CIS Amazon Linux 2 v2.0.0 L2

Audit Details

Name: CIS Amazon Linux 2 v2.0.0 L2

Updated: 9/16/2022

Authority: CIS

Plugin: Unix

Revision: 1.5

Estimated Item Count: 128

File Details

Filename: CIS_Amazon_Linux_2_v2.0.0_L2.audit

Size: 425 kB

MD5: 0000051d55fdbbaaae19e8e8b2b096f4
SHA256: 366235778de274c7fca5b3526a7111d41bae4ddbf8c25e0d9a0ebdaa0fb4d2f7

Audit Items

DescriptionCategories
1.1.1.2 Ensure mounting of squashfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.1.2 Ensure mounting of squashfs filesystems is disabled - modprobe

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.10 Ensure separate partition exists for /var

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.11 Ensure separate partition exists for /var/tmp

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.15 Ensure separate partition exists for /var/log

AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.16 Ensure separate partition exists for /var/log/audit

AUDIT AND ACCOUNTABILITY

1.1.17 Ensure separate partition exists for /home

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.6.1.5 Ensure the SELinux mode is enforcing

ACCESS CONTROL, MEDIA PROTECTION

3.1.1 Disable IPv6

CONFIGURATION MANAGEMENT

3.4.1 Ensure DCCP is disabled - lsmod

CONFIGURATION MANAGEMENT

3.4.1 Ensure DCCP is disabled - modprobe

CONFIGURATION MANAGEMENT

3.4.2 Ensure SCTP is disabled - lsmod

CONFIGURATION MANAGEMENT

3.4.2 Ensure SCTP is disabled - modprobe

CONFIGURATION MANAGEMENT

4.1.1.1 Ensure auditd is installed - audit

AUDIT AND ACCOUNTABILITY

4.1.1.1 Ensure auditd is installed - audit-libs

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure auditd service is enabled and running - enabled

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure auditd service is enabled and running - running

AUDIT AND ACCOUNTABILITY

4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled

AUDIT AND ACCOUNTABILITY

4.1.2.1 Ensure audit log storage size is configured

AUDIT AND ACCOUNTABILITY

4.1.2.2 Ensure audit logs are not automatically deleted

AUDIT AND ACCOUNTABILITY

4.1.2.3 Ensure system is disabled when audit logs are full - action_mail_acct

AUDIT AND ACCOUNTABILITY

4.1.2.3 Ensure system is disabled when audit logs are full - admin_space_left_action

AUDIT AND ACCOUNTABILITY

4.1.2.3 Ensure system is disabled when audit logs are full - space_left_action

AUDIT AND ACCOUNTABILITY

4.1.2.4 Ensure audit_backlog_limit is sufficient

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - adjtimex

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - adjtimex b32

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - adjtimex b64

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - auditctl adjtimex b64

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - auditctl clock_settime b64

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - auditctl localtime

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - clock_settime

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - clock_settime b32

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - clock_settime b64

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - localtime

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure events that modify date and time information are collected - localtime b64

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - /etc/group

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - /etc/gshadow

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - /etc/passwd

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - /etc/security/opasswd

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - /etc/shadow

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/group

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/gshadow

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/passwd

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/security/opasswd

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify user/group information are collected - auditctl /etc/shadow

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify the system's network environment are collected - /etc/hosts

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify the system's network environment are collected - /etc/issue

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify the system's network environment are collected - /etc/issue.net

AUDIT AND ACCOUNTABILITY