CIS CentOS Linux 7 Benchmark

v2.2.0 - 12-27-2017

1 | P a g e

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike

4.0 International Public License. The link to the license terms can be found at

https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode

To further clarify the Creative Commons license related to CIS Benchmark content, you are

authorized to copy and redistribute the content for use by you, within your organization

and outside your organization for non-commercial purposes only, provided that (i)

appropriate credit is given to CIS, (ii) a link to the license is provided. Additionally, if you

remix, transform or build upon the CIS Benchmark(s), you may only distribute the modified

materials if they are subject to the same license terms as the original Benchmark license

and your derivative will no longer be a CIS Benchmark. Commercial use of CIS Benchmarks

is subject to the prior approval of the Center for Internet Security.

2 | P a g e

Table of Contents

Terms of Use ........................................................................................................................................................... 1

Overview ............................................................................................................................................................... 12

Intended Audience ........................................................................................................................................ 12

Consensus Guidance ..................................................................................................................................... 12

Typographical Conventions ...................................................................................................................... 14

Scoring Information ..................................................................................................................................... 14

Profile Definitions ......................................................................................................................................... 15

Acknowledgements ...................................................................................................................................... 17

Recommendations ............................................................................................................................................. 19

1 Initial Setup .................................................................................................................................................. 19

1.1 Filesystem Configuration ............................................................................................................... 19

1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored) .............................. 20

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)............................ 22

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored) ................................... 23

1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored) ...................................... 24

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored) ............................. 25

1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored) .......................... 26

1.1.1.7 Ensure mounting of udf filesystems is disabled (Scored) ..................................... 27

1.1.1.8 Ensure mounting of FAT filesystems is disabled (Scored) ................................... 28

1.1.2 Ensure separate partition exists for /tmp (Scored) .................................................... 30

1.1.3 Ensure nodev option set on /tmp partition (Scored) ................................................. 32

1.1.4 Ensure nosuid option set on /tmp partition (Scored) ................................................ 33

1.1.5 Ensure noexec option set on /tmp partition (Scored) ............................................... 34

1.1.6 Ensure separate partition exists for /var (Scored) ..................................................... 35

1.1.7 Ensure separate partition exists for /var/tmp (Scored) ........................................... 36

1.1.8 Ensure nodev option set on /var/tmp partition (Scored) ........................................ 38

1.1.9 Ensure nosuid option set on /var/tmp partition (Scored) ....................................... 39

1.1.10 Ensure noexec option set on /var/tmp partition (Scored) .................................... 40

1.1.11 Ensure separate partition exists for /var/log (Scored) .......................................... 41

3 | P a g e

1.1.12 Ensure separate partition exists for /var/log/audit (Scored) ............................. 43

1.1.13 Ensure separate partition exists for /home (Scored) .............................................. 45

1.1.14 Ensure nodev option set on /home partition (Scored) ........................................... 46

1.1.15 Ensure nodev option set on /dev/shm partition (Scored) .................................... 47

1.1.16 Ensure nosuid option set on /dev/shm partition (Scored) ................................... 48

1.1.17 Ensure noexec option set on /dev/shm partition (Scored) .................................. 49

1.1.18 Ensure nodev option set on removable media partitions (Not Scored) ........... 51

1.1.19 Ensure nosuid option set on removable media partitions (Not Scored) .......... 52

1.1.20 Ensure noexec option set on removable media partitions (Not Scored) ......... 53

1.1.21 Ensure sticky bit is set on all world-writable directories (Scored) .................... 54

1.1.22 Disable Automounting (Scored) ....................................................................................... 55

1.2 Configure Software Updates ......................................................................................................... 57

1.2.1 Ensure package manager repositories are configured (Not Scored) ................... 57

1.2.2 Ensure GPG keys are configured (Not Scored) .............................................................. 59

1.2.3 Ensure gpgcheck is globally activated (Scored) ........................................................... 60

1.3 Filesystem Integrity Checking ...................................................................................................... 61

1.3.1 Ensure AIDE is installed (Scored) ...................................................................................... 61

1.3.2 Ensure filesystem integrity is regularly checked (Scored) ....................................... 63

1.4 Secure Boot Settings ........................................................................................................................ 65

1.4.1 Ensure permissions on bootloader config are configured (Scored) ..................... 65

1.4.2 Ensure bootloader password is set (Scored) ................................................................. 67

1.4.3 Ensure authentication required for single user mode (Scored) ............................. 69

1.5 Additional Process Hardening ..................................................................................................... 71

1.5.1 Ensure core dumps are restricted (Scored) ................................................................... 71

1.5.2 Ensure XD/NX support is enabled (Not Scored) .......................................................... 73

1.5.3 Ensure address space layout randomization (ASLR) is enabled (Scored) ......... 75

1.5.4 Ensure prelink is disabled (Scored) .................................................................................. 77

1.6 Mandatory Access Control ............................................................................................................. 78

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration (Scored) ............ 80

1.6.1.2 Ensure the SELinux state is enforcing (Scored) ........................................................ 82

4 | P a g e

1.6.1.3 Ensure SELinux policy is configured (Scored) ........................................................... 83

1.6.1.4 Ensure SETroubleshoot is not installed (Scored) ..................................................... 84

1.6.1.5 Ensure the MCS Translation Service (mcstrans) is not installed (Scored) ..... 85

1.6.1.6 Ensure no unconfined daemons exist (Scored) ......................................................... 86

1.6.2 Ensure SELinux is installed (Scored) ................................................................................ 87

1.7 Warning Banners............................................................................................................................... 88

1.7.1.1 Ensure message of the day is configured properly (Scored) ............................... 89

1.7.1.2 Ensure local login warning banner is configured properly (Not Scored) ....... 91

1.7.1.3 Ensure remote login warning banner is configured properly (Not Scored) .. 93

1.7.1.4 Ensure permissions on /etc/motd are configured (Not Scored) ....................... 95

1.7.1.5 Ensure permissions on /etc/issue are configured (Scored) ................................ 96

1.7.1.6 Ensure permissions on /etc/issue.net are configured (Not Scored) ................ 97

1.7.2 Ensure GDM login banner is configured (Scored) ........................................................ 98

1.8 Ensure updates, patches, and additional security software are installed (Scored)

................................................................................................................................................................... 100

2 Services ........................................................................................................................................................ 101

2.1 inetd Services .................................................................................................................................... 102

2.1.1 Ensure chargen services are not enabled (Scored) ................................................... 102

2.1.2 Ensure daytime services are not enabled (Scored) ................................................... 104

2.1.3 Ensure discard services are not enabled (Scored) .................................................... 105

2.1.4 Ensure echo services are not enabled (Scored) .......................................................... 106

2.1.5 Ensure time services are not enabled (Scored) .......................................................... 107

2.1.6 Ensure tftp server is not enabled (Scored) ................................................................... 108

2.1.7 Ensure xinetd is not enabled (Scored) ........................................................................... 109

2.2 Special Purpose Services .............................................................................................................. 109

2.2.1.1 Ensure time synchronization is in use (Not Scored) ............................................. 110

2.2.1.2 Ensure ntp is configured (Scored) ................................................................................ 112

2.2.1.3 Ensure chrony is configured (Scored) ........................................................................ 114

2.2.2 Ensure X Window System is not installed (Scored) .................................................. 116

2.2.3 Ensure Avahi Server is not enabled (Scored) .............................................................. 117

2.2.4 Ensure CUPS is not enabled (Scored) ............................................................................. 118

5 | P a g e

2.2.5 Ensure DHCP Server is not enabled (Scored) .............................................................. 120

2.2.6 Ensure LDAP server is not enabled (Scored) ............................................................... 121

2.2.7 Ensure NFS and RPC are not enabled (Scored) ........................................................... 122

2.2.8 Ensure DNS Server is not enabled (Scored) ................................................................. 124

2.2.9 Ensure FTP Server is not enabled (Scored) .................................................................. 125

2.2.10 Ensure HTTP server is not enabled (Scored) ............................................................ 126

2.2.11 Ensure IMAP and POP3 server is not enabled (Scored) ........................................ 127

2.2.12 Ensure Samba is not enabled (Scored) ........................................................................ 128

2.2.13 Ensure HTTP Proxy Server is not enabled (Scored) ............................................... 129

2.2.14 Ensure SNMP Server is not enabled (Scored) ........................................................... 130

2.2.15 Ensure mail transfer agent is configured for local-only mode (Scored)......... 132

2.2.16 Ensure NIS Server is not enabled (Scored) ................................................................ 134

2.2.17 Ensure rsh server is not enabled (Scored) ................................................................. 135

2.2.18 Ensure telnet server is not enabled (Scored) ............................................................ 137

2.2.19 Ensure tftp server is not enabled (Scored) ................................................................ 138

2.2.20 Ensure rsync service is not enabled (Scored) ........................................................... 139

2.2.21 Ensure talk server is not enabled (Scored) ................................................................ 140

2.3 Service Clients .................................................................................................................................. 141

2.3.1 Ensure NIS Client is not installed (Scored) ................................................................... 141

2.3.2 Ensure rsh client is not installed (Scored) .................................................................... 143

2.3.3 Ensure talk client is not installed (Scored) ................................................................... 145

2.3.4 Ensure telnet client is not installed (Scored) ............................................................... 146

2.3.5 Ensure LDAP client is not installed (Scored) ............................................................... 148

3 Network Configuration .......................................................................................................................... 148

3.1 Network Parameters (Host Only) ............................................................................................. 150

3.1.1 Ensure IP forwarding is disabled (Scored) ................................................................... 150

3.1.2 Ensure packet redirect sending is disabled (Scored) ............................................... 152

3.2 Network Parameters (Host and Router) ................................................................................ 154

3.2.1 Ensure source routed packets are not accepted (Scored) ...................................... 154

3.2.2 Ensure ICMP redirects are not accepted (Scored) ..................................................... 156

6 | P a g e

3.2.3 Ensure secure ICMP redirects are not accepted (Scored) ...................................... 158

3.2.4 Ensure suspicious packets are logged (Scored) .......................................................... 160

3.2.5 Ensure broadcast ICMP requests are ignored (Scored) ........................................... 162

3.2.6 Ensure bogus ICMP responses are ignored (Scored) ................................................ 164

3.2.7 Ensure Reverse Path Filtering is enabled (Scored) ................................................... 166

3.2.8 Ensure TCP SYN Cookies is enabled (Scored) .............................................................. 168

3.3 IPv6 ....................................................................................................................................................... 170

3.3.1 Ensure IPv6 router advertisements are not accepted (Not Scored) ................... 170

3.3.2 Ensure IPv6 redirects are not accepted (Not Scored) .............................................. 172

3.3.3 Ensure IPv6 is disabled (Not Scored) ............................................................................. 174

3.4 TCP Wrappers ................................................................................................................................... 176

3.4.1 Ensure TCP Wrappers is installed (Scored) ................................................................. 176

3.4.2 Ensure /etc/hosts.allow is configured (Scored) ......................................................... 178

3.4.3 Ensure /etc/hosts.deny is configured (Scored) .......................................................... 179

3.4.4 Ensure permissions on /etc/hosts.allow are configured (Scored) ..................... 180

3.4.5 Ensure permissions on /etc/hosts.deny are configured (Scored) ...................... 181

3.5 Uncommon Network Protocols ................................................................................................. 182

3.5.1 Ensure DCCP is disabled (Not Scored) ........................................................................... 182

3.5.2 Ensure SCTP is disabled (Not Scored) ............................................................................ 184

3.5.3 Ensure RDS is disabled (Not Scored) .............................................................................. 185

3.5.4 Ensure TIPC is disabled (Not Scored) ............................................................................. 186

3.6 Firewall Configuration .................................................................................................................. 187

3.6.1 Ensure iptables is installed (Scored) ............................................................................... 187

3.6.2 Ensure default deny firewall policy (Scored) .............................................................. 189

3.6.3 Ensure loopback traffic is configured (Scored) .......................................................... 191

3.6.4 Ensure outbound and established connections are configured (Not Scored) 193

3.6.5 Ensure firewall rules exist for all open ports (Scored) ............................................ 195

3.7 Ensure wireless interfaces are disabled (Not Scored) ................................................. 197

4 Logging and Auditing ............................................................................................................................. 198

4.1 Configure System Accounting (auditd) ................................................................................... 199

7 | P a g e

4.1.1.1 Ensure audit log storage size is configured (Not Scored) ................................... 200

4.1.1.2 Ensure system is disabled when audit logs are full (Scored) ............................ 202

4.1.1.3 Ensure audit logs are not automatically deleted (Scored) .................................. 203

4.1.2 Ensure auditd service is enabled (Scored) ................................................................... 204

4.1.3 Ensure auditing for processes that start prior to auditd is enabled (Scored) 205

4.1.4 Ensure events that modify date and time information are collected (Scored)

................................................................................................................................................................... 207

4.1.5 Ensure events that modify user/group information are collected (Scored) ... 209

4.1.6 Ensure events that modify the system's network environment are collected

(Scored) ................................................................................................................................................. 211

4.1.7 Ensure events that modify the system's Mandatory Access Controls are

collected (Scored) .............................................................................................................................. 214

4.1.8 Ensure login and logout events are collected (Scored) ............................................ 216

4.1.9 Ensure session initiation information is collected (Scored) .................................. 218

4.1.10 Ensure discretionary access control permission modification events are

collected (Scored) .............................................................................................................................. 220

4.1.11 Ensure unsuccessful unauthorized file access attempts are collected (Scored)

................................................................................................................................................................... 223

4.1.12 Ensure use of privileged commands is collected (Scored)................................... 225

4.1.13 Ensure successful file system mounts are collected (Scored) ............................ 227

4.1.14 Ensure file deletion events by users are collected (Scored)................................ 229

4.1.15 Ensure changes to system administration scope (sudoers) is collected

(Scored) ................................................................................................................................................. 231

4.1.16 Ensure system administrator actions (sudolog) are collected (Scored) ........ 233

4.1.17 Ensure kernel module loading and unloading is collected (Scored) ................ 235

4.1.18 Ensure the audit configuration is immutable (Scored) ......................................... 237

4.2 Configure Logging ........................................................................................................................... 238

4.2.1.1 Ensure rsyslog Service is enabled (Scored) .............................................................. 239

4.2.1.2 Ensure logging is configured (Not Scored) ............................................................... 241

4.2.1.3 Ensure rsyslog default file permissions configured (Scored) ............................ 243

4.2.1.4 Ensure rsyslog is configured to send logs to a remote log host (Scored) ..... 245

8 | P a g e

4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts.

(Not Scored) ......................................................................................................................................... 247

4.2.2.1 Ensure syslog-ng service is enabled (Scored) .......................................................... 249

4.2.2.2 Ensure logging is configured (Not Scored) ............................................................... 251

4.2.2.3 Ensure syslog-ng default file permissions configured (Scored) ....................... 253

4.2.2.4 Ensure syslog-ng is configured to send logs to a remote log host (Not Scored)

................................................................................................................................................................... 254

4.2.2.5 Ensure remote syslog-ng messages are only accepted on designated log hosts

(Not Scored) ......................................................................................................................................... 256

4.2.3 Ensure rsyslog or syslog-ng is installed (Scored) ...................................................... 258

4.2.4 Ensure permissions on all logfiles are configured (Scored) .................................. 260

4.3 Ensure logrotate is configured (Not Scored) ................................................................... 261

5 Access, Authentication and Authorization ..................................................................................... 262

5.1 Configure cron .................................................................................................................................. 263

5.1.1 Ensure cron daemon is enabled (Scored) ..................................................................... 263

5.1.2 Ensure permissions on /etc/crontab are configured (Scored) ............................ 264

5.1.3 Ensure permissions on /etc/cron.hourly are configured (Scored)..................... 265

5.1.4 Ensure permissions on /etc/cron.daily are configured (Scored) ........................ 267

5.1.5 Ensure permissions on /etc/cron.weekly are configured (Scored) ................... 269

5.1.6 Ensure permissions on /etc/cron.monthly are configured (Scored) ................. 271

5.1.7 Ensure permissions on /etc/cron.d are configured (Scored) ............................... 273

5.1.8 Ensure at/cron is restricted to authorized users (Scored) .................................... 275

5.2 SSH Server Configuration ............................................................................................................. 277

5.2.1 Ensure permissions on /etc/ssh/sshd_config are configured (Scored) ............ 277

5.2.2 Ensure SSH Protocol is set to 2 (Scored) ....................................................................... 279

5.2.3 Ensure SSH LogLevel is set to INFO (Scored) .............................................................. 280

5.2.4 Ensure SSH X11 forwarding is disabled (Scored) ...................................................... 281

5.2.5 Ensure SSH MaxAuthTries is set to 4 or less (Scored) ............................................. 282

5.2.6 Ensure SSH IgnoreRhosts is enabled (Scored) ............................................................ 283

5.2.7 Ensure SSH HostbasedAuthentication is disabled (Scored) .................................. 284

5.2.8 Ensure SSH root login is disabled (Scored) .................................................................. 285

9 | P a g e

5.2.9 Ensure SSH PermitEmptyPasswords is disabled (Scored) ..................................... 286

5.2.10 Ensure SSH PermitUserEnvironment is disabled (Scored) ................................. 287

5.2.11 Ensure only approved MAC algorithms are used (Scored) .................................. 288

5.2.12 Ensure SSH Idle Timeout Interval is configured (Scored) ................................... 290

5.2.13 Ensure SSH LoginGraceTime is set to one minute or less (Scored).................. 292

5.2.14 Ensure SSH access is limited (Scored) ......................................................................... 293

5.2.15 Ensure SSH warning banner is configured (Scored) .............................................. 295

5.3 Configure PAM .................................................................................................................................. 296

5.3.1 Ensure password creation requirements are configured (Scored) .................... 296

5.3.2 Ensure lockout for failed password attempts is configured (Scored)................ 299

5.3.3 Ensure password reuse is limited (Scored).................................................................. 301

5.3.4 Ensure password hashing algorithm is SHA-512 (Scored) .................................... 303

5.4 User Accounts and Environment .............................................................................................. 304

5.4.1.1 Ensure password expiration is 365 days or less (Scored) .................................. 305

5.4.1.2 Ensure minimum days between password changes is 7 or more (Scored) . 307

5.4.1.3 Ensure password expiration warning days is 7 or more (Scored) .................. 309

5.4.1.4 Ensure inactive password lock is 30 days or less (Scored) ................................ 311

5.4.1.5 Ensure all users last password change date is in the past (Scored) ................ 313

5.4.2 Ensure system accounts are non-login (Scored) ........................................................ 314

5.4.3 Ensure default group for the root account is GID 0 (Scored) ................................ 316

5.4.4 Ensure default user umask is 027 or more restrictive (Scored) .......................... 317

5.4.5 Ensure default user shell timeout is 900 seconds or less (Scored) ..................... 319

5.5 Ensure root login is restricted to system console (Not Scored)............................... 321

5.6 Ensure access to the su command is restricted (Scored) ........................................... 322

6 System Maintenance ............................................................................................................................... 323

6.1 System File Permissions ............................................................................................................... 324

6.1.1 Audit system file permissions (Not Scored) ................................................................. 324

6.1.2 Ensure permissions on /etc/passwd are configured (Scored) ............................. 326

6.1.3 Ensure permissions on /etc/shadow are configured (Scored) ............................ 327

6.1.4 Ensure permissions on /etc/group are configured (Scored) ................................ 328

10 | P a g e

6.1.5 Ensure permissions on /etc/gshadow are configured (Scored) .......................... 329

6.1.6 Ensure permissions on /etc/passwd- are configured (Scored) ........................... 330

6.1.7 Ensure permissions on /etc/shadow- are configured (Scored) ........................... 331

6.1.8 Ensure permissions on /etc/group- are configured (Scored) .............................. 332

6.1.9 Ensure permissions on /etc/gshadow- are configured (Scored) ........................ 333

6.1.10 Ensure no world writable files exist (Scored) .......................................................... 334

6.1.11 Ensure no unowned files or directories exist (Scored) ......................................... 335

6.1.12 Ensure no ungrouped files or directories exist (Scored) ...................................... 336

6.1.13 Audit SUID executables (Not Scored) ........................................................................... 337

6.1.14 Audit SGID executables (Not Scored) ........................................................................... 338

6.2 User and Group Settings ............................................................................................................... 340

6.2.1 Ensure password fields are not empty (Scored) ........................................................ 340

6.2.2 Ensure no legacy "+" entries exist in /etc/passwd (Scored) ................................. 342

6.2.3 Ensure no legacy "+" entries exist in /etc/shadow (Scored) ................................. 343

6.2.4 Ensure no legacy "+" entries exist in /etc/group (Scored) .................................... 344

6.2.5 Ensure root is the only UID 0 account (Scored) .......................................................... 345

6.2.6 Ensure root PATH Integrity (Scored) ............................................................................. 346

6.2.7 Ensure all users' home directories exist (Scored) ..................................................... 348

6.2.8 Ensure users' home directories permissions are 750 or more restrictive

(Scored) ................................................................................................................................................. 349

6.2.9 Ensure users own their home directories (Scored) .................................................. 351

6.2.10 Ensure users' dot files are not group or world writable (Scored) .................... 353

6.2.11 Ensure no users have .forward files (Scored) ........................................................... 355

6.2.12 Ensure no users have .netrc files (Scored) ................................................................. 357

6.2.13 Ensure users' .netrc Files are not group or world accessible (Scored) ........... 359

6.2.14 Ensure no users have .rhosts files (Scored) ............................................................... 361

6.2.15 Ensure all groups in /etc/passwd exist in /etc/group (Scored) ....................... 363

6.2.16 Ensure no duplicate UIDs exist (Scored) .................................................................... 364

6.2.17 Ensure no duplicate GIDs exist (Scored) ..................................................................... 365

6.2.18 Ensure no duplicate user names exist (Scored) ....................................................... 367

6.2.19 Ensure no duplicate group names exist (Scored) .................................................... 368

11 | P a g e

Appendix: Summary Table ........................................................................................................................... 370

Appendix: Change History ............................................................................................................................ 378

12 | P a g e

Overview

This document provides prescriptive guidance for establishing a secure configuration

posture for CentOS Linux 7 systems running on x86 and x64 platforms. This document was

tested against CentOS 7.4.

The guidance within broadly assumes that operations are being performed as the root user.

Non-root users may not be able to access certain areas of the system, especially after

remediation has been performed. It is advisable to verify root users path integrity and the

integrity of any programs being run prior to execution of commands and scripts included in

this benchmark.

To obtain the latest version of this guide, please visit http://workbench.cisecurity.org. If

you have questions, comments, or have identified ways to improve this guide, please write

us at feedback@cisecurity.org.

Intended Audience

This benchmark is intended for system and application administrators, security specialists,

auditors, help desk, and platform deployment personnel who plan to develop, deploy,

assess, or secure solutions that incorporate Linux on a x86 platform.

Consensus Guidance

This benchmark was created using a consensus review process comprised of subject

matter experts. Consensus participants provide perspective from a diverse set of

backgrounds including consulting, software development, audit and compliance, security

research, operations, government, and legal.

Each CIS benchmark undergoes two phases of consensus review. The first phase occurs

during initial benchmark development. During this phase, subject matter experts convene

to discuss, create, and test working drafts of the benchmark. This discussion occurs until

consensus has been reached on benchmark recommendations. The second phase begins

after the benchmark has been published. During this phase, all feedback provided by the

Internet community is reviewed by the consensus team for incorporation in the

benchmark. If you are interested in participating in the consensus process, please visit

https://workbench.cisecurity.org/.

13 | P a g e

14 | P a g e

Typographical Conventions

The following typographical conventions are used throughout this guide:

Convention

Meaning

Stylized Monospace font

Used for blocks of code, command, and script examples.

Text should be interpreted exactly as presented.

Monospace font

Used for inline code, commands, or examples. Text should

be interpreted exactly as presented.

Italic texts set in angle brackets denote a variable

requiring substitution for a real value.

Italic font

Used to denote the title of a book, article, or other

publication.

Note

Additional information or caveats

Scoring Information

A scoring status indicates whether compliance with the given recommendation impacts the

assessed target's benchmark score. The following scoring statuses are used in this

benchmark:

Scored

Failure to comply with "Scored" recommendations will decrease the final benchmark score.

Compliance with "Scored" recommendations will increase the final benchmark score.

Not Scored

Failure to comply with "Not Scored" recommendations will not decrease the final

benchmark score. Compliance with "Not Scored" recommendations will not increase the

final benchmark score.

15 | P a g e

Profile Definitions

The following configuration profiles are defined by this Benchmark:

 Level 1 - Server

Items in this profile intend to:

o be practical and prudent;

o provide a clear security benefit; and

o not inhibit the utility of the technology beyond acceptable means.

This profile is intended for servers.

 Level 2 - Server

This profile extends the "Level 1 - Server" profile. Items in this profile exhibit one or

more of the following characteristics:

o are intended for environments or use cases where security is paramount.

o acts as defense in depth measure.

o may negatively inhibit the utility or performance of the technology.

This profile is intended for servers.

 Level 1 - Workstation

Items in this profile intend to:

o be practical and prudent;

o provide a clear security benefit; and

o not inhibit the utility of the technology beyond acceptable means.

This profile is intended for workstations.

 Level 2 - Workstation

This profile extends the "Level 1 - Workstation" profile. Items in this profile exhibit

one or more of the following characteristics:

o are intended for environments or use cases where security is paramount.

o acts as defense in depth measure.

o may negatively inhibit the utility or performance of the technology.

16 | P a g e

This profile is intended for workstations.

17 | P a g e

Acknowledgements

This benchmark exemplifies the great things a community of users, vendors, and subject matter

experts can accomplish through consensus collaboration. The CIS community thanks the entire

consensus team with special recognition to the following individuals who contributed greatly to

the creation of this guide:

This benchmark is based upon previous Linux benchmarks published and would not be

possible without the contributions provided over the history of all of these benchmarks

including the previous version of the CentOS and Red Hat benchmarks. The CIS community

thanks everyone who has contributed to the Linux benchmarks.

Contributor

Alan Guan

Algis Kibirkstis

Bill Erickson

Dave Billing

Dmitry Krayansky

Dominic Pace

Duncan Innes

Elliot Anderson

Ely Pinto

Fredrik Silverskär

Joy Latten

Kirill Antonenko

Koen Laevens

Marcelo Cerri

Mark Birch

Martynas Brijunas

Michael Palmer

Michel Verbraak

Mike Thompson

Mikhail Krylatykh

Pradeep R B, Intel

Rakesh Jain Research Engineer

Robert Thomas

Ron Colvin

18 | P a g e

Striker Leggette

Tom Pietschmann

Vineetha Hari Pai

William E. Triest Iii, The Ohio State University

Rael Daruszka , Center for Internet Security

Editor

Rael Daruszka , Center for Internet Security

Jonathan Lewis Christopherson

19 | P a g e

Recommendations

1 Initial Setup

Items in this section are advised for all systems, but may be difficult or require extensive

preparation after the initial setup of the system.

1.1 Filesystem Configuration

Directories that are used for system-wide functions can be further protected by placing

them on separate partitions. This provides protection for resource exhaustion and enables

the use of mounting options that are applicable to the directory's intended use. Users' data

can be stored on separate partitions and have stricter mount options. A user partition is a

filesystem that has been established for use by the users and does not contain software for

system operations.

The recommendations in this section are easier to perform during initial system

installation. If the system is already installed, it is recommended that a full backup be

performed before repartitioning the system.

Note: If you are repartitioning a system that has already been installed, make sure the data

has been copied over to the new partition, unmount it and then remove the data from the

directory that was in the old partition. Otherwise it will still consume space in the old

partition that will be masked when the new filesystem is mounted. For example, if a system

is in single-user mode with no filesystems mounted and the administrator adds a lot of data

to the /tmp directory, this data will still consume space in / once the /tmp filesystem is

mounted unless it is removed first.

20 | P a g e

1.1.1 Disable unused filesystems

A number of uncommon filesystem types are supported under Linux. Removing support for

unneeded filesystem types reduces the local attack surface of the system. If a filesystem

type is not needed it should be disabled. Native Linux file systems are designed to ensure

that built-in security controls function as expected. Non-native filesystems can lead to

unexpected consequences to both the security and functionality of the system and should

be used with caution. Many filesystems are created for niche use cases and are not

maintained and supported as the operating systems are updated and patched. Users of

non-native filesystems should ensure that there is attention and ongoing support for them,

especially in light of frequent operating system changes.

Standard network connectivity and Internet access to cloud storage may make the use of

non-standard filesystem formats to directly attach heterogeneous devices much less

attractive.

Note: This should not be considered a comprehensive list of filesystems. You may wish to

consider additions to those listed here for your environment.

1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small

footprint systems. A cramfs image can be used without having to first decompress the

image.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

server. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v cramfs

install /bin/true

21 | P a g e

# lsmod | grep cramfs

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install cramfs /bin/true

Run the following command to unload the cramfs module:

# rmmod cramfs

CIS Controls:

13 Data Protection

Data Protection

22 | P a g e

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The freevxfs filesystem type is a free version of the Veritas type filesystem. This is the

primary filesystem type for HP-UX operating systems.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v freevxfs

install /bin/true

# lsmod | grep freevxfs

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install freevxfs /bin/true

Run the following command to unload the freevxfs module:

# rmmod freevxfs

CIS Controls:

13 Data Protection

Data Protection

23 | P a g e

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used

in flash memory devices.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v jffs2

install /bin/true

# lsmod | grep jffs2

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install jffs2 /bin/true

Run the following command to unload the jffs2 module:

# rmmod jffs2

CIS Controls:

13 Data Protection

Data Protection

24 | P a g e

1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The hfs filesystem type is a hierarchical filesystem that allows you to mount Mac OS

filesystems.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v hfs

install /bin/true

# lsmod | grep hfs

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install hfs /bin/true

Run the following command to unload the hfs module:

# rmmod hfs

CIS Controls:

13 Data Protection

Data Protection

25 | P a g e

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The hfsplus filesystem type is a hierarchical filesystem designed to replace hfs that allows

you to mount Mac OS filesystems.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v hfsplus

install /bin/true

# lsmod | grep hfsplus

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install hfsplus /bin/true

Run the following command to unload the hfsplus module:

# rmmod hfsplus

CIS Controls:

13 Data Protection

Data Protection

26 | P a g e

1.1.1.6 Ensure mounting of squashfs filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The squashfs filesystem type is a compressed read-only Linux filesystem embedded in

small footprint systems (similar to cramfs ). A squashfs image can be used without having

to first decompress the image.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v squashfs

install /bin/true

# lsmod | grep squashfs

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install squashfs /bin/true

Run the following command to unload the squashfs module:

# rmmod squashfs

CIS Controls:

13 Data Protection

Data Protection

27 | P a g e

1.1.1.7 Ensure mounting of udf filesystems is disabled (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The udf filesystem type is the universal disk format used to implement ISO/IEC 13346 and

ECMA-167 specifications. This is an open vendor filesystem type for data storage on a

broad range of media. This filesystem type is necessary to support writing DVDs and newer

optical disc formats.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v udf

install /bin/true

# lsmod | grep udf

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install udf /bin/true

Run the following command to unload the udf module:

# rmmod udf

CIS Controls:

13 Data Protection

Data Protection

28 | P a g e

1.1.1.8 Ensure mounting of FAT filesystems is disabled (Scored)

Profile Applicability:

 Level 2 - Workstation

 Level 2 - Server

Description:

The FAT filesystem format is primarily used on older windows systems and portable USB

drives or flash modules. It comes in three types FAT12 , FAT16 , and FAT32 all of which are

supported by the vfat kernel module.

Rationale:

Removing support for unneeded filesystem types reduces the local attack surface of the

system. If this filesystem type is not needed, disable it.

Audit:

Run the following commands and verify the output is as indicated:

# modprobe -n -v vfat

install /bin/true

# lsmod | grep vfat

Remediation:

Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:

install vfat /bin/true

Run the following command to unload the vfat module:

# rmmod vfat

Impact:

FAT filesystems are often used on portable USB sticks and other flash media are commonly

used to transfer files between workstations, removing VFAT support may prevent the

ability to transfer files in this way.

29 | P a g e

Disabling the vfat module can prevent boot on UEFI systems.

CIS Controls:

13 Data Protection

Data Protection

30 | P a g e

1.1.2 Ensure separate partition exists for /tmp (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The /tmp directory is a world-writable directory used for temporary storage by all users

and some applications.

Rationale:

Since the /tmp directory is intended to be world-writable, there is a risk of resource

exhaustion if it is not bound to a separate partition. In addition, making /tmp its own file

system allows an administrator to set the noexec option on the mount, making /tmp useless

for an attacker to install executable code. It would also prevent an attacker from

establishing a hardlink to a system setuid program and wait for it to be updated. Once the

program was updated, the hardlink would be broken and the attacker would have his own

copy of the program. If the program happened to have a security vulnerability, the attacker

could continue to exploit the known flaw.

Audit:

Run the following command and verify output shows /tmp is mounted:

# mount | grep /tmp

tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /tmp .

For systems that were previously installed, create a new partition for /tmp if not using

tmpfs .

Run the following commands to enable systemd /tmp mounting:

systemctl unmask tmp.mount

systemctl enable tmp.mount

31 | P a g e

Edit /etc/systemd/system/local-fs.target.wants/tmp.mount to configure the /tmp

mount:

[Mount]

What=tmpfs

Where=/tmp

Type=tmpfs

Options=mode=1777,strictatime,noexec,nodev,nosuid

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

References:

1. AJ Lewis, "LVM HOWTO", http://tldp.org/HOWTO/LVM-HOWTO/

32 | P a g e

1.1.3 Ensure nodev option set on /tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nodev mount option specifies that the filesystem cannot contain special devices.

Rationale:

Since the /tmp filesystem is not intended to support devices, set this option to ensure that

users cannot attempt to create block or character special devices in /tmp .

Audit:

If a /tmp partition exists run the following command and verify that the nodev option is set

on /tmp:

# mount | grep /tmp

tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit /etc/systemd/system/local-fs.target.wants/tmp.mount to add nodev to the /tmp

mount options:

[Mount]

Options=mode=1777,strictatime,noexec,nodev,nosuid

Run the following command to remount /tmp :

# mount -o remount,nodev /tmp

33 | P a g e

1.1.4 Ensure nosuid option set on /tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nosuid mount option specifies that the filesystem cannot contain setuid files.

Rationale:

Since the /tmp filesystem is only intended for temporary file storage, set this option to

ensure that users cannot create setuid files in /tmp .

Audit:

If a /tmp partition exists run the following command and verify that the nosuid option is set

on /tmp:

# mount | grep /tmp

tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit /etc/systemd/system/local-fs.target.wants/tmp.mount to add nosuid to the /tmp

mount options:

[Mount]

Options=mode=1777,strictatime,noexec,nodev,nosuid

Run the following command to remount /tmp :

# mount -o remount,nosuid /tmp

34 | P a g e

1.1.5 Ensure noexec option set on /tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale:

Since the /tmp filesystem is only intended for temporary file storage, set this option to

ensure that users cannot run executable binaries from /tmp .

Audit:

If a /tmp partition exists run the following command and verify that the noexec option is set

on /tmp:

# mount | grep /tmp

tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit /etc/systemd/system/local-fs.target.wants/tmp.mount to add noexec to the /tmp

mount options:

[Mount]

Options=mode=1777,strictatime,noexec,nodev,nosuid

Run the following command to remount /tmp :

# mount -o remount,noexec /tmp

CIS Controls:

2 Inventory of Authorized and Unauthorized Software

Inventory of Authorized and Unauthorized Software

35 | P a g e

1.1.6 Ensure separate partition exists for /var (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The /var directory is used by daemons and other system services to temporarily store

dynamic data. Some directories created by these processes may be world-writable.

Rationale:

Since the /var directory may contain world-writable files and directories, there is a risk of

resource exhaustion if it is not bound to a separate partition.

Audit:

Run the following command and verify output shows /var is mounted:

# mount | grep /var

/dev/xvdg1 on /var type ext4 (rw,relatime,data=ordered)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /var .

For systems that were previously installed, create a new partition and configure

/etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

References:

1. AJ Lewis, "LVM HOWTO", http://tldp.org/HOWTO/LVM-HOWTO/

36 | P a g e

1.1.7 Ensure separate partition exists for /var/tmp (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The /var/tmp directory is a world-writable directory used for temporary storage by all

users and some applications.

Rationale:

Since the /var/tmp directory is intended to be world-writable, there is a risk of resource

exhaustion if it is not bound to a separate partition. In addition, making /var/tmp its own

file system allows an administrator to set the noexec option on the mount, making

/var/tmp useless for an attacker to install executable code. It would also prevent an

attacker from establishing a hardlink to a system setuid program and wait for it to be

updated. Once the program was updated, the hardlink would be broken and the attacker

would have his own copy of the program. If the program happened to have a security

vulnerability, the attacker could continue to exploit the known flaw.

Audit:

Run the following command and verify output shows /var/tmp is mounted:

# mount | grep /var/tmp

<device> on /var/tmp type ext4 (rw,nosuid,nodev,noexec,relatime)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /var/tmp .

For systems that were previously installed, create a new partition and configure

/etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

37 | P a g e

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

38 | P a g e

1.1.8 Ensure nodev option set on /var/tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nodev mount option specifies that the filesystem cannot contain special devices.

Rationale:

Since the /var/tmp filesystem is not intended to support devices, set this option to ensure

that users cannot attempt to create block or character special devices in /var/tmp .

Audit:

If a /var/tmp partition exists run the following command and verify that the nodev option is

set on /var/tmp .

# mount | grep /var/tmp

tmpfs on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the

/var/tmp partition. See the fstab(5) manual page for more information.

Run the following command to remount /var/tmp :

# mount -o remount,nodev /var/tmp

39 | P a g e

1.1.9 Ensure nosuid option set on /var/tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nosuid mount option specifies that the filesystem cannot contain setuid files.

Rationale:

Since the /var/tmp filesystem is only intended for temporary file storage, set this option to

ensure that users cannot create setuid files in /var/tmp .

Audit:

If a /var/tmp partition exists run the following command and verify that the nosuid option

is set on /var/tmp .

# mount | grep /var/tmp

tmpfs on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add nosuid to the fourth field (mounting options) for the

/var/tmp partition. See the fstab(5) manual page for more information.

Run the following command to remount /var/tmp :

# mount -o remount,nosuid /var/tmp

40 | P a g e

1.1.10 Ensure noexec option set on /var/tmp partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale:

Since the /var/tmp filesystem is only intended for temporary file storage, set this option to

ensure that users cannot run executable binaries from /var/tmp .

Audit:

If a /var/tmp partition exists run the following command and verify that the noexec option

is set on /var/tmp .

# mount | grep /var/tmp

tmpfs on /var/tmp type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add noexec to the fourth field (mounting options) for the

/var/tmp partition. See the fstab(5) manual page for more information.

Run the following command to remount /var/tmp :

# mount -o remount,noexec /var/tmp

CIS Controls:

2 Inventory of Authorized and Unauthorized Software

Inventory of Authorized and Unauthorized Software

41 | P a g e

1.1.11 Ensure separate partition exists for /var/log (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The /var/log directory is used by system services to store log data .

Rationale:

There are two important reasons to ensure that system logs are stored on a separate

partition: protection against resource exhaustion (since logs can grow quite large) and

protection of audit data.

Audit:

Run the following command and verify output shows /var/log is mounted:

# mount | grep /var/log

/dev/xvdh1 on /var/log type ext4 (rw,relatime,data=ordered)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /var/log .

For systems that were previously installed, create a new partition and configure

/etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

References:

1. AJ Lewis, "LVM HOWTO", http://tldp.org/HOWTO/LVM-HOWTO/

CIS Controls:

42 | P a g e

6.3 Ensure Audit Logging Systems Are Not Subject To Loss (i.e. rotation/archive)

Ensure that all systems that store logs have adequate storage space for the logs generated

on a regular basis, so that log files will not fill up between log rotation intervals. The logs

must be archived and digitally signed on a periodic basis.

43 | P a g e

1.1.12 Ensure separate partition exists for /var/log/audit (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The auditing daemon, auditd , stores log data in the /var/log/audit directory.

Rationale:

There are two important reasons to ensure that data gathered by auditd is stored on a

separate partition: protection against resource exhaustion (since the audit.log file can

grow quite large) and protection of audit data. The audit daemon calculates how much free

space is left and performs actions based on the results. If other processes (such as syslog )

consume space in the same partition as auditd , it may not perform as desired.

Audit:

Run the following command and verify output shows /var/log/audit is mounted:

# mount | grep /var/log/audit

/dev/xvdi1 on /var/log/audit type ext4 (rw,relatime,data=ordered)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /var/log/audit .

For systems that were previously installed, create a new partition and configure

/etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

References:

1. AJ Lewis, "LVM HOWTO", http://tldp.org/HOWTO/LVM-HOWTO/

44 | P a g e

CIS Controls:

6.3 Ensure Audit Logging Systems Are Not Subject To Loss (i.e. rotation/archive)

Ensure that all systems that store logs have adequate storage space for the logs generated

on a regular basis, so that log files will not fill up between log rotation intervals. The logs

must be archived and digitally signed on a periodic basis.

45 | P a g e

1.1.13 Ensure separate partition exists for /home (Scored)

Profile Applicability:

 Level 2 - Server

 Level 2 - Workstation

Description:

The /home directory is used to support disk storage needs of local users.

Rationale:

If the system is intended to support local users, create a separate partition for the /home

directory to protect against resource exhaustion and restrict the type of files that can be

stored under /home .

Audit:

Run the following command and verify output shows /home is mounted:

# mount | grep /home

/dev/xvdf1 on /home type ext4 (rw,nodev,relatime,data=ordered)

Remediation:

For new installations, during installation create a custom partition setup and specify a

separate partition for /home .

For systems that were previously installed, create a new partition and configure

/etc/fstab as appropriate.

Impact:

Resizing filesystems is a common activity in cloud-hosted servers. Separate filesystem

partitions may prevent successful resizing, or may require the installation of additional

tools solely for the purpose of resizing operations. The use of these additional tools may

introduce their own security considerations.

References:

1. AJ Lewis, "LVM HOWTO", http://tldp.org/HOWTO/LVM-HOWTO/

46 | P a g e

1.1.14 Ensure nodev option set on /home partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nodev mount option specifies that the filesystem cannot contain special devices.

Rationale:

Since the user partitions are not intended to support devices, set this option to ensure that

users cannot attempt to create block or character special devices.

Audit:

If a /home partition exists run the following command and verify that the nodev option is set

on /home .

# mount | grep /home

/dev/xvdf1 on /home type ext4 (rw,nodev,relatime,data=ordered)

Remediation:

Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the /home

partition. See the fstab(5) manual page for more information.

# mount -o remount,nodev /home

Notes:

The actions in this recommendation refer to the /homepartition, which is the default user

partition that is defined. If you have created other user partitions, it is recommended that

the Remediation and Audit steps be applied to these partitions as well.

47 | P a g e

1.1.15 Ensure nodev option set on /dev/shm partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nodev mount option specifies that the filesystem cannot contain special devices.

Rationale:

Since the /dev/shm filesystem is not intended to support devices, set this option to ensure

that users cannot attempt to create special devices in /dev/shm partitions.

Audit:

Run the following command and verify that the nodev option is set on /dev/shm .

# mount | grep /dev/shm

tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add nodev to the fourth field (mounting options) for the

/dev/shm partition. See the fstab(5) manual page for more information.

Run the following command to remount /dev/shm :

# mount -o remount,nodev /dev/shm

Notes:

/dev/shm is not specified in /etc/fstab despite being mounted by default. The following

line will implement the recommended /dev/shm mount options in /etc/fstab:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

48 | P a g e

1.1.16 Ensure nosuid option set on /dev/shm partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nosuid mount option specifies that the filesystem cannot contain setuid files.

Rationale:

Setting this option on a file system prevents users from introducing privileged programs

onto the system and allowing non-root users to execute them.

Audit:

Run the following command and verify that the no suid option is set on /dev/shm .

# mount | grep /dev/shm

tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add nosuid to the fourth field (mounting options) for the

/dev/shm partition. See the fstab(5) manual page for more information.

Run the following command to remount /dev/shm :

# mount -o remount,nosuid /dev/shm

Notes:

/dev/shm is not specified in /etc/fstab despite being mounted by default. The following

line will implement the recommended /dev/shm mount options in /etc/fstab:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

49 | P a g e

1.1.17 Ensure noexec option set on /dev/shm partition (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale:

Setting this option on a file system prevents users from executing programs from shared

memory. This deters users from introducing potentially malicious software on the system.

Audit:

Run the following command and verify that the noexec option is set on /dev/shm .

# mount | grep /dev/shm

tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime)

Remediation:

Edit the /etc/fstab file and add noexec to the fourth field (mounting options) for the

/dev/shm partition. See the fstab(5) manual page for more information.

Run the following command to remount /dev/shm :

# mount -o remount,noexec /dev/shm

Notes:

/dev/shm is not specified in /etc/fstab despite being mounted by default. The following

line will implement the recommended /dev/shm mount options in /etc/fstab:

tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0

CIS Controls:

50 | P a g e

2 Inventory of Authorized and Unauthorized Software

Inventory of Authorized and Unauthorized Software

51 | P a g e

1.1.18 Ensure nodev option set on removable media partitions (Not

Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nodev mount option specifies that the filesystem cannot contain special devices.

Rationale:

Removable media containing character and block special devices could be used to

circumvent security controls by allowing non-root users to access sensitive device files

such as /dev/kmem or the raw disk partitions.

Audit:

Run the following command and verify that the nodev option is set on all removable media

partitions.

# mount

Remediation:

Edit the /etc/fstab file and add nodev to the fourth field (mounting options) of all

removable media partitions. Look for entries that have mount points that contain words

such as floppy or cdrom. See the fstab(5) manual page for more information.

52 | P a g e

1.1.19 Ensure nosuid option set on removable media partitions (Not

Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The nosuid mount option specifies that the filesystem cannot contain setuid files.

Rationale:

Setting this option on a file system prevents users from introducing privileged programs

onto the system and allowing non-root users to execute them.

Audit:

Run the following command and verify that the nosuid option is set on all removable media

partitions.

# mount

Remediation:

Edit the /etc/fstab file and add nosuid to the fourth field (mounting options) of all

removable media partitions. Look for entries that have mount points that contain words

such as floppy or cdrom. See the fstab(5) manual page for more information.

53 | P a g e

1.1.20 Ensure noexec option set on removable media partitions (Not

Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The noexec mount option specifies that the filesystem cannot contain executable binaries.

Rationale:

Setting this option on a file system prevents users from executing programs from the

removable media. This deters users from being able to introduce potentially malicious

software on the system.

Audit:

Run the following command and verify that the noexec option is set on all removable media

partitions.

# mount

Remediation:

Edit the /etc/fstab file and add noexec to the fourth field (mounting options) of all

removable media partitions. Look for entries that have mount points that contain words

such as floppy or cdrom. See the fstab(5) manual page for more information.

CIS Controls:

8 Malware Defenses

Malware Defenses

54 | P a g e

1.1.21 Ensure sticky bit is set on all world-writable directories (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

Setting the sticky bit on world writable directories prevents users from deleting or

renaming files in that directory that are not owned by them.

Rationale:

This feature prevents the ability to delete or rename files in world writable directories

(such as /tmp ) that are owned by another user.

Audit:

Run the following command to verify no world writable directories exist without the sticky

bit set:

# df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev

-type d $ -perm -0002 -a ! -perm -1000 $ 2>/dev/null

No output should be returned.

Remediation:

Run the following command to set the sticky bit on all world writable directories:

# df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev

-type d -perm -0002 2>/dev/null | xargs chmod a+t

Notes:

Some distributions may not support the --local option to df.

CIS Controls:

13 Data Protection

Data Protection

55 | P a g e

1.1.22 Disable Automounting (Scored)

Profile Applicability:

 Level 1 - Server

 Level 2 - Workstation

Description:

autofs allows automatic mounting of devices, typically including CD/DVDs and USB drives.

Rationale:

With automounting enabled anyone with physical access could attach a USB drive or disc

and have its contents available in system even if they lacked permissions to mount it

themselves.

Audit:

Run the following command and verify result is not "enabled":

# systemctl is-enabled autofs

disabled

Remediation:

Run the following command to disable autofs :

# systemctl disable autofs

Impact:

The use portable hard drives is very common for workstation users. If your organization

allows the use of portable storage or media on workstations and physical access controls to

workstations is considered adequate there is little value add in turning off automounting.

Notes:

This control should align with the tolerance of the use of portable drives and optical media

in the organization. On a server requiring an admin to manually mount media can be part

of defense-in-depth to reduce the risk of unapproved software or information being

introduced or proprietary software or information being exfiltrated. If admins commonly

56 | P a g e

use flash drives and Server access has sufficient physical controls, requiring manual

mounting may not increase security.

CIS Controls:

8.3 Limit Use Of External Devices (i.e. USB)

Limit use of external devices to those with an approved, documented business need.

Monitor for use and attempted use of external devices. Configure laptops, workstations,

and servers so that they will not auto-run content from removable media, like USB tokens

(i.e., “thumb drives”), USB hard drives, CDs/DVDs, FireWire devices, external serial

advanced technology attachment devices, and mounted network shares. Configure systems

so that they automatically conduct an anti-malware scan of removable media when

inserted.

57 | P a g e

1.2 Configure Software Updates

CentOS 7 uses yum to install and update software packages. Patch management procedures

may vary widely between enterprises. Large enterprises may choose to install a local

updates server that can be used in place of CentOS's servers, whereas a single deployment

of a system may prefer to get updates directly. Updates can be performed automatically or

manually, depending on the site's policy for patch management. Many large enterprises

prefer to test patches on a non-production system before rolling out to production.

For the purpose of this benchmark, the requirement is to ensure that a patch management

system is configured and maintained. The specifics on patch update procedures are left to

the organization.

1.2.1 Ensure package manager repositories are configured (Not Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

Systems need to have package manager repositories configured to ensure they receive the

latest patches and updates.

Rationale:

If a system's package repositories are misconfigured important patches may not be

identified or a rogue repository could introduce compromised software.

Audit:

Run the following command and verify repositories are configured correctly:

# yum repolist

Remediation:

Configure your package manager repositories according to site policy.

CIS Controls:

58 | P a g e

4.5 Use Automated Patch Management And Software Update Tools

Deploy automated patch management tools and software update tools for operating system

and software/applications on all systems for which such tools are available and safe.

Patches should be applied to all systems, even systems that are properly air gapped.

59 | P a g e

1.2.2 Ensure GPG keys are configured (Not Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

Most packages managers implement GPG key signing to verify package integrity during

installation.

Rationale:

It is important to ensure that updates are obtained from a valid source to protect against

spoofing that could lead to the inadvertent installation of malware on the system.

Audit:

Run the following command and verify GPG keys are configured correctly:

# rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} --> %{summary}\n'

Remediation:

Update your package manager GPG keys in accordance with site policy.

CIS Controls:

4.5 Use Automated Patch Management And Software Update Tools

Deploy automated patch management tools and software update tools for operating system

and software/applications on all systems for which such tools are available and safe.

Patches should be applied to all systems, even systems that are properly air gapped.

60 | P a g e

1.2.3 Ensure gpgcheck is globally activated (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

The gpgcheck option, found in the main section of the /etc/yum.conf and individual

/etc/yum/repos.d/* files determines if an RPM package's signature is checked prior to its

installation.

Rationale:

It is important to ensure that an RPM's package signature is always checked prior to

installation to ensure that the software is obtained from a trusted source.

Audit:

Run the following command and verify gpgcheck is set to ' 1 ':

# grep ^gpgcheck /etc/yum.conf

gpgcheck=1

Run the following command and verify that all instances of gpgcheck returned are set to ' 1

# grep ^gpgcheck /etc/yum.repos.d/*

Remediation:

Edit /etc/yum.conf and set 'gpgcheck=1' in the [main] section.

Edit any failing files in /etc/yum.repos.d/* and set all instances of gpgcheck to '1'.

CIS Controls:

4.5 Use Automated Patch Management And Software Update Tools

Deploy automated patch management tools and software update tools for operating system

and software/applications on all systems for which such tools are available and safe.

Patches should be applied to all systems, even systems that are properly air gapped.

61 | P a g e

1.3 Filesystem Integrity Checking

AIDE is a file integrity checking tool, similar in nature to Tripwire. While it cannot prevent

intrusions, it can detect unauthorized changes to configuration files by alerting when the

files are changed. When setting up AIDE, decide internally what the site policy will be

concerning integrity checking. Review the AIDE quick start guide and AIDE documentation

before proceeding.

1.3.1 Ensure AIDE is installed (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

AIDE takes a snapshot of filesystem state including modification times, permissions, and

file hashes which can then be used to compare against the current state of the filesystem to

detect modifications to the system.

Rationale:

By monitoring the filesystem state compromised files can be detected to prevent or limit

the exposure of accidental or malicious misconfigurations or modified binaries.

Audit:

Run the following command and verify aide is installed:

# rpm -q aide

aide-<version>

Remediation:

Run the following command to install aide :

# yum install aide

Configure AIDE as appropriate for your environment. Consult the AIDE documentation for

options.

Initialize AIDE:

62 | P a g e

# aide --init

# mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

References:

1. AIDE stable manual: http://aide.sourceforge.net/stable/manual.html

Notes:

The prelinking feature can interfere with AIDE because it alters binaries to speed up their

start up times. Run prelink -uato restore the binaries to their prelinked state, thus

avoiding false positives from AIDE.

CIS Controls:

3.5 Use File Integrity Tools For Critical System Files

Use file integrity checking tools to ensure that critical system files (including sensitive

system and application executables, libraries, and configurations) have not been altered.

The reporting system should: have the ability to account for routine and expected changes;

highlight and alert on unusual or unexpected alterations; show the history of configuration

changes over time and identify who made the change (including the original logged-in

account in the event of a user ID switch, such as with the su or sudo command). These

integrity checks should identify suspicious system alterations such as: owner and

permissions changes to files or directories; the use of alternate data streams which could

be used to hide malicious activities; and the introduction of extra files into key system

areas (which could indicate malicious payloads left by attackers or additional files

inappropriately added during batch distribution processes).

63 | P a g e

1.3.2 Ensure filesystem integrity is regularly checked (Scored)

Profile Applicability:

 Level 1 - Server

 Level 1 - Workstation

Description:

Periodic checking of the filesystem integrity is needed to detect changes to the filesystem.

Rationale:

Periodic file checking allows the system administrator to determine on a regular basis if

critical files have been changed in an unauthorized fashion.

Audit:

Run the following commands to determine if there is a cron job scheduled to run the aide

check.

# crontab -u root -l | grep aide

# grep -r aide /etc/cron.* /etc/crontab

Ensure a cron job in compliance with site policy is returned.

Remediation:

Run the following command:

# crontab -u root -e

Add the following line to the crontab:

0 5 * * * /usr/sbin/aide --check

Notes:

The checking in this recommendation occurs every day at 5am. Alter the frequency and

time of the checks in compliance with site policy.

CIS Controls:

64 | P a g e