CIS Amazon Linux v2.1.0 L1

Audit Details

Name: CIS Amazon Linux v2.1.0 L1

Updated: 9/19/2022

Authority: CIS

Plugin: Unix

Revision: 1.34

Estimated Item Count: 268

File Details

Filename: CIS_Amazon_Linux_v2.1.0_L1.audit

Size: 352 kB

MD5: 8610d1cbce51a95f02b47598714a2e8e
SHA256: aa0e87d6653fd39bf5fe2cbd758b3a36ebb4fe1f095d7562a267b6892f29359b

Audit Items

DescriptionCategories
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.2 Ensure mounting of freevxfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.4 Ensure mounting of hfs filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.4 Ensure mounting of hfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.5 Ensure mounting of hfsplus filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.6 Ensure mounting of squashfs filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.6 Ensure mounting of squashfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.7 Ensure mounting of udf filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.7 Ensure mounting of udf filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.1.8 Ensure mounting of FAT filesystems is disabled - /etc/modprobe.d/CIS.conf

CONFIGURATION MANAGEMENT

1.1.1.8 Ensure mounting of FAT filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT

1.1.3 Ensure nodev option set on /tmp partition

ACCESS CONTROL

1.1.4 Ensure nosuid option set on /tmp partition

CONFIGURATION MANAGEMENT

1.1.5 Ensure noexec option set on /tmp partition

ACCESS CONTROL

1.1.8 Ensure nodev option set on /var/tmp partition

ACCESS CONTROL

1.1.9 Ensure nosuid option set on /var/tmp partition

ACCESS CONTROL

1.1.10 Ensure noexec option set on /var/tmp partition

ACCESS CONTROL

1.1.14 Ensure nodev option set on /home partition

ACCESS CONTROL

1.1.15 Ensure nodev option set on /dev/shm partition

ACCESS CONTROL

1.1.16 Ensure nosuid option set on /dev/shm partition

ACCESS CONTROL

1.1.17 Ensure noexec option set on /dev/shm partition

ACCESS CONTROL

1.1.18 Ensure sticky bit is set on all world-writable directories

ACCESS CONTROL

1.1.19 Disable Automounting

CONFIGURATION MANAGEMENT

1.2.1 Ensure package manager repositories are configured

SYSTEM AND INFORMATION INTEGRITY

1.2.2 Ensure GPG keys are configured

SYSTEM AND INFORMATION INTEGRITY

1.2.3 Ensure gpgcheck is globally activated

SYSTEM AND INFORMATION INTEGRITY

1.3.1 Ensure AIDE is installed

AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked

SYSTEM AND INFORMATION INTEGRITY

1.4.1 Ensure permissions on bootloader config are configured

SYSTEM AND INFORMATION INTEGRITY

1.4.2 Ensure authentication required for single user mode

SYSTEM AND INFORMATION INTEGRITY

1.4.3 Ensure interactive boot is not enabled

SYSTEM AND INFORMATION INTEGRITY

1.5.1 Ensure core dumps are restricted - /etc/sysctl.conf, /etc/sysctl.d/*

ACCESS CONTROL, CONFIGURATION MANAGEMENT

1.5.1 Ensure core dumps are restricted - limits.conf, limits.d/*

ACCESS CONTROL

1.5.1 Ensure core dumps are restricted - sysctl

ACCESS CONTROL

1.5.2 Ensure XD/NX support is enabled

SYSTEM AND INFORMATION INTEGRITY

1.5.3 Ensure address space layout randomization (ASLR) is enabled - /etc/sysctl.conf, /etc/sysctl.d/*

SYSTEM AND INFORMATION INTEGRITY

1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl

SYSTEM AND INFORMATION INTEGRITY

1.5.4 Ensure prelink is disabled

CONFIGURATION MANAGEMENT

1.7.1.1 Ensure message of the day is configured properly - banner text

ACCESS CONTROL

1.7.1.1 Ensure message of the day is configured properly - mrsv

CONFIGURATION MANAGEMENT

1.7.1.2 Ensure local login warning banner is configured properly - banner text

ACCESS CONTROL

1.7.1.2 Ensure local login warning banner is configured properly - mrsv

CONFIGURATION MANAGEMENT

1.7.1.3 Ensure remote login warning banner is configured properly - banner text

ACCESS CONTROL

1.7.1.3 Ensure remote login warning banner is configured properly - mrsv

CONFIGURATION MANAGEMENT

1.7.1.4 Ensure permissions on /etc/motd are configured

CONFIGURATION MANAGEMENT