated fix | core |
CB-UBU-AUDIT-033 | Check the integrity of the audit tools with AIDEA modified audit tool would not be detected | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUDIT-034 | Build the AIDE database and check file integrity every dayFile integrity is never checked | medium | automatedautomated fix | core |
CB-UBU-AUDIT-035 | Keep a protected copy of the AIDE databaseThe AIDE reference database is only stored on the system it protects | medium | manual | server-hardened, desktop-hardened |
CB-UBU-AUDIT-036 | Audit administrative commands that are not setuidUse of administrative commands is not recorded | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUTH-001 | Show a legal warning before login, without system detailsThe login prompt shows the operating system version and no legal warning | low | automatedautomated fix | core |
CB-UBU-AUTH-002 | Keep system details out of the message of the dayThe message of the day shows the operating system version and kernel release to every user who logs in | low | automatedautomated fix | core |
CB-UBU-AUTH-003 | Protect the login banner files from modificationLogin banner files can be changed by non-root users | low | automatedautomated fix | core |
CB-UBU-AUTH-004 | Install sudo for administrative accesssudo is not installed | medium | automatedautomated fix | core |
CB-UBU-AUTH-005 | Configure sudo to use a pseudo-terminal, a log file and a short credential cachesudo defaults allow terminal hijacking, keep no local log or cache credentials too long | medium | automatedautomated fix | core |
CB-UBU-AUTH-006 | Require a password for every sudo ruleSome sudo rules run commands without asking for a password | high | automated | server-hardened, desktop-hardened |
CB-UBU-AUTH-007 | Never disable authentication for sudo globallysudo is configured to skip authentication | high | automated | core |
CB-UBU-AUTH-008 | Restrict the su command to an empty groupAny user who knows a target password can switch user with su | medium | automatedautomated fix | core |
CB-UBU-AUTH-009 | Write sudo rules with least privilegesudo rules give broader rights than the tasks need | medium | manual | core |
CB-UBU-AUTH-010 | Enforce password quality with pam_pwqualityUsers can set short or trivial passwords | medium | automatedautomated fix | core |
CB-UBU-AUTH-011 | Lock accounts after repeated failed loginsPasswords can be guessed without limit | medium | automatedautomated fix | core |
CB-UBU-AUTH-012 | Prevent reuse of recent passwordsUsers can set a password they used before | low | automatedautomated fix | core |
CB-UBU-AUTH-013 | Refuse empty passwords and hash passwords with a strong algorithm in pam_unixpam_unix accepts accounts with an empty password | high | automatedautomated fix | core |
CB-UBU-AUTH-014 | Set password aging and hashing defaults for new accountsNew accounts get passwords that never expire and are never disabled when unused | low | automatedautomated fix | core |
CB-UBU-AUTH-015 | Apply the password aging policy to existing accountsExisting accounts keep passwords that never expire | low | automatedautomated fix | core |
CB-UBU-AUTH-016 | Keep root the only superuser account and protect its passwordAnother account has superuser identity, or root has no password protection | high | automated | core |
CB-UBU-AUTH-017 | Keep the root PATH free of relative and writable directoriesThe root login PATH contains a relative or writable directory | medium | automated | core |
CB-UBU-AUTH-018 | Prevent interactive logins to system accountsA system account has a login shell or an unlocked password | medium | automatedautomated fix | core |
CB-UBU-AUTH-019 | Set a restrictive default umask for login sessionsNew files are readable by every local user by default | low | automatedautomated fix | core |
CB-UBU-AUTH-020 | Close idle shell sessions automaticallyIdle shell sessions stay open forever | low | automatedautomated fix | core |
CB-UBU-AUTH-021 | Do not list nologin as a valid shellnologin is declared as a valid login shell | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-AUTH-022 | Disable reboot with Ctrl-Alt-Del on the consoleAnyone at the console can reboot the system with Ctrl-Alt-Del | low | automatedautomated fix | server-hardened |
CB-UBU-AUTH-023 | Disable accounts that are no longer usedAccounts of people or services that left are still active | medium | manual | core |
CB-UBU-AUTH-024 | Give each service its own dedicated accountSeveral services share one account, or run as a person's account | medium | manual | core |
CB-UBU-AUTH-025 | Replace default secrets right after installationSecrets set by the installer, an image or a vendor are still in use | high | manual | server-hardened, desktop-hardened |
CB-UBU-AUTH-026 | Store every password hash in shadow and leave no account without a passwordAn account has its password hash in /etc/passwd, or an empty password | high | automatedautomated fix | core |
CB-UBU-AUTH-027 | Keep the user and group databases consistentUser and group files contain duplicates or dangling references | medium | automated | core |
CB-UBU-AUTH-028 | Keep the shadow group emptyUsers are members of the shadow group | high | automatedautomated fix | core |
CB-UBU-AUTH-029 | Keep user home directories and dot files privateUser home directories or startup files are readable or writable by others | medium | automatedautomated fix | core |
CB-UBU-AUTH-030 | Turn off MOTD content fetched from the network (motd-news, update-notifier)The system contacts Canonical servers to build the message of the day | low | automatedautomated fix | core |
CB-UBU-BOOT-001 | Enable full address space layout randomizationMemory layout of processes is predictable | medium | automatedautomated fix | core |
CB-UBU-BOOT-002 | Hide kernel addresses from usersKernel memory addresses are exposed through /proc and other interfaces | medium | automatedautomated fix | core |
CB-UBU-BOOT-003 | Restrict the kernel log buffer to privileged usersUnprivileged users can read the kernel log buffer | low | automatedautomated fix | core |
CB-UBU-BOOT-004 | Restrict ptrace to descendant processesAny process can trace and read the memory of other processes of the same user | medium | automatedautomated fix | core |
CB-UBU-BOOT-005 | Disable core dumps of setuid programsPrivileged programs can write their memory to core dump files | medium | automatedautomated fix | core |
CB-UBU-BOOT-006 | Protect symbolic links in world-writable sticky directoriesSymbolic links in shared temporary directories are followed for any user | medium | automatedautomated fix | core |
CB-UBU-BOOT-007 | Protect hard links to files the user does not ownUsers can create hard links to files they do not own | medium | automatedautomated fix | core |
CB-UBU-BOOT-008 | Install and enable AppArmorAppArmor mandatory access control is not active | medium | automatedautomated fix | core |
CB-UBU-BOOT-009 | Stop unconfined unprivileged processes from switching AppArmor profilesUnprivileged unconfined processes can move to a more permissive AppArmor profile | low | automatedautomated fix | core |
CB-UBU-BOOT-010 | Keep no AppArmor profile in complain modeSome AppArmor profiles only log violations instead of blocking them | medium | automated | server-hardened, desktop-hardened |
CB-UBU-BOOT-011 | Protect the boot loader configuration with a passwordAnyone at the console can edit the boot entries | medium | automated | core |
CB-UBU-BOOT-012 | Restrict access to the boot loader configurationUsers can read the boot loader configuration | low | automatedautomated fix | core |
CB-UBU-BOOT-013 | Disable core dumpsCrashing programs can write their memory to disk | low | automatedautomated fix | core |
CB-UBU-BOOT-014 | Remove prelinkprelink is installed | low | automatedautomated fix | core |
CB-UBU-BOOT-015 | Disable automatic crash reporting (apport, whoopsie)Crashes are collected automatically and can be sent outside the organization | medium | automatedautomated fix | core |
CB-UBU-BOOT-016 | Restrict unprivileged user namespaces with AppArmorAny local program can create unprivileged user namespaces | medium | automatedautomated fix | core |
CB-UBU-BOOT-017 | Protect FIFOs and regular files in world-writable sticky directoriesPrograms can be tricked into opening FIFOs or files planted by other users in /tmp | low | automatedautomated fix | core |
CB-UBU-DESK-001 | Disable automatic mounting of removable media in GNOMEGNOME mounts and opens removable media as soon as they are plugged in | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-DESK-002 | Show a warning banner and hide the user list on the GDM login screenThe GDM login screen lists local accounts and shows no warning | medium | automatedautomated fix | desktop |
CB-UBU-DESK-003 | Lock GNOME sessions after a short inactivity delayUsers can extend or disable the GNOME inactivity lock | medium | automatedautomated fix | desktop |
CB-UBU-DESK-004 | Never run software automatically from inserted media in GNOMEGNOME can start programs from inserted media | medium | automatedautomated fix | desktop |
CB-UBU-DESK-005 | Disable XDMCP in the display managerThe display manager accepts XDMCP remote logins | high | automatedautomated fix | desktop |
CB-UBU-DESK-006 | Require a password at the graphical login, without automatic login or guest sessionThe display manager opens a session without a password | high | automatedautomated fix | desktop |
CB-UBU-DESK-007 | Refuse root logins at the graphical login screenroot can open a graphical session | medium | automatedautomated fix | desktop |
CB-UBU-DESK-008 | Lock idle sessions outside GNOME, through logind and the KDE screen lockerIdle sessions of desktops other than GNOME may never lock | medium | automatedautomated fix | desktop |
CB-UBU-DESK-009 | Lock the session when the screen saver starts and when the system suspendsUsers can turn off the screen lock, including on suspend and lid close | medium | automatedautomated fix | desktop |
CB-UBU-DESK-010 | Decide whether to turn off Wayland sessions in GDM (recommended - skip)GDM starts Wayland sessions, which run X11 programs through Xwayland | low | manual | server-hardened, desktop-hardened |
CB-UBU-DESK-011 | Remove the Ctrl-Alt-Del shortcut from GNOMECtrl-Alt-Del in GNOME opens the power-off and restart dialog | low | automatedautomated fix | desktop-hardened |
CB-UBU-DESK-012 | Allow only known USB devices with USBGuardAny USB device plugged into the machine is accepted | medium | automatedautomated fix | desktop-hardened |
CB-UBU-FS-001 | Block kernel modules for filesystems the system does not useThe kernel can load modules for rarely used filesystems | low | automatedautomated fix | core |
CB-UBU-FS-002 | Block USB mass storage and FireWire kernel modulesUSB storage devices and FireWire can be used on the system | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-FS-003 | Mount /tmp as a separate filesystem with nodev, nosuid and noexecPrograms can be run, or device files and setuid programs used, from /tmp | medium | automatedautomated fix | core |
CB-UBU-FS-004 | Mount /dev/shm with nodev, nosuid and noexecPrograms can be run from the shared memory filesystem | medium | automatedautomated fix | core |
CB-UBU-FS-005 | Put /home, /var, /var/tmp, /var/log and /var/log/audit on separate filesystemsUser data, variable data and logs share the root filesystem | low | automated | server-hardened, desktop-hardened |
CB-UBU-FS-006 | Mount separate filesystems with nodev, nosuid and noexec where they are not neededSeparate filesystems are mounted without restrictive options | low | automated | core |
CB-UBU-FS-007 | Protect the user, group and password database filesThe account database files have weak ownership or permissions | high | automatedautomated fix | core |
CB-UBU-FS-008 | Leave no world-writable file, and set the sticky bit on world-writable directoriesFiles can be changed by any user, or shared directories let users delete each other's files | medium | automatedautomated fix | core |
CB-UBU-FS-009 | Leave no file without a known owner or groupSome files belong to a user or group that does not exist | low | automated | core |
CB-UBU-FS-010 | Review setuid and setgid programs and keep only those that are neededUnexpected setuid or setgid programs are present | medium | partial | core |
CB-UBU-FS-011 | Keep system programs and libraries owned by root and not writable by othersSystem programs or libraries can be changed by a non-root account | high | automated | core |
CB-UBU-FS-012 | Encrypt the disks holding the system and dataFile systems or swap are stored unencrypted on disk | medium | automated | desktop-hardened |
CB-UBU-NET-001 | Decide whether IPv6 is used, and disable or secure it accordinglyIPv6 is active without a decision to use it | low | manual | core |
CB-UBU-NET-002 | Prevent loading of unused network protocol modulesRarely used network protocol modules can be loaded on demand | medium | automatedautomated fix | core |
CB-UBU-NET-003 | Disable wireless network interfaces on serversA wireless network interface is available on a server | medium | automated | server |
CB-UBU-NET-004 | Disable the Bluetooth serviceThe Bluetooth service can be started | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-NET-005 | Run exactly one host firewallNo host firewall is active, or several firewall tools compete for the same rules | high | automatedautomated fix | core |
CB-UBU-NET-006 | Drop incoming and forwarded traffic by default, with SSH allowedThe host firewall accepts incoming or forwarded traffic that no rule allows | high | automatedautomated fix | core |
CB-UBU-NET-007 | Drop outgoing traffic by defaultThe host firewall lets the system open any outgoing connection | medium | automated | server-hardened, desktop-hardened |
CB-UBU-NET-008 | Restrict access to firewall and IPsec configuration filesFirewall or IPsec configuration files can be changed or read by non-root users | medium | automatedautomated fix | core |
CB-UBU-NET-009 | Disable IP forwarding unless the system is a routerThe system forwards packets between networks | medium | automatedautomated fix | core |
CB-UBU-NET-010 | Ignore ICMP redirects and source-routed packets, and send no redirectsThe kernel accepts route changes or routing instructions from the network | medium | automatedautomated fix | core |
CB-UBU-NET-011 | Drop and log packets with spoofed source addressesThe kernel accepts packets whose source address cannot be genuine, without logging them | medium | automatedautomated fix | core |
CB-UBU-NET-012 | Harden ICMP and TCP handling against floods and bogus packetsThe kernel ICMP and TCP settings leave the system open to simple floods and protocol abuse | low | automatedautomated fix | core |
CB-UBU-NET-013 | Restrict ARP answers and ignore gratuitous ARPThe kernel answers and accepts ARP messages beyond what the local network needs | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-NET-014 | Ignore IPv6 router advertisementsThe kernel configures IPv6 addresses and routes from any router advertisement | medium | automatedautomated fix | core |
CB-UBU-NET-015 | Use only strong ciphers, MACs and key exchange algorithms in the SSH serverThe SSH server accepts weak or outdated cryptographic algorithms | medium | automatedautomated fix | core |
CB-UBU-NET-016 | Restrict SSH authentication to named accounts with strong methodsThe SSH server allows root logins, weak authentication methods or unlimited guessing | high | automatedautomated fix | core |
CB-UBU-NET-017 | Limit SSH connections and close dead sessionsThe SSH server keeps dead sessions open and accepts many concurrent unauthenticated connections | low | automatedautomated fix | core |
CB-UBU-NET-018 | Disable SSH forwardingSSH sessions can forward ports, sockets, X11 and the SSH agent | medium | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-NET-019 | Log SSH logins with enough detailThe SSH server logs too little to trace logins | low | automatedautomated fix | core |
CB-UBU-NET-020 | Show the legal warning banner before SSH authenticationThe SSH server shows no warning before authentication | low | automatedautomated fix | core |
CB-UBU-NET-021 | Limit SSH logins to the users and groups that need themEvery account with a valid credential can log in over SSH | medium | manual | core |
CB-UBU-NET-022 | Protect the SSH server configuration and host keysSSH server configuration or host keys can be read or changed by non-root users | high | automatedautomated fix | core |
CB-UBU-NET-023 | Restrict access to netplan configuration filesNetplan configuration files can be read or changed by non-root users | medium | automatedautomated fix | core |
CB-UBU-PKG-001 | Bind every APT repository to its signing keyAPT repositories are not bound to a signing key or bypass signature checks | high | automatedautomated fix | core |
CB-UBU-PKG-002 | Download packages over HTTPSAPT downloads from repositories over an unencrypted protocol | low | automatedautomated fix | core |
CB-UBU-PKG-003 | Keep APT signature, freshness and TLS checks enabledAPT is configured to accept unsigned, weakly signed, outdated or unverified repositories | high | automatedautomated fix | core |
CB-UBU-PKG-004 | Restrict write access to APT keys and repository listsNon-root users can change the APT keys or repository lists | medium | automatedautomated fix | core |
CB-UBU-PKG-005 | Restrict access to APT repository credentialsAPT repository credentials are readable or writable by other users | medium | automatedautomated fix | core |
CB-UBU-PKG-006 | Configure the Ubuntu security pocketThe Ubuntu security pocket is not configured | high | automated | core |
CB-UBU-PKG-007 | Install security updates automaticallySecurity updates are not installed automatically | medium | automatedautomated fix | core |
CB-UBU-PKG-008 | Leave no security update pendingSecurity updates are available but not installed | medium | automated | core |
CB-UBU-PKG-009 | Run an Ubuntu release that still receives security updatesThe Ubuntu release no longer receives security updates | high | automated | core |
CB-UBU-PKG-010 | Install only the packages the system needsPackages without a use on this system are installed | low | manual | core |
CB-UBU-PKG-011 | Do not install recommended and suggested packages automaticallyAPT installs recommended packages automatically | low | automatedautomated fix | server-hardened, desktop-hardened |
CB-UBU-PKG-012 | Keep snap packages refreshed automaticallySnap packages are not refreshed automatically | medium | automatedautomated fix | core |
CB-UBU-PKG-013 | Reboot after updates that require it, or use LivepatchThe system has waited too long for a reboot that updates require | medium | automated | core |
CB-UBU-PKG-014 | Receive security updates for every installed package, including universe (Ubuntu Pro esm-apps)Packages from universe are installed without Ubuntu Pro esm-apps | medium | automated | server, desktop-hardened |
CB-UBU-SVC-001 | Disable DHCP and DNS server services the system does not provideDHCP or DNS server services can run on a system that does not provide them | medium | automatedautomated fix | core |
CB-UBU-SVC-002 | Disable file transfer and file sharing server services the system does not provideFTP, TFTP, rsync or Samba servers can run on a system that does not provide them | medium | automatedautomated fix | core |
CB-UBU-SVC-003 | Remove the NFS server and disable rpcbind when the system does not provide themThe NFS server or rpcbind can run on a system that does not need them | medium | automatedautomated fix | core |
CB-UBU-SVC-004 | Disable LDAP and NIS directory server services the system does not provideAn LDAP or NIS directory server can run on a system that does not provide one | medium | automatedautomated fix | core |
CB-UBU-SVC-005 | Disable IMAP and POP3 mail access servers the system does not provideAn IMAP or POP3 server can run on a system that does not provide mailboxes | medium | automatedautomated fix | core |
CB-UBU-SVC-006 | Disable the SNMP agent and trap receiver when they are not usedAn SNMP agent or trap receiver can run on a system that is not monitored through SNMP | medium | automatedautomated fix | core |
CB-UBU-SVC-007 | Remove telnet, rsh and talk servers and disable inetd super-serversClear-text remote access servers or an inetd super-server are present | high | automatedautomated fix | core |
CB-UBU-SVC-008 | Disable web server services on systems that do not serve web contentA web server can run on a system that does not serve web content | medium | automatedautomated fix | core |
CB-UBU-SVC-009 | Disable the Squid web proxy on systems that are not proxy serversA web proxy can run on a system that is not a proxy server | medium | automatedautomated fix | core |
CB-UBU-SVC-010 | Restrict the mail transfer agent to local deliveryThe mail transfer agent accepts connections from the network | medium | automatedautomated fix | core |
CB-UBU-SVC-011 | Forward mail for root to a monitored mailboxMail sent to root stays unread on the system | low | automated | core |
CB-UBU-SVC-012 | Only approved services listen on network interfacesServices nobody approved accept connections from the network | medium | partial | core |
CB-UBU-SVC-013 | Remove clear-text network clients (NIS, rsh, talk, telnet, LDAP tools, FTP)Clients for clear-text or obsolete network protocols are installed | low | automatedautomated fix | core |
CB-UBU-SVC-014 | Run exactly one time synchronization daemonThe system clock is not synchronized, or several daemons fight over it | medium | automated | core |
CB-UBU-SVC-015 | Configure systemd-timesyncd with approved time servers and keep it runningsystemd-timesyncd uses built-in fallback servers or is not running | low | automatedautomated fix | core |
CB-UBU-SVC-016 | Configure chrony with time sources, run it unprivileged and keep it runningchrony has no time source, runs as root or is not running | low | automatedautomated fix | core |
CB-UBU-SVC-017 | Keep the cron daemon enabled and runningThe cron daemon is installed but not running | low | automatedautomated fix | core |
CB-UBU-SVC-018 | Restrict the system crontab and cron directories to rootUsers can read the system cron jobs | medium | automatedautomated fix | core |
CB-UBU-SVC-019 | Allow only listed users to schedule jobs with crontab and atAny local user can schedule jobs with crontab or at | medium | automatedautomated fix | core |
CB-UBU-SVC-020 | Encrypt SSSD LDAP connections and verify the server certificateSSSD talks to the LDAP directory without TLS or without checking the server certificate | high | automated | core |
CB-UBU-SVC-021 | Disable the autofs automounterThe autofs automounter can mount file systems on demand | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-SVC-022 | Disable the Avahi mDNS/DNS-SD daemonAvahi announces the system and its services on the local network | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-SVC-023 | Disable the CUPS print server and printer discoveryThe CUPS print service runs on a system that does not print | medium | automatedautomated fix | server, desktop-hardened |
CB-UBU-SVC-024 | Remove the X Window System server and the GNOME display manager from serversAn X Window System server or a graphical login manager is installed on a server | low | automatedautomated fix | server-hardened |
CB-UBU-SVC-025 | Confine services with systemd sandboxing optionsNetwork-facing services run with the full privileges systemd gives by default | medium | partial | server-hardened |
CB-UBU-SVC-026 | Disable the kdump kernel crash dump serviceKernel crash dumps are collected on the system | low | automatedautomated fix | server-hardened |
CB-UBU-SVC-027 | Remove the NFS client utilities when no NFS share is mountedNFS client utilities are installed on a system that mounts no NFS share | low | automatedautomated fix | server-hardened |
CB-UBU-SVC-028 | Disable cloud-init once the server is provisionedcloud-init still runs at every boot on a provisioned server | medium | automatedautomated fix | server-hardened |
CB-UBU-SVC-029 | Do not send usage data to Canonical (popularity-contest, ubuntu-report, ubuntu-insights)The system can send its package list or hardware details to Canonical | low | automatedautomated fix | core |
No control matches these filters.
02
Profiles
- Core
core - Settings every Ubuntu system should apply, server or desktop. Low operational impact. 112 controls.
- Server
server - Core plus settings for headless servers. Extends
core: applies every one of its controls too. 120 controls. - Server hardened
server-hardened - Stronger settings for exposed or sensitive servers. May break some workloads. Extends
server: applies every one of its controls too. 162 controls. - Desktop
desktop - Core plus settings for workstations with a graphical session. Extends
core: applies every one of its controls too. 120 controls. - Desktop hardened
desktop-hardened - Stronger settings for admin or mobile workstations. May hinder some uses. Extends
desktop: applies every one of its controls too. 164 controls.
03
Domains
- Boot & system hardening
CB-UBU-BOOT-NNN - 17 controls.
- Accounts & authentication
CB-UBU-AUTH-NNN - 30 controls.
- Network
CB-UBU-NET-NNN - 23 controls.
- Services
CB-UBU-SVC-NNN - 29 controls.
- Filesystem & permissions
CB-UBU-FS-NNN - 12 controls.
- Logging & auditing
CB-UBU-AUDIT-NNN - 36 controls.
- Desktop environment
CB-UBU-DESK-NNN - 12 controls.
- Packages & updates
CB-UBU-PKG-NNN - 14 controls.
04
Facts
Conditions a scanner detects on its own, once per target. A control, check or fix that needs a false fact is not applicable there.
- OpenSSH server is installed
openssh-server - Used by 9 controls.
name: openssh-server state: installed - A sudo command is installed (sudo or sudo-rs)
sudo - Used by 4 controls.
script: command -v sudo >/dev/null 2>&1 - auditd is installed
auditd - Used by 0 controls.
name: auditd state: installed - rsyslog is installed
rsyslog - Used by 4 controls.
name: rsyslog state: installed - chrony is installed
chrony - Used by 1 control.
name: chrony state: installed - systemd-timesyncd is installed
systemd-timesyncd - Used by 1 control.
name: systemd-timesyncd state: installed - ufw is installed
ufw - Used by 3 controls.
name: ufw state: installed - nftables is installed
nftables - Used by 2 controls.
name: nftables state: installed - systemd-coredump is installed
systemd-coredump - Used by 1 control.
name: systemd-coredump state: installed - cron is installed
cron - Used by 3 controls.
name: cron state: installed - GNOME Display Manager is installed
gdm - Used by 4 controls.
name: gdm3 state: installed - GNOME desktop is installed
desktop-gnome - Used by 5 controls.
name: gnome-shell state: installed - KDE Plasma desktop is installed
desktop-kde - Used by 2 controls.
name: plasma-workspace state: installed - Xfce desktop is installed
desktop-xfce - Used by 0 controls.
name: xfce4-session state: installed - IPv6 is enabled in the kernel
ipv6 - Used by 3 controls.
script: test -d /proc/sys/net/ipv6 - GRUB is the boot loader
grub - Used by 3 controls.
script: test -f /boot/grub/grub.cfg - LightDM display manager is installed
lightdm - Used by 2 controls.
name: lightdm state: installed - SDDM display manager is installed
sddm - Used by 1 control.
name: sddm state: installed - The kernel has USB support
usb - Used by 1 control.
script: test -d /sys/bus/usb - A mail transfer agent is installed
mta - Used by 2 controls.
script: test -x /usr/sbin/sendmail - at is installed
at - Used by 1 control.
name: at state: installed - SSSD LDAP provider is installed
sssd-ldap - Used by 1 control.
name: sssd-ldap state: installed - sudo is provided by sudo-rs
sudo-rs - Used by 0 controls.
script: sudo --version 2>/dev/null | head -n 1 | grep -q '^sudo-rs' - snapd is installed
snapd - Used by 1 control.
name: snapd state: installed - cloud-init is installed
cloud-init - Used by 1 control.
name: cloud-init state: installed - apport is installed
apport - Used by 1 control.
name: apport state: installed - The system is attached to Ubuntu Pro
ubuntu-pro - Used by 1 control.
script: | pro api u.pro.status.is_attached.v1 2>/dev/null | grep -Eq '"is_attached": ?true'
05
Versions
| Version | Released | Controls | Files |
|---|---|---|---|
| main | unreleased, v0.1.0 in progress | source | |
| v0.1.2 (beta) | 2026-10-19 | 173 | release archive |
| v0.1.1 (beta) | 2026-10-19 | 173 | release archive |
| v0.1.0 (beta) | 2026-10-19 | 173 | release archive |
A release is the git tag ubuntu/v<version>: a zip with the controls and their translations, bundle.json, index.json, an OSCAL catalog and profiles, and per profile the generated audit.sh, remediate.sh and Ansible role.
06
Run it
Each release ships, per profile, scripts generated from its controls. They need only POSIX sh, run on the machine itself and send nothing anywhere. Profiles in v0.1.0: core, server, server-hardened, desktop, desktop-hardened. A beta published for testing: it may still change before a final release.
# Warning: do not execute code or commands that you don't understand
# Download the release and check its checksum
curl -LO https://github.com/cirsec/baselines/releases/download/ubuntu/v0.1.0/cirsec-baselines-ubuntu-0.1.0.zip
curl -LO https://github.com/cirsec/baselines/releases/download/ubuntu/v0.1.0/cirsec-baselines-ubuntu-0.1.0.zip.sha256
sha256sum -c cirsec-baselines-ubuntu-0.1.0.zip.sha256
unzip -q cirsec-baselines-ubuntu-0.1.0.zip
cd cirsec-baselines-ubuntu-0.1.0/generated/server
# Audit: changes nothing, prints a report, writes the result JSON here
sudo sh audit.sh
# Fix what failed: dry run first, then apply
sudo sh remediate.sh
sudo sh remediate.sh --apply- The report
- A summary and a score, then the failures by severity with the observed and expected values, the checks that could not run, and what to check by hand. Colors on a terminal only, none with
NO_COLOR.--verboselists every entry. - The result JSON
- On a terminal it goes to
cirsec-result-<host>-<date>.json; redirected (sudo sh audit.sh > result.json) it goes to stdout, for a pipeline or a dashboard. Format:result.schema.json.audit.shexits 1 when anything fails or cannot run. - Fixes
remediate.shruns a fix only where its check fails and checks again after. Files are backed up under/var/backups/cirsec/first, services restart once at the end, and it says when a reboot or a new login is needed. Fixes that can cut off administrative access stay off unless a tailoring file opts in.- One control, or Ansible
controls/<ID>.sh checkruns one control (exit 0 pass, 1 fail, 2 not applicable, 3 error, 4 manual). Theansible/folder holds the same checks and fixes as a role:ansible-playbook -i <host>, ansible/site.yml --check.- Your own settings
- A tailoring file picks the profile, tunes parameters within their bounds and excludes controls with a reason. Regenerate the scripts with it:
python tools/generate.py --standard ubuntu --tailoring yours.yml.
07
Written from
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux ANSSI, guide
- Ubuntu Security documentation Canonical, vendor-doc
- Ubuntu Server documentation - Security Canonical, vendor-doc
- Ubuntu manual pages Canonical, vendor-doc
- Ubuntu release cycle Canonical, vendor-doc
- Linux kernel documentation - sysctl The Linux Kernel Organization, vendor-doc
- NIST SP 800-123 - Guide to General Server Security NIST, guide
Maintained by1
Alice@Sn0wAlice
Text under CC BY 4.0, code under Apache 2.0 · Source _standard.yml