{ "id": "ubuntu", "code": "UBU", "title": "Ubuntu", "category": "Operating systems", "version": "0.1.0", "standard_version": "0.1.0", "prerelease": true, "released": "2026-10-19", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0.json", "release": { "tag": "https://github.com/cirsec/baselines/releases/tag/ubuntu/v0.1.0", "archive": "https://github.com/cirsec/baselines/releases/download/ubuntu/v0.1.0/cirsec-baselines-ubuntu-0.1.0.zip" }, "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "standard": { "id": "ubuntu", "code": "UBU", "title": "Ubuntu", "description": "Secure configuration baseline for Ubuntu LTS systems, servers and desktops. Version-specific differences are handled per control with applicability.versions.", "status": "draft", "version": "0.1.0", "applies_to": [ { "product": "Ubuntu", "vendor": "Canonical", "versions": [ "20.04", "22.04", "24.04", "26.04" ] } ], "profiles": [ { "key": "core", "title": "Core", "description": "Settings every Ubuntu system should apply, server or desktop. Low operational impact." }, { "key": "server", "title": "Server", "description": "Core plus settings for headless servers.", "extends": "core" }, { "key": "server-hardened", "title": "Server hardened", "description": "Stronger settings for exposed or sensitive servers. May break some workloads.", "extends": "server" }, { "key": "desktop", "title": "Desktop", "description": "Core plus settings for workstations with a graphical session.", "extends": "core" }, { "key": "desktop-hardened", "title": "Desktop hardened", "description": "Stronger settings for admin or mobile workstations. May hinder some uses.", "extends": "desktop" } ], "domains": [ { "code": "BOOT", "title": "Boot & system hardening" }, { "code": "AUTH", "title": "Accounts & authentication" }, { "code": "NET", "title": "Network" }, { "code": "SVC", "title": "Services" }, { "code": "FS", "title": "Filesystem & permissions" }, { "code": "AUDIT", "title": "Logging & auditing" }, { "code": "DESK", "title": "Desktop environment" }, { "code": "PKG", "title": "Packages & updates" } ], "facts": [ { "key": "openssh-server", "title": "OpenSSH server is installed", "detect": { "engine": "package", "spec": { "name": "openssh-server", "state": "installed" } } }, { "key": "sudo", "title": "A sudo command is installed (sudo or sudo-rs)", "detect": { "engine": "shell", "spec": { "script": "command -v sudo >/dev/null 2>&1" } } }, { "key": "auditd", "title": "auditd is installed", "detect": { "engine": "package", "spec": { "name": "auditd", "state": "installed" } } }, { "key": "rsyslog", "title": "rsyslog is installed", "detect": { "engine": "package", "spec": { "name": "rsyslog", "state": "installed" } } }, { "key": "chrony", "title": "chrony is installed", "detect": { "engine": "package", "spec": { "name": "chrony", "state": "installed" } } }, { "key": "systemd-timesyncd", "title": "systemd-timesyncd is installed", "detect": { "engine": "package", "spec": { "name": "systemd-timesyncd", "state": "installed" } } }, { "key": "ufw", "title": "ufw is installed", "detect": { "engine": "package", "spec": { "name": "ufw", "state": "installed" } } }, { "key": "nftables", "title": "nftables is installed", "detect": { "engine": "package", "spec": { "name": "nftables", "state": "installed" } } }, { "key": "systemd-coredump", "title": "systemd-coredump is installed", "detect": { "engine": "package", "spec": { "name": "systemd-coredump", "state": "installed" } } }, { "key": "cron", "title": "cron is installed", "detect": { "engine": "package", "spec": { "name": "cron", "state": "installed" } } }, { "key": "gdm", "title": "GNOME Display Manager is installed", "detect": { "engine": "package", "spec": { "name": "gdm3", "state": "installed" } } }, { "key": "desktop-gnome", "title": "GNOME desktop is installed", "detect": { "engine": "package", "spec": { "name": "gnome-shell", "state": "installed" } } }, { "key": "desktop-kde", "title": "KDE Plasma desktop is installed", "detect": { "engine": "package", "spec": { "name": "plasma-workspace", "state": "installed" } } }, { "key": "desktop-xfce", "title": "Xfce desktop is installed", "detect": { "engine": "package", "spec": { "name": "xfce4-session", "state": "installed" } } }, { "key": "ipv6", "title": "IPv6 is enabled in the kernel", "detect": { "engine": "shell", "spec": { "script": "test -d /proc/sys/net/ipv6" } } }, { "key": "grub", "title": "GRUB is the boot loader", "detect": { "engine": "shell", "spec": { "script": "test -f /boot/grub/grub.cfg" } } }, { "key": "lightdm", "title": "LightDM display manager is installed", "detect": { "engine": "package", "spec": { "name": "lightdm", "state": "installed" } } }, { "key": "sddm", "title": "SDDM display manager is installed", "detect": { "engine": "package", "spec": { "name": "sddm", "state": "installed" } } }, { "key": "usb", "title": "The kernel has USB support", "detect": { "engine": "shell", "spec": { "script": "test -d /sys/bus/usb" } } }, { "key": "mta", "title": "A mail transfer agent is installed", "detect": { "engine": "shell", "spec": { "script": "test -x /usr/sbin/sendmail" } } }, { "key": "at", "title": "at is installed", "detect": { "engine": "package", "spec": { "name": "at", "state": "installed" } } }, { "key": "sssd-ldap", "title": "SSSD LDAP provider is installed", "detect": { "engine": "package", "spec": { "name": "sssd-ldap", "state": "installed" } } }, { "key": "sudo-rs", "title": "sudo is provided by sudo-rs", "detect": { "engine": "shell", "spec": { "script": "sudo --version 2>/dev/null | head -n 1 | grep -q '^sudo-rs'" } } }, { "key": "snapd", "title": "snapd is installed", "detect": { "engine": "package", "spec": { "name": "snapd", "state": "installed" } } }, { "key": "cloud-init", "title": "cloud-init is installed", "detect": { "engine": "package", "spec": { "name": "cloud-init", "state": "installed" } } }, { "key": "apport", "title": "apport is installed", "detect": { "engine": "package", "spec": { "name": "apport", "state": "installed" } } }, { "key": "ubuntu-pro", "title": "The system is attached to Ubuntu Pro", "detect": { "engine": "shell", "spec": { "script": "pro api u.pro.status.is_attached.v1 2>/dev/null | grep -Eq '\"is_attached\": ?true'\n" } } } ], "maintainers": [ { "name": "Alice", "github": "Sn0wAlice" } ], "primary_sources": [ { "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux", "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf", "publisher": "ANSSI", "kind": "guide" }, { "title": "Ubuntu Security documentation", "url": "https://documentation.ubuntu.com/security/", "publisher": "Canonical", "kind": "vendor-doc" }, { "title": "Ubuntu Server documentation - Security", "url": "https://documentation.ubuntu.com/server/how-to/security/", "publisher": "Canonical", "kind": "vendor-doc" }, { "title": "Ubuntu manual pages", "url": "https://manpages.ubuntu.com/", "publisher": "Canonical", "kind": "vendor-doc" }, { "title": "Ubuntu release cycle", "url": "https://ubuntu.com/about/release-cycle", "publisher": "Canonical", "kind": "vendor-doc" }, { "title": "Linux kernel documentation - sysctl", "url": "https://docs.kernel.org/admin-guide/sysctl/index.html", "publisher": "The Linux Kernel Organization", "kind": "vendor-doc" }, { "title": "NIST SP 800-123 - Guide to General Server Security", "url": "https://csrc.nist.gov/pubs/sp/800/123/final", "publisher": "NIST", "kind": "guide" } ], "i18n": { "fr": { "title": "Ubuntu", "description": "Référentiel de configuration sécurisée pour les systèmes Ubuntu LTS, serveurs et postes de travail. Les différences entre versions sont gérées par contrôle via applicability.versions.", "domains": { "BOOT": "Démarrage et durcissement système", "AUTH": "Comptes et authentification", "NET": "Réseau", "SVC": "Services", "FS": "Système de fichiers et permissions", "AUDIT": "Journalisation et audit", "DESK": "Environnement graphique", "PKG": "Paquets et mises à jour" }, "profiles": { "core": { "title": "Socle", "description": "Paramètres que tout système Ubuntu devrait appliquer, serveur ou poste. Impact opérationnel faible." }, "server": { "title": "Serveur", "description": "Socle plus les paramètres des serveurs sans interface graphique." }, "server-hardened": { "title": "Serveur renforcé", "description": "Paramètres plus stricts pour les serveurs exposés ou sensibles. Peut casser certains usages." }, "desktop": { "title": "Poste de travail", "description": "Socle plus les paramètres des postes avec session graphique." }, "desktop-hardened": { "title": "Poste renforcé", "description": "Paramètres plus stricts pour les postes d'administration ou nomades. Peut gêner certains usages." } } } } }, "controls": [ { "id": "CB-UBU-AUDIT-001", "title": "Keep the systemd journal running, persistent, compressed and bounded in size", "finding": "System logs may be lost at reboot or fill the disk", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "journald", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-001.json" }, { "id": "CB-UBU-AUDIT-002", "title": "Forward the journal to rsyslog only when rsyslog is the chosen logger", "finding": "The journal forwarding setting does not match the logging system in use", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "journald", "rsyslog", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-002.json" }, { "id": "CB-UBU-AUDIT-003", "title": "Do not accept logs from other hosts", "finding": "The system listens for log messages from the network", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "journald", "rsyslog", "logging", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-003.json" }, { "id": "CB-UBU-AUDIT-004", "title": "Restrict access to log files", "finding": "Log files are readable or writable by too many users", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "logging", "permissions", "journald" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-004.json" }, { "id": "CB-UBU-AUDIT-005", "title": "Run rsyslog and create its log files with restricted permissions", "finding": "rsyslog is installed but does not run, or writes logs readable by everyone", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "rsyslog", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-005.json" }, { "id": "CB-UBU-AUDIT-006", "title": "Review which messages rsyslog writes and where", "finding": "The rsyslog rules have not been reviewed against the site logging needs", "severity": "low", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "rsyslog", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-006.json" }, { "id": "CB-UBU-AUDIT-007", "title": "Rotate log files with logrotate", "finding": "Text log files are never rotated", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "logrotate", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-007.json" }, { "id": "CB-UBU-AUDIT-008", "title": "Send system logs to a remote log server", "finding": "System logs are only stored on the system that produced them", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "logging", "remote", "journald", "rsyslog" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-008.json" }, { "id": "CB-UBU-AUDIT-009", "title": "Encrypt and authenticate the rsyslog connection to the log server", "finding": "Logs are sent to the log server without TLS", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "rsyslog", "logging", "remote", "tls" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-009.json" }, { "id": "CB-UBU-AUDIT-010", "title": "Give each exposed service its own activity log", "finding": "Service activity is mixed into general logs or not logged at all", "severity": "low", "status": "active", "assessment": "manual", "profiles": [ "server-hardened" ], "tags": [ "logging", "services" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-010.json" }, { "id": "CB-UBU-AUDIT-011", "title": "Install and run the audit daemon", "finding": "The kernel audit records are not collected", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-011.json" }, { "id": "CB-UBU-AUDIT-012", "title": "Enable auditing from boot with a large enough backlog", "finding": "Processes started before auditd are not audited", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "boot", "grub" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-012.json" }, { "id": "CB-UBU-AUDIT-013", "title": "Keep audit logs instead of rotating them away", "finding": "Old audit logs are deleted automatically", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "retention" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-013.json" }, { "id": "CB-UBU-AUDIT-014", "title": "Decide and configure what happens when the audit disk fills up", "finding": "The system keeps running without recording audit events when the audit log space runs out", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "availability" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-014.json" }, { "id": "CB-UBU-AUDIT-015", "title": "Send audit records to a remote server", "finding": "Audit records are only stored on the audited system", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "auditd", "remote" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-015", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-015.json" }, { "id": "CB-UBU-AUDIT-016", "title": "Audit changes to sudo rights and commands run as another user", "finding": "Changes to administrator rights and use of other identities are not recorded", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "sudo" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-016", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-016.json" }, { "id": "CB-UBU-AUDIT-017", "title": "Audit changes to the system clock and time zone", "finding": "Changes to the system time are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "time" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-017", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-017.json" }, { "id": "CB-UBU-AUDIT-018", "title": "Audit changes to the host name and network configuration", "finding": "Changes to the host identity and network settings are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-018", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-018.json" }, { "id": "CB-UBU-AUDIT-019", "title": "Audit changes to accounts, groups and authentication settings", "finding": "Changes to accounts and authentication settings are not recorded", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "accounts", "pam" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-019", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-019.json" }, { "id": "CB-UBU-AUDIT-020", "title": "Audit changes to file permissions, owners and extended attributes", "finding": "Changes to file permissions and ownership are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-020", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-020.json" }, { "id": "CB-UBU-AUDIT-021", "title": "Audit denied attempts to open or truncate files", "finding": "Failed attempts to access files are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "access" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-021", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-021.json" }, { "id": "CB-UBU-AUDIT-022", "title": "Audit file system mounts and unmounts by users", "finding": "File system mounts by users are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "mount" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-022", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-022.json" }, { "id": "CB-UBU-AUDIT-023", "title": "Audit file deletions and renames by users", "finding": "File deletions and renames by users are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "files" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-023", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-023.json" }, { "id": "CB-UBU-AUDIT-024", "title": "Audit changes to the AppArmor configuration", "finding": "Changes to the mandatory access control policy are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "apparmor" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-024", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-024.json" }, { "id": "CB-UBU-AUDIT-025", "title": "Audit kernel module loading and unloading", "finding": "Kernel modules can be loaded or removed without a record", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "kernel-modules" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-025", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-025.json" }, { "id": "CB-UBU-AUDIT-026", "title": "Audit every use of setuid and setgid programs", "finding": "Use of privileged programs is not recorded", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "setuid" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-026", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-026.json" }, { "id": "CB-UBU-AUDIT-027", "title": "Audit login records and session files", "finding": "Tampering with login records is not detected", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "login" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-027", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-027.json" }, { "id": "CB-UBU-AUDIT-028", "title": "Audit changes to scheduled tasks and to the systemd journal", "finding": "Changes to scheduled tasks and journal files are not recorded", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "cron", "journald" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-028", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-028.json" }, { "id": "CB-UBU-AUDIT-029", "title": "Lock the audit configuration and load every valid rule", "finding": "The audit rules can be changed or disabled on the running system", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-029", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-029.json" }, { "id": "CB-UBU-AUDIT-030", "title": "Restrict access to the audit logs", "finding": "Audit logs can be read or changed by users other than root", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-030", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-030.json" }, { "id": "CB-UBU-AUDIT-031", "title": "Restrict access to the audit configuration and tools", "finding": "Audit configuration or tools can be changed by users other than root", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-031", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-031.json" }, { "id": "CB-UBU-AUDIT-032", "title": "Install the AIDE file integrity checker", "finding": "No file integrity checker is installed", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "aide", "integrity" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-032", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-032.json" }, { "id": "CB-UBU-AUDIT-033", "title": "Check the integrity of the audit tools with AIDE", "finding": "A modified audit tool would not be detected", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "aide", "auditd", "integrity" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-033", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-033.json" }, { "id": "CB-UBU-AUDIT-034", "title": "Build the AIDE database and check file integrity every day", "finding": "File integrity is never checked", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "aide", "integrity", "systemd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-034", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-034.json" }, { "id": "CB-UBU-AUDIT-035", "title": "Keep a protected copy of the AIDE database", "finding": "The AIDE reference database is only stored on the system it protects", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "aide", "integrity" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-035", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-035.json" }, { "id": "CB-UBU-AUDIT-036", "title": "Audit administrative commands that are not setuid", "finding": "Use of administrative commands is not recorded", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "auditd", "privileged" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-036", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-036.json" }, { "id": "CB-UBU-AUTH-001", "title": "Show a legal warning before login, without system details", "finding": "The login prompt shows the operating system version and no legal warning", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "banner", "login" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-001.json" }, { "id": "CB-UBU-AUTH-002", "title": "Keep system details out of the message of the day", "finding": "The message of the day shows the operating system version and kernel release to every user who logs in", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "banner", "login", "motd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-002.json" }, { "id": "CB-UBU-AUTH-003", "title": "Protect the login banner files from modification", "finding": "Login banner files can be changed by non-root users", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "banner", "login", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-003.json" }, { "id": "CB-UBU-AUTH-004", "title": "Install sudo for administrative access", "finding": "sudo is not installed", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sudo", "privilege-escalation", "accountability" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-004.json" }, { "id": "CB-UBU-AUTH-005", "title": "Configure sudo to use a pseudo-terminal, a log file and a short credential cache", "finding": "sudo defaults allow terminal hijacking, keep no local log or cache credentials too long", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sudo", "privilege-escalation", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-005.json" }, { "id": "CB-UBU-AUTH-006", "title": "Require a password for every sudo rule", "finding": "Some sudo rules run commands without asking for a password", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "sudo", "privilege-escalation" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-006.json" }, { "id": "CB-UBU-AUTH-007", "title": "Never disable authentication for sudo globally", "finding": "sudo is configured to skip authentication", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sudo", "privilege-escalation" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-007.json" }, { "id": "CB-UBU-AUTH-008", "title": "Restrict the su command to an empty group", "finding": "Any user who knows a target password can switch user with su", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "su", "pam", "privilege-escalation" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-008.json" }, { "id": "CB-UBU-AUTH-009", "title": "Write sudo rules with least privilege", "finding": "sudo rules give broader rights than the tasks need", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sudo", "privilege-escalation", "least-privilege" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-009.json" }, { "id": "CB-UBU-AUTH-010", "title": "Enforce password quality with pam_pwquality", "finding": "Users can set short or trivial passwords", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "pam", "password" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-010.json" }, { "id": "CB-UBU-AUTH-011", "title": "Lock accounts after repeated failed logins", "finding": "Passwords can be guessed without limit", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "pam", "password", "brute-force" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-011.json" }, { "id": "CB-UBU-AUTH-012", "title": "Prevent reuse of recent passwords", "finding": "Users can set a password they used before", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "pam", "password" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-012.json" }, { "id": "CB-UBU-AUTH-013", "title": "Refuse empty passwords and hash passwords with a strong algorithm in pam_unix", "finding": "pam_unix accepts accounts with an empty password", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "pam", "password" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-013.json" }, { "id": "CB-UBU-AUTH-014", "title": "Set password aging and hashing defaults for new accounts", "finding": "New accounts get passwords that never expire and are never disabled when unused", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "password", "accounts", "login-defs" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-014.json" }, { "id": "CB-UBU-AUTH-015", "title": "Apply the password aging policy to existing accounts", "finding": "Existing accounts keep passwords that never expire", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "password", "accounts" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-015", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-015.json" }, { "id": "CB-UBU-AUTH-016", "title": "Keep root the only superuser account and protect its password", "finding": "Another account has superuser identity, or root has no password protection", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "root" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-016", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-016.json" }, { "id": "CB-UBU-AUTH-017", "title": "Keep the root PATH free of relative and writable directories", "finding": "The root login PATH contains a relative or writable directory", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "root", "path" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-017", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-017.json" }, { "id": "CB-UBU-AUTH-018", "title": "Prevent interactive logins to system accounts", "finding": "A system account has a login shell or an unlocked password", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "service-accounts" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-018", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-018.json" }, { "id": "CB-UBU-AUTH-019", "title": "Set a restrictive default umask for login sessions", "finding": "New files are readable by every local user by default", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "umask", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-019", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-019.json" }, { "id": "CB-UBU-AUTH-020", "title": "Close idle shell sessions automatically", "finding": "Idle shell sessions stay open forever", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "session", "timeout" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-020", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-020.json" }, { "id": "CB-UBU-AUTH-021", "title": "Do not list nologin as a valid shell", "finding": "nologin is declared as a valid login shell", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "accounts", "shells" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-021", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-021.json" }, { "id": "CB-UBU-AUTH-022", "title": "Disable reboot with Ctrl-Alt-Del on the console", "finding": "Anyone at the console can reboot the system with Ctrl-Alt-Del", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "console", "physical-access", "systemd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-022", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-022.json" }, { "id": "CB-UBU-AUTH-023", "title": "Disable accounts that are no longer used", "finding": "Accounts of people or services that left are still active", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "lifecycle" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-023", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-023.json" }, { "id": "CB-UBU-AUTH-024", "title": "Give each service its own dedicated account", "finding": "Several services share one account, or run as a person's account", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "service-accounts", "least-privilege" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-024", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-024.json" }, { "id": "CB-UBU-AUTH-025", "title": "Replace default secrets right after installation", "finding": "Secrets set by the installer, an image or a vendor are still in use", "severity": "high", "status": "active", "assessment": "manual", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "accounts", "secrets", "provisioning" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-025", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-025.json" }, { "id": "CB-UBU-AUTH-026", "title": "Store every password hash in shadow and leave no account without a password", "finding": "An account has its password hash in /etc/passwd, or an empty password", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "password", "shadow" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-026", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-026.json" }, { "id": "CB-UBU-AUTH-027", "title": "Keep the user and group databases consistent", "finding": "User and group files contain duplicates or dangling references", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "integrity" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-027", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-027.json" }, { "id": "CB-UBU-AUTH-028", "title": "Keep the shadow group empty", "finding": "Users are members of the shadow group", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "shadow", "password" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-028", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-028.json" }, { "id": "CB-UBU-AUTH-029", "title": "Keep user home directories and dot files private", "finding": "User home directories or startup files are readable or writable by others", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "accounts", "home", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-029", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-029.json" }, { "id": "CB-UBU-AUTH-030", "title": "Turn off MOTD content fetched from the network (motd-news, update-notifier)", "finding": "The system contacts Canonical servers to build the message of the day", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "motd", "privacy", "network", "services" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-030", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUTH-030.json" }, { "id": "CB-UBU-BOOT-001", "title": "Enable full address space layout randomization", "finding": "Memory layout of processes is predictable", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "memory" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-001.json" }, { "id": "CB-UBU-BOOT-002", "title": "Hide kernel addresses from users", "finding": "Kernel memory addresses are exposed through /proc and other interfaces", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "information-disclosure" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-002.json" }, { "id": "CB-UBU-BOOT-003", "title": "Restrict the kernel log buffer to privileged users", "finding": "Unprivileged users can read the kernel log buffer", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "information-disclosure" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-003.json" }, { "id": "CB-UBU-BOOT-004", "title": "Restrict ptrace to descendant processes", "finding": "Any process can trace and read the memory of other processes of the same user", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "yama", "credentials" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-004.json" }, { "id": "CB-UBU-BOOT-005", "title": "Disable core dumps of setuid programs", "finding": "Privileged programs can write their memory to core dump files", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "core-dump", "credentials" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-005.json" }, { "id": "CB-UBU-BOOT-006", "title": "Protect symbolic links in world-writable sticky directories", "finding": "Symbolic links in shared temporary directories are followed for any user", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "filesystem", "toctou" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-006.json" }, { "id": "CB-UBU-BOOT-007", "title": "Protect hard links to files the user does not own", "finding": "Users can create hard links to files they do not own", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "filesystem", "toctou" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-007.json" }, { "id": "CB-UBU-BOOT-008", "title": "Install and enable AppArmor", "finding": "AppArmor mandatory access control is not active", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apparmor", "mac", "lsm" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-008.json" }, { "id": "CB-UBU-BOOT-009", "title": "Stop unconfined unprivileged processes from switching AppArmor profiles", "finding": "Unprivileged unconfined processes can move to a more permissive AppArmor profile", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apparmor", "mac", "sysctl" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-009.json" }, { "id": "CB-UBU-BOOT-010", "title": "Keep no AppArmor profile in complain mode", "finding": "Some AppArmor profiles only log violations instead of blocking them", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "apparmor", "mac" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-010.json" }, { "id": "CB-UBU-BOOT-011", "title": "Protect the boot loader configuration with a password", "finding": "Anyone at the console can edit the boot entries", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "grub", "boot", "physical-access" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-011.json" }, { "id": "CB-UBU-BOOT-012", "title": "Restrict access to the boot loader configuration", "finding": "Users can read the boot loader configuration", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "grub", "boot", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-012.json" }, { "id": "CB-UBU-BOOT-013", "title": "Disable core dumps", "finding": "Crashing programs can write their memory to disk", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "core-dump", "pam", "systemd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-013.json" }, { "id": "CB-UBU-BOOT-014", "title": "Remove prelink", "finding": "prelink is installed", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "package", "memory", "integrity" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-014.json" }, { "id": "CB-UBU-BOOT-015", "title": "Disable automatic crash reporting (apport, whoopsie)", "finding": "Crashes are collected automatically and can be sent outside the organization", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "core-dump", "apport", "privacy", "services" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-015", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-015.json" }, { "id": "CB-UBU-BOOT-016", "title": "Restrict unprivileged user namespaces with AppArmor", "finding": "Any local program can create unprivileged user namespaces", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apparmor", "kernel", "sysctl", "namespaces" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-016", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-016.json" }, { "id": "CB-UBU-BOOT-017", "title": "Protect FIFOs and regular files in world-writable sticky directories", "finding": "Programs can be tricked into opening FIFOs or files planted by other users in /tmp", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "sysctl", "filesystem", "toctou" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-017", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-BOOT-017.json" }, { "id": "CB-UBU-DESK-001", "title": "Disable automatic mounting of removable media in GNOME", "finding": "GNOME mounts and opens removable media as soon as they are plugged in", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "gnome", "dconf", "removable-media" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-001.json" }, { "id": "CB-UBU-DESK-002", "title": "Show a warning banner and hide the user list on the GDM login screen", "finding": "The GDM login screen lists local accounts and shows no warning", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gdm", "banner", "login", "dconf" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-002.json" }, { "id": "CB-UBU-DESK-003", "title": "Lock GNOME sessions after a short inactivity delay", "finding": "Users can extend or disable the GNOME inactivity lock", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gnome", "dconf", "session-lock" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-003.json" }, { "id": "CB-UBU-DESK-004", "title": "Never run software automatically from inserted media in GNOME", "finding": "GNOME can start programs from inserted media", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gnome", "dconf", "removable-media" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-004.json" }, { "id": "CB-UBU-DESK-005", "title": "Disable XDMCP in the display manager", "finding": "The display manager accepts XDMCP remote logins", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gdm", "lightdm", "xdmcp", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-005.json" }, { "id": "CB-UBU-DESK-006", "title": "Require a password at the graphical login, without automatic login or guest session", "finding": "The display manager opens a session without a password", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gdm", "lightdm", "sddm", "login", "authentication" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-006.json" }, { "id": "CB-UBU-DESK-007", "title": "Refuse root logins at the graphical login screen", "finding": "root can open a graphical session", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gdm", "lightdm", "sddm", "pam", "root" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-007.json" }, { "id": "CB-UBU-DESK-008", "title": "Lock idle sessions outside GNOME, through logind and the KDE screen locker", "finding": "Idle sessions of desktops other than GNOME may never lock", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "logind", "kde", "session-lock" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-008.json" }, { "id": "CB-UBU-DESK-009", "title": "Lock the session when the screen saver starts and when the system suspends", "finding": "Users can turn off the screen lock, including on suspend and lid close", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop", "desktop-hardened" ], "tags": [ "gnome", "kde", "dconf", "session-lock", "suspend" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-009.json" }, { "id": "CB-UBU-DESK-010", "title": "Decide whether to turn off Wayland sessions in GDM (recommended - skip)", "finding": "GDM starts Wayland sessions, which run X11 programs through Xwayland", "severity": "low", "status": "active", "assessment": "manual", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "gdm", "wayland", "xwayland", "x11" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-010.json" }, { "id": "CB-UBU-DESK-011", "title": "Remove the Ctrl-Alt-Del shortcut from GNOME", "finding": "Ctrl-Alt-Del in GNOME opens the power-off and restart dialog", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "desktop-hardened" ], "tags": [ "gnome", "dconf", "availability" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-011.json" }, { "id": "CB-UBU-DESK-012", "title": "Allow only known USB devices with USBGuard", "finding": "Any USB device plugged into the machine is accepted", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop-hardened" ], "tags": [ "usb", "usbguard", "device-control" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-DESK-012.json" }, { "id": "CB-UBU-FS-001", "title": "Block kernel modules for filesystems the system does not use", "finding": "The kernel can load modules for rarely used filesystems", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel-modules", "filesystems", "modprobe" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-001.json" }, { "id": "CB-UBU-FS-002", "title": "Block USB mass storage and FireWire kernel modules", "finding": "USB storage devices and FireWire can be used on the system", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "kernel-modules", "usb", "firewire", "modprobe" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-002.json" }, { "id": "CB-UBU-FS-003", "title": "Mount /tmp as a separate filesystem with nodev, nosuid and noexec", "finding": "Programs can be run, or device files and setuid programs used, from /tmp", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "mount", "tmp", "tmpfs" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-003.json" }, { "id": "CB-UBU-FS-004", "title": "Mount /dev/shm with nodev, nosuid and noexec", "finding": "Programs can be run from the shared memory filesystem", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "mount", "shm", "tmpfs" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-004.json" }, { "id": "CB-UBU-FS-005", "title": "Put /home, /var, /var/tmp, /var/log and /var/log/audit on separate filesystems", "finding": "User data, variable data and logs share the root filesystem", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "mount", "partitions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-005.json" }, { "id": "CB-UBU-FS-006", "title": "Mount separate filesystems with nodev, nosuid and noexec where they are not needed", "finding": "Separate filesystems are mounted without restrictive options", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "mount", "partitions", "fstab" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-006.json" }, { "id": "CB-UBU-FS-007", "title": "Protect the user, group and password database files", "finding": "The account database files have weak ownership or permissions", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "permissions", "accounts", "shadow" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-007.json" }, { "id": "CB-UBU-FS-008", "title": "Leave no world-writable file, and set the sticky bit on world-writable directories", "finding": "Files can be changed by any user, or shared directories let users delete each other's files", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "permissions", "world-writable", "sticky-bit" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-008.json" }, { "id": "CB-UBU-FS-009", "title": "Leave no file without a known owner or group", "finding": "Some files belong to a user or group that does not exist", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "permissions", "ownership" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-009.json" }, { "id": "CB-UBU-FS-010", "title": "Review setuid and setgid programs and keep only those that are needed", "finding": "Unexpected setuid or setgid programs are present", "severity": "medium", "status": "active", "assessment": "partial", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "permissions", "setuid", "setgid", "privilege-escalation" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-010.json" }, { "id": "CB-UBU-FS-011", "title": "Keep system programs and libraries owned by root and not writable by others", "finding": "System programs or libraries can be changed by a non-root account", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "permissions", "binaries", "libraries" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-011.json" }, { "id": "CB-UBU-FS-012", "title": "Encrypt the disks holding the system and data", "finding": "File systems or swap are stored unencrypted on disk", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "desktop-hardened" ], "tags": [ "encryption", "luks", "physical-access" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-FS-012.json" }, { "id": "CB-UBU-NET-001", "title": "Decide whether IPv6 is used, and disable or secure it accordingly", "finding": "IPv6 is active without a decision to use it", "severity": "low", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ipv6", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-001.json" }, { "id": "CB-UBU-NET-002", "title": "Prevent loading of unused network protocol modules", "finding": "Rarely used network protocol modules can be loaded on demand", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "kernel", "modules", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-002.json" }, { "id": "CB-UBU-NET-003", "title": "Disable wireless network interfaces on servers", "finding": "A wireless network interface is available on a server", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened" ], "tags": [ "wireless", "network", "hardware" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-003.json" }, { "id": "CB-UBU-NET-004", "title": "Disable the Bluetooth service", "finding": "The Bluetooth service can be started", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "bluetooth", "wireless", "service" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-004.json" }, { "id": "CB-UBU-NET-005", "title": "Run exactly one host firewall", "finding": "No host firewall is active, or several firewall tools compete for the same rules", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "firewall", "ufw", "nftables", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-005.json" }, { "id": "CB-UBU-NET-006", "title": "Drop incoming and forwarded traffic by default, with SSH allowed", "finding": "The host firewall accepts incoming or forwarded traffic that no rule allows", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "firewall", "ufw", "nftables", "network", "ssh" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-006.json" }, { "id": "CB-UBU-NET-007", "title": "Drop outgoing traffic by default", "finding": "The host firewall lets the system open any outgoing connection", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "firewall", "ufw", "nftables", "network", "egress" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-007.json" }, { "id": "CB-UBU-NET-008", "title": "Restrict access to firewall and IPsec configuration files", "finding": "Firewall or IPsec configuration files can be changed or read by non-root users", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "firewall", "ipsec", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-008.json" }, { "id": "CB-UBU-NET-009", "title": "Disable IP forwarding unless the system is a router", "finding": "The system forwards packets between networks", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sysctl", "network", "routing", "ipv6" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-009.json" }, { "id": "CB-UBU-NET-010", "title": "Ignore ICMP redirects and source-routed packets, and send no redirects", "finding": "The kernel accepts route changes or routing instructions from the network", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sysctl", "network", "routing", "ipv6" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-010.json" }, { "id": "CB-UBU-NET-011", "title": "Drop and log packets with spoofed source addresses", "finding": "The kernel accepts packets whose source address cannot be genuine, without logging them", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sysctl", "network", "spoofing", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-011.json" }, { "id": "CB-UBU-NET-012", "title": "Harden ICMP and TCP handling against floods and bogus packets", "finding": "The kernel ICMP and TCP settings leave the system open to simple floods and protocol abuse", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sysctl", "network", "icmp", "tcp", "denial-of-service" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-012.json" }, { "id": "CB-UBU-NET-013", "title": "Restrict ARP answers and ignore gratuitous ARP", "finding": "The kernel answers and accepts ARP messages beyond what the local network needs", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "sysctl", "network", "arp" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-013.json" }, { "id": "CB-UBU-NET-014", "title": "Ignore IPv6 router advertisements", "finding": "The kernel configures IPv6 addresses and routes from any router advertisement", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sysctl", "network", "ipv6" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-014.json" }, { "id": "CB-UBU-NET-015", "title": "Use only strong ciphers, MACs and key exchange algorithms in the SSH server", "finding": "The SSH server accepts weak or outdated cryptographic algorithms", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "cryptography", "network" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-015", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-015.json" }, { "id": "CB-UBU-NET-016", "title": "Restrict SSH authentication to named accounts with strong methods", "finding": "The SSH server allows root logins, weak authentication methods or unlimited guessing", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "authentication", "root" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-016", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-016.json" }, { "id": "CB-UBU-NET-017", "title": "Limit SSH connections and close dead sessions", "finding": "The SSH server keeps dead sessions open and accepts many concurrent unauthenticated connections", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "session", "denial-of-service" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-017", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-017.json" }, { "id": "CB-UBU-NET-018", "title": "Disable SSH forwarding", "finding": "SSH sessions can forward ports, sockets, X11 and the SSH agent", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "ssh", "forwarding", "tunneling" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-018", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-018.json" }, { "id": "CB-UBU-NET-019", "title": "Log SSH logins with enough detail", "finding": "The SSH server logs too little to trace logins", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "logging" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-019", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-019.json" }, { "id": "CB-UBU-NET-020", "title": "Show the legal warning banner before SSH authentication", "finding": "The SSH server shows no warning before authentication", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "banner", "legal" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-020", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-020.json" }, { "id": "CB-UBU-NET-021", "title": "Limit SSH logins to the users and groups that need them", "finding": "Every account with a valid credential can log in over SSH", "severity": "medium", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "access-control" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-021", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-021.json" }, { "id": "CB-UBU-NET-022", "title": "Protect the SSH server configuration and host keys", "finding": "SSH server configuration or host keys can be read or changed by non-root users", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "ssh", "permissions", "keys" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-022", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-022.json" }, { "id": "CB-UBU-NET-023", "title": "Restrict access to netplan configuration files", "finding": "Netplan configuration files can be read or changed by non-root users", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "netplan", "network", "permissions", "secrets" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-023", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-NET-023.json" }, { "id": "CB-UBU-PKG-001", "title": "Bind every APT repository to its signing key", "finding": "APT repositories are not bound to a signing key or bypass signature checks", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "repositories", "signatures", "supply-chain" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-001.json" }, { "id": "CB-UBU-PKG-002", "title": "Download packages over HTTPS", "finding": "APT downloads from repositories over an unencrypted protocol", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "repositories", "https" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-002.json" }, { "id": "CB-UBU-PKG-003", "title": "Keep APT signature, freshness and TLS checks enabled", "finding": "APT is configured to accept unsigned, weakly signed, outdated or unverified repositories", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "repositories", "signatures", "supply-chain" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-003.json" }, { "id": "CB-UBU-PKG-004", "title": "Restrict write access to APT keys and repository lists", "finding": "Non-root users can change the APT keys or repository lists", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "repositories", "permissions", "supply-chain" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-004.json" }, { "id": "CB-UBU-PKG-005", "title": "Restrict access to APT repository credentials", "finding": "APT repository credentials are readable or writable by other users", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "credentials", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-005.json" }, { "id": "CB-UBU-PKG-006", "title": "Configure the Ubuntu security pocket", "finding": "The Ubuntu security pocket is not configured", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "repositories", "updates", "ubuntu-pro" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-006.json" }, { "id": "CB-UBU-PKG-007", "title": "Install security updates automatically", "finding": "Security updates are not installed automatically", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "updates", "unattended-upgrades" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-007.json" }, { "id": "CB-UBU-PKG-008", "title": "Leave no security update pending", "finding": "Security updates are available but not installed", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "apt", "updates" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-008.json" }, { "id": "CB-UBU-PKG-009", "title": "Run an Ubuntu release that still receives security updates", "finding": "The Ubuntu release no longer receives security updates", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "updates", "lifecycle", "ubuntu-pro" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-009.json" }, { "id": "CB-UBU-PKG-010", "title": "Install only the packages the system needs", "finding": "Packages without a use on this system are installed", "severity": "low", "status": "active", "assessment": "manual", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "packages", "minimal-install" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-010.json" }, { "id": "CB-UBU-PKG-011", "title": "Do not install recommended and suggested packages automatically", "finding": "APT installs recommended packages automatically", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened", "desktop-hardened" ], "tags": [ "apt", "packages", "minimal-install" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-011.json" }, { "id": "CB-UBU-PKG-012", "title": "Keep snap packages refreshed automatically", "finding": "Snap packages are not refreshed automatically", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "snap", "updates" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-012.json" }, { "id": "CB-UBU-PKG-013", "title": "Reboot after updates that require it, or use Livepatch", "finding": "The system has waited too long for a reboot that updates require", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "updates", "reboot", "livepatch" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-013.json" }, { "id": "CB-UBU-PKG-014", "title": "Receive security updates for every installed package, including universe (Ubuntu Pro esm-apps)", "finding": "Packages from universe are installed without Ubuntu Pro esm-apps", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "updates", "ubuntu-pro", "esm" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-PKG-014.json" }, { "id": "CB-UBU-SVC-001", "title": "Disable DHCP and DNS server services the system does not provide", "finding": "DHCP or DNS server services can run on a system that does not provide them", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "dhcp", "dns", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-001", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-001.json" }, { "id": "CB-UBU-SVC-002", "title": "Disable file transfer and file sharing server services the system does not provide", "finding": "FTP, TFTP, rsync or Samba servers can run on a system that does not provide them", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "ftp", "tftp", "rsync", "samba", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-002", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-002.json" }, { "id": "CB-UBU-SVC-003", "title": "Remove the NFS server and disable rpcbind when the system does not provide them", "finding": "The NFS server or rpcbind can run on a system that does not need them", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "nfs", "rpc", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-003", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-003.json" }, { "id": "CB-UBU-SVC-004", "title": "Disable LDAP and NIS directory server services the system does not provide", "finding": "An LDAP or NIS directory server can run on a system that does not provide one", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "ldap", "nis", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-004", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-004.json" }, { "id": "CB-UBU-SVC-005", "title": "Disable IMAP and POP3 mail access servers the system does not provide", "finding": "An IMAP or POP3 server can run on a system that does not provide mailboxes", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "mail", "imap", "pop3", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-005", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-005.json" }, { "id": "CB-UBU-SVC-006", "title": "Disable the SNMP agent and trap receiver when they are not used", "finding": "An SNMP agent or trap receiver can run on a system that is not monitored through SNMP", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "snmp", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-006.json" }, { "id": "CB-UBU-SVC-007", "title": "Remove telnet, rsh and talk servers and disable inetd super-servers", "finding": "Clear-text remote access servers or an inetd super-server are present", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "telnet", "rsh", "talk", "inetd", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-007", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-007.json" }, { "id": "CB-UBU-SVC-008", "title": "Disable web server services on systems that do not serve web content", "finding": "A web server can run on a system that does not serve web content", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "http", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-008", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-008.json" }, { "id": "CB-UBU-SVC-009", "title": "Disable the Squid web proxy on systems that are not proxy servers", "finding": "A web proxy can run on a system that is not a proxy server", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "proxy", "http", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-009", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-009.json" }, { "id": "CB-UBU-SVC-010", "title": "Restrict the mail transfer agent to local delivery", "finding": "The mail transfer agent accepts connections from the network", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "mail", "mta", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-010", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-010.json" }, { "id": "CB-UBU-SVC-011", "title": "Forward mail for root to a monitored mailbox", "finding": "Mail sent to root stays unread on the system", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "mail", "mta", "alerting" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-011", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-011.json" }, { "id": "CB-UBU-SVC-012", "title": "Only approved services listen on network interfaces", "finding": "Services nobody approved accept connections from the network", "severity": "medium", "status": "active", "assessment": "partial", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "services", "network", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-012.json" }, { "id": "CB-UBU-SVC-013", "title": "Remove clear-text network clients (NIS, rsh, talk, telnet, LDAP tools, FTP)", "finding": "Clients for clear-text or obsolete network protocols are installed", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "packages", "clients", "telnet", "rsh", "ftp", "nis", "ldap" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-013", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-013.json" }, { "id": "CB-UBU-SVC-014", "title": "Run exactly one time synchronization daemon", "finding": "The system clock is not synchronized, or several daemons fight over it", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "time", "ntp", "chrony", "timesyncd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-014", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-014.json" }, { "id": "CB-UBU-SVC-015", "title": "Configure systemd-timesyncd with approved time servers and keep it running", "finding": "systemd-timesyncd uses built-in fallback servers or is not running", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "time", "ntp", "timesyncd" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-015", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-015.json" }, { "id": "CB-UBU-SVC-016", "title": "Configure chrony with time sources, run it unprivileged and keep it running", "finding": "chrony has no time source, runs as root or is not running", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "time", "ntp", "chrony" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-016", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-016.json" }, { "id": "CB-UBU-SVC-017", "title": "Keep the cron daemon enabled and running", "finding": "The cron daemon is installed but not running", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "cron", "scheduling" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-017", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-017.json" }, { "id": "CB-UBU-SVC-018", "title": "Restrict the system crontab and cron directories to root", "finding": "Users can read the system cron jobs", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "cron", "permissions" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-018", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-018.json" }, { "id": "CB-UBU-SVC-019", "title": "Allow only listed users to schedule jobs with crontab and at", "finding": "Any local user can schedule jobs with crontab or at", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "cron", "at", "access-control", "persistence" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-019", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-019.json" }, { "id": "CB-UBU-SVC-020", "title": "Encrypt SSSD LDAP connections and verify the server certificate", "finding": "SSSD talks to the LDAP directory without TLS or without checking the server certificate", "severity": "high", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "sssd", "ldap", "tls", "authentication" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-020", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-020.json" }, { "id": "CB-UBU-SVC-021", "title": "Disable the autofs automounter", "finding": "The autofs automounter can mount file systems on demand", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "services", "autofs", "removable-media" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-021", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-021.json" }, { "id": "CB-UBU-SVC-022", "title": "Disable the Avahi mDNS/DNS-SD daemon", "finding": "Avahi announces the system and its services on the local network", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "services", "avahi", "mdns", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-022", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-022.json" }, { "id": "CB-UBU-SVC-023", "title": "Disable the CUPS print server and printer discovery", "finding": "The CUPS print service runs on a system that does not print", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server", "server-hardened", "desktop-hardened" ], "tags": [ "services", "cups", "printing", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-023", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-023.json" }, { "id": "CB-UBU-SVC-024", "title": "Remove the X Window System server and the GNOME display manager from servers", "finding": "An X Window System server or a graphical login manager is installed on a server", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "packages", "x11", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-024", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-024.json" }, { "id": "CB-UBU-SVC-025", "title": "Confine services with systemd sandboxing options", "finding": "Network-facing services run with the full privileges systemd gives by default", "severity": "medium", "status": "active", "assessment": "partial", "profiles": [ "server-hardened" ], "tags": [ "systemd", "sandboxing", "services", "least-privilege" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-025", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-025.json" }, { "id": "CB-UBU-SVC-026", "title": "Disable the kdump kernel crash dump service", "finding": "Kernel crash dumps are collected on the system", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "services", "kdump", "kernel", "data-exposure" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-026", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-026.json" }, { "id": "CB-UBU-SVC-027", "title": "Remove the NFS client utilities when no NFS share is mounted", "finding": "NFS client utilities are installed on a system that mounts no NFS share", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "packages", "nfs", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-027", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-027.json" }, { "id": "CB-UBU-SVC-028", "title": "Disable cloud-init once the server is provisioned", "finding": "cloud-init still runs at every boot on a provisioned server", "severity": "medium", "status": "active", "assessment": "automated", "profiles": [ "server-hardened" ], "tags": [ "services", "cloud-init", "provisioning", "attack-surface" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-028", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-028.json" }, { "id": "CB-UBU-SVC-029", "title": "Do not send usage data to Canonical (popularity-contest, ubuntu-report, ubuntu-insights)", "finding": "The system can send its package list or hardware details to Canonical", "severity": "low", "status": "active", "assessment": "automated", "profiles": [ "core", "server", "server-hardened", "desktop", "desktop-hardened" ], "tags": [ "privacy", "telemetry", "popularity-contest", "gdpr" ], "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-029", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-SVC-029.json" } ] }