CIS Compliance

CIS® (Center for Internet Security, Inc.) is a forward-thinking, non-profit entity that harnesses the power of a global IT community to safeguard private and public organizations against cyber threats.

The CIS Controls™ and CIS Benchmarks™ are the global standard and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continuously refined and verified by a volunteer, global community of experienced IT professionals.

Over time we have seen more and more customers asking for CIS hardening details on the Snare v8 install. The v7 of Snare Central used STIG and some CIS technical controls. For v8 of Snare Central it now has full coverage of the CIS controls which extended the STIG technical controls. The cisecurity.org site provides a multitude of security review and hardening build standards for many operating systems. The STIG hardening controls for Snare Central v8 are based on https://www.stigviewer.com/stig/canonical_ubuntu_18.04_lts/

The CIS Benchmark for Ubuntu Linux provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 18.04 LTS systems running on x86 and x64 platforms. Many lists include filesystem types, services, clients, and network protocols. Not all items in these lists are guaranteed to exist on all distributions and additional similar items may exist which should be considered in addition to those explicitly mentioned. The full document can be reviewed on the cisecurity.org site.

Note

CIS requires auditd to be enabled in the system for it to be compliant. Snare Central enables the auditing system only when STIG compliance is enabled, hence it is required that STIG be enabled for the Snare Central to be fully CIS compliant.

We used Nessus vulnerability scanner for a CIS compliance assessment on Snare Central. The following table lists all Nessus benchmark items that are assessed:


chapter	section	index	title	v8.x.x enabled
1			Initial Setup
	1.1		Filesystem Configuration
		1.1.1.1	Ensure mounting of cramfs filesystems is disabled	always
		1.1.1.2	Ensure mounting of freevxfs filesystems is disabled	always
		1.1.1.3	Ensure mounting of jffs2 filesystems is disabled	always
		1.1.1.4	Ensure mounting of hfs filesystems is disabled	always
		1.1.1.5	Ensure mounting of hfsplus filesystems is disabled	always
		1.1.1.6	Ensure mounting of udf filesystems is disabled	always
		1.1.2	Ensure separate partition exists for /tmp	always
		1.1.3	Ensure nodev option set on /tmp partition	always
		1.1.4	Ensure nosuid option set on /tmp partition	always
		1.1.5	Ensure separate partition exists for /var	always
		1.1.6	Ensure separate partition exists for /var/tmp	always
		1.1.7	Ensure nodev option set on /var/tmp partition	always
		1.1.8	Ensure nosuid option set on /var/tmp partition	always
		1.1.9	Ensure noexec option set on /var/tmp partition	always
		1.1.10	Ensure separate partition exists for /var/log	always
		1.1.11	Ensure separate partition exists for /var/log/audit	always
		1.1.12	Ensure separate partition exists for /home	always
		1.1.13	Ensure nodev option set on /home partition	always
		1.1.14	Ensure nodev option set on /dev/shm partition (/run)	always
		1.1.15	Ensure nosuid option set on /dev/shm partition (/run)	always
		1.1.16	Ensure noexec option set on /dev/shm partition (/run)	always
		1.1.17	Ensure nodev option set on removable media partitions	always
		1.1.18	Ensure nosuid option set on removable media partitions	always
		1.1.19	Ensure noexec option set on removable media partitions	always
		1.1.20	Ensure sticky bit is set on all world-writable directories	always
		1.1.21	Disable Automounting	always
	1.2		Configure Software Updates
		1.2.1	Ensure package manager repositories are configured	always
		1.2.2	Ensure GPG keys are configured	always
	1.3		Filesystem Integrity Checking
		1.3.1	Ensure AIDE is installed	always
		1.3.2	Ensure filesystem integrity is regularly checked	always
	1.4		Secure Boot Settings
		1.4.1	Ensure permissions on bootloader config are configured	always
		1.4.2	Ensure bootloader password is set	Customer to set see below notes
		1.4.3	Ensure authentication required for single user mode	always
	1.5		Additional Process Hardening
		1.5.1	Ensure core dumps are restricted	always
		1.5.2	Ensure XD/NX support is enabled	always
		1.5.3	Ensure address space layout randomization (ASLR) is enabled	always
		1.5.4	Ensure prelink is disabled	always
	1.6		Mandatory Access Control
		1.6.1.1	Ensure SELinux is not disabled in bootloader configuration	always
		1.6.1.2	Ensure the SELinux state is enforcing	always
		1.6.1.3	Ensure SELinux policy is configured	always
		1.6.1.4	Ensure no unconfined daemons exist	always
		1.6.2.1	Ensure AppArmor is not disabled in bootloader configuration	always
		1.6.2.2	Ensure all AppArmor Profiles are enforcing	always
		1.6.3	Ensure SELinux or AppArmor are installed	always
	1.7		Warning Banners
		1.7.1.1	Ensure message of the day is configured properly	always
		1.7.1.2	Ensure local login warning banner is configured properly	always
		1.7.1.3	Ensure remote login warning banner is configured properly	always
		1.7.1.4	Ensure permissions on /etc/motd are configured	always
		1.7.1.5	Ensure permissions on /etc/issue are configured	always
		1.7.1.6	Ensure permissions on /etc/issue.net are configured	always
		1.7.2	Ensure GDM login banner is configured	always
	1.8		Ensure updates patches and additional security software are installed	Snare Central patches the system with OS and security updates with each new release.

2			Services
	2.1		inetd Services
		2.1.1	Ensure chargen services are not enabled	always
		2.1.2	Ensure daytime services are not enabled	always
		2.1.3	Ensure discard services are not enabled	always
		2.1.4	Ensure echo services are not enabled	always
		2.1.5	Ensure time services are not enabled	always
		2.1.6	Ensure rsh server is not enabled	always
		2.1.7	Ensure talk server is not enabled	always
		2.1.8	Ensure telnet server is not enabled	always
		2.1.9	Ensure tftp server is not enabled	always
		2.1.10	Ensure xinetd is not enabled	always
		2.1.11	Ensure openbsd-inetd is not installed	always
	2.2		Special Purpose Services
		2.2.1.1	Ensure time synchronization is in use	false positive
		2.2.1.2	Ensure ntp is configured	always
		2.2.1.3	Ensure chrony is configured	false positive
		2.2.2	Ensure X Window System is not installed	always
		2.2.3	Ensure Avahi Server is not enabled	always
		2.2.4	Ensure CUPS is not enabled	always
		2.2.5	Ensure DHCP Server is not enabled	always
		2.2.6	Ensure LDAP server is not enabled	always
		2.2.7	Ensure NFS and RPC are not enabled	false positive
		2.2.8	Ensure DNS Server is not enabled	always
		2.2.9	Ensure FTP Server is not enabled	always
		2.2.10	Ensure HTTP server is not enabled	The website redirects from HTTP to HTTPS on login page
		2.2.11	Ensure IMAP and POP3 server is not enabled	always
		2.2.12	Ensure Samba is not enabled	false positive
		2.2.13	Ensure HTTP Proxy Server is not enabled	always
		2.2.14	Ensure SNMP Server is not enabled	false positive
		2.2.15	Ensure mail transfer agent is configured for local-only mode	always
		2.2.16	Ensure rsync service is not enabled	false positive
		2.2.17	Ensure NIS Server is not enabled	always
	2.3		Service Clients
		2.3.1	Ensure NIS Client is not installed	always
		2.3.2	Ensure rsh client is not installed	always
		2.3.3	Ensure talk client is not installed	always
		2.3.4	Ensure telnet client is not installed	always
		2.3.5	Ensure LDAP client is not installed	false positive

3			Network Configuration
	3.1		Network Parameters (Host Only)
		3.1.1	Ensure IP forwarding is disabled	always
		3.1.2	Ensure packet redirect sending is disabled	always
	3.2		Network Parameters (Host and Router)
		3.2.1	Ensure source routed packets are not accepted	always
		3.2.2	Ensure ICMP redirects are not accepted	always
		3.2.3	Ensure secure ICMP redirects are not accepted	always
		3.2.4	Ensure suspicious packets are logged	always
		3.2.5	Ensure broadcast ICMP requests are ignored	always
		3.2.6	Ensure bogus ICMP responses are ignored	always
		3.2.7	Ensure Reverse Path Filtering is enabled	always
		3.2.8	Ensure TCP SYN Cookies is enabled	always
	3.3		Ipv6
		3.3.1	Ensure IPv6 router advertisements are not accepted	always
		3.3.2	Ensure IPv6 redirects are not accepted	always
		3.3.3	Ensure IPv6 is disabled	always
	3.4		TCP Wrappers
		3.4.1	Ensure TCP Wrappers is installed	always
		3.4.2	Ensure /etc/hosts.allow is configured	false positive
		3.4.3	Ensure /etc/hosts.deny is configured	false positive
		3.4.4	Ensure permissions on /etc/hosts.allow are configured	always
		3.4.5	Ensure permissions on /etc/hosts.deny are configured	always
	3.5		Uncommon Network Protocols
		3.5.1	Ensure DCCP is disabled	always
		3.5.2	Ensure SCTP is disabled	always
		3.5.3	Ensure RDS is disabled	always
		3.5.4	Ensure TIPC is disabled	always
	3.6		Firewall Configuration
		3.6.1	Ensure iptables is installed	always
		3.6.2	Ensure default deny firewall policy	always
		3.6.3	Ensure loopback traffic is configured	always
		3.6.4	Ensure outbound and established connections are configured	always
		3.6.5	Ensure firewall rules exist for all open ports	always
	3.7		Ensure wireless interfaces are disabled	always

4			Logging and Auditing
	4.1		Configure System Accounting (auditd)
		4.1.1.1	Ensure audit log storage size is configured	always
		4.1.1.2	Ensure system is disabled when audit logs are full	false positive
		4.1.1.3	Ensure audit logs are not automatically deleted	false positive
		4.1.2	Ensure auditd service is enabled	needs STIG
		4.1.3	Ensure auditing for processes that start prior to auditd is enabled	needs STIG
		4.1.4	Ensure events that modify date and time information are collected	needs STIG
		4.1.5	Ensure events that modify user/group information are collected	needs STIG
		4.1.6	Ensure events that modify the system's network environment are collected	needs STIG
		4.1.7	Ensure events that modify the system's Mandatory Access Controls are collected	needs STIG
		4.1.8	Ensure login and logout events are collected	needs STIG
		4.1.9	Ensure session initiation information is collected	needs STIG
		4.1.10	Ensure discretionary access control permission modification events are collected	needs STIG
		4.1.11	Ensure unsuccessful unauthorized file access attempts are collected	needs STIG
		4.1.12	Ensure use of privileged commands is collected	needs STIG
		4.1.13	Ensure successful file system mounts are collected	needs STIG
		4.1.14	Ensure file deletion events by users are collected	needs STIG
		4.1.15	Ensure changes to system administration scope (sudoers) is collected	needs STIG
		4.1.16	Ensure system administrator actions (sudolog) are collected	needs STIG
		4.1.17	Ensure kernel module loading and unloading is collected	needs STIG
		4.1.18	Ensure the audit configuration is immutable	needs STIG
	4.2		Configure Logging
		4.2.1.1	Ensure rsyslog Service is enabled	always
		4.2.1.2	Ensure logging is configured	always
		4.2.1.3	Ensure rsyslog default file permissions configured	always
		4.2.1.4	Ensure rsyslog is configured to send logs to a remote log host	false positive
		4.2.1.5	Ensure remote rsyslog messages are only accepted on designated log hosts	false positive
		4.2.2.1	Ensure syslog-ng service is enabled	always
		4.2.2.2	Ensure logging is configured	always
		4.2.2.3	Ensure syslog-ng default file permissions configured	always
		4.2.2.4	Ensure syslog-ng is configured to send logs to a remote log host	always
		4.2.2.5	Ensure remote syslog-ng messages are only accepted on designated log hosts]	always
		4.2.3	Ensure rsyslog or syslog-ng is installed	always
		4.2.4	Ensure permissions on all logfiles are configured	always
	4.3		Ensure logrotate is configured	always

5			Access, Authentication and Authorization
	5.1		Configure cron
		5.1.1	Ensure cron daemon is enabled	always
		5.1.2	Ensure permissions on /etc/crontab are configured	always
		5.1.3	Ensure permissions on /etc/cron.hourly are configured	always
		5.1.4	Ensure permissions on /etc/cron.daily are configured	always
		5.1.5	Ensure permissions on /etc/cron.weekly are configured	always
		5.1.6	Ensure permissions on /etc/cron.monthly are configured	always
		5.1.7	Ensure permissions on /etc/cron.d are configured	always
		5.1.8	Ensure at/cron is restricted to authorized users	always
	5.2		SSH Server Configuration	always
		5.2.1	Ensure permissions on /etc/ssh/sshd_config are configured	always
		5.2.2	Ensure SSH Protocol is set to 2	always
		5.2.3	Ensure SSH LogLevel is set to INFO	always
		5.2.4	Ensure SSH X11 forwarding is disabled	always
		5.2.5	Ensure SSH MaxAuthTries is set to 4 or less	always
		5.2.6	Ensure SSH IgnoreRhosts is enabled	always
		5.2.7	Ensure SSH HostbasedAuthentication is disabled	always
		5.2.8	Ensure SSH root login is disabled	always
		5.2.9	Ensure SSH PermitEmptyPasswords is disabled	always
		5.2.10	Ensure SSH PermitUserEnvironment is disabled	always
		5.2.11	Ensure only approved MAC algorithms are used	always
		5.2.12	Ensure SSH Idle Timeout Interval is configured	always
		5.2.13	Ensure SSH LoginGraceTime is set to one minute or less	always
		5.2.14	Ensure SSH access is limited	always
		5.2.15	Ensure SSH warning banner is configured	always
	5.3		Configure PAM
		5.3.1	Ensure password creation requirements are configured	false positive
		5.3.2	Ensure lockout for failed password attempts is configured	always
		5.3.3	Ensure password reuse is limited	always
		5.3.4	Ensure password hashing algorithm is SHA-512	always
	5.4		User Accounts and Environment
		5.4.1.1	Ensure password expiration is 365 days or less	always
		5.4.1.2	Ensure minimum days between password changes is 7 or more	always
		5.4.1.3	Ensure password expiration warning days is 7 or more	always
		5.4.1.4	Ensure inactive password lock is 30 days or less	always
		5.4.1.5	Ensure all users last password change date is in the past	always
		5.4.2	Ensure system accounts are non-login	always
		5.4.3	Ensure default group for the root account is GID 0	always
		5.4.4	Ensure default user umask is 027 or more restrictive	always
		5.4.5	Ensure default user shell timeout is 900 seconds or less	always
	5.5		Ensure root login is restricted to system console	always
	5.6		Ensure access to the su command is restricted	always

6			System Maintenance
	6.1		System File Permissions
		6.1.1	Audit system file permissions	always
		6.1.2	Ensure permissions on /etc/passwd are configured	always
		6.1.3	Ensure permissions on /etc/shadow are configured	always
		6.1.4	Ensure permissions on /etc/group are configured	always
		6.1.5	Ensure permissions on /etc/gshadow are configured	always
		6.1.6	Ensure permissions on /etc/passwd- are configured	always
		6.1.7	Ensure permissions on /etc/shadow- are configured	always
		6.1.8	Ensure permissions on /etc/group- are configured	always
		6.1.9	Ensure permissions on /etc/gshadow- are configured	always
		6.1.10	Ensure no world writable files exist	false positive
		6.1.11	Ensure no unowned files or directories exist	always
		6.1.12	Ensure no ungrouped files or directories exist	always
		6.1.13	Audit SUID executables	always
		6.1.14	Audit SGID executables	always
	6.2		User and Group Settings
		6.2.1	Ensure password fields are not empty	always
		6.2.2	Ensure no legacy "+" entries exist in /etc/passwd	always
		6.2.3	Ensure no legacy "+" entries exist in /etc/shadow	always
		6.2.4	Ensure no legacy "+" entries exist in /etc/group	always
		6.2.5	Ensure root is the only UID 0 account	always
		6.2.6	Ensure root PATH Integrity	always
		6.2.7	Ensure all users' home directories exist	always
		6.2.8	Ensure users' home directories permissions are 750 or more restrictive	always
		6.2.9	Ensure users own their home directories	always
		6.2.10	Ensure users' dot files are not group or world writable	always
		6.2.11	Ensure no users have .forward files	always
		6.2.12	Ensure no users have .netrc files	always
		6.2.13	Ensure users' .netrc Files are not group or world accessible	always
		6.2.14	Ensure no users have .rhosts files	always
		6.2.15	Ensure all groups in /etc/passwd exist in /etc/group	always
		6.2.16	Ensure no duplicate UIDs exist	always
		6.2.17	Ensure no duplicate GIDs exist	always
		6.2.18	Ensure no duplicate user names exist	always
		6.2.19	Ensure no duplicate group names exist	always
		6.2.20	Ensure shadow group is empty	always

CIS vs STIG solved only conflict:

CIS recommendation 5.2.11 states that we need to "Ensure only approved MAC algorithms are used", however STIG V-23826 requires that the SSH daemon only uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). This document: https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2907.pdf indicates that if we use the CIS settings for this parameter, we still satisfy the FIPS 140-2 validated cryptographic module and in consequence STIG V-23826 as well. MAC algorithms include:

hmac-sha2-512-etm@openssh.com,

hmac-sha2-256-etm@openssh.com,

umac-128-etm@openssh.com,

hmac-sha2-512,

hmac-sha2-256,

umac-128@openssh.com

False positives:


2.2.1.1	Ensure time synchronization is in use.	Snare Central runs ntpdate daily, the ntp source server is set by the customer during the install.
2.2.1.3	Ensure chrony is configured.	Snare Central does not use chrony
2.2.7	Ensure NFS and RPC are not enabled.	User can disable NFS from UI
2.2.12	Ensure Samba is not enabled.	User can disable samba from UI
2.2.14	Ensure SNMP Server is not enabled.	User can disable SNMP from UI
2.2.16	Ensure rsync service is not enabled.	rsync Is used for side by side migration only.
2.3.5	Ensure LDAP client is not installed.	Snare Central comes with LDAP client.
3.4.2	Ensure /etc/hosts.allow is configured.	The contents depend on user network layout.
3.4.3	Ensure /etc/hosts.deny is configured.	The contents depend on user network layout.
4.1.1.2	Ensure system is disabled when audit logs are full.	Snare Central uses SUSPEND instead of HALT as Snare Central is a logging system it needs to keep operating.
4.1.1.3	Ensure audit logs are not automatically deleted.	Snare Central uses ROTATE instead of KEEP.
4.2.1.4	Ensure rsyslog is configured to send logs to a remote log host.	Not Applicable, Snare Central is the central logging system so it collects its own logs and also other systems, so the context is different to what the CIS checklist is asking for.
4.2.1.5	Ensure remote rsyslog messages are only accepted on designated log hosts.	Not Applicable
5.3.1	Ensure password creation requirements are configured.	Snare Central uses pam_cracklib to help enforce password complexity.
6.1.10	Ensure no world writable files exist.	Apache web server needs this file only: /tmp/perf-23853.map owner: www-data, group: www-data, permissions: 0666

Won't do:
1.4.2 Ensure bootloader password is set. this need to be done manually by the sysadmin