CIS Ubuntu Linux 14.04 LTS Server L2 v2.1.0

Audit Details

Name: CIS Ubuntu Linux 14.04 LTS Server L2 v2.1.0

Updated: 4/25/2022

Authority: CIS

Plugin: Unix

Revision: 1.11

Estimated Item Count: 133

File Details

Filename: CIS_Ubuntu_14.04_LTS_Server_v2.1.0_L2.audit

Size: 291 kB

MD5: 7f4e8637d84990b963056c2877bc3b33
SHA256: 9afaf4d45f13bcf174ee6e81ca96ec593e16285cc9d1b5fd02f0e5c6efd11f68

Audit Items

DescriptionCategories
1.1.2 Ensure separate partition exists for /tmp

CONFIGURATION MANAGEMENT

1.1.5 Ensure separate partition exists for /var

CONFIGURATION MANAGEMENT

1.1.6 Ensure separate partition exists for /var/tmp

CONFIGURATION MANAGEMENT

1.1.10 Ensure separate partition exists for /var/log

CONFIGURATION MANAGEMENT

1.1.11 Ensure separate partition exists for /var/log/audit

AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

1.1.12 Ensure separate partition exists for /home

CONFIGURATION MANAGEMENT

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration

ACCESS CONTROL

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration - 'enforcing'

SYSTEM AND INFORMATION INTEGRITY

1.6.1.1 Ensure SELinux is not disabled in bootloader configuration -'selinux'

SYSTEM AND INFORMATION INTEGRITY

1.6.1.2 Ensure the SELinux state is enforcing

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - 'Current mode'

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - 'Mode from config file'

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - 'SELinux status'

ACCESS CONTROL

1.6.1.2 Ensure the SELinux state is enforcing - 'SELINUX'

ACCESS CONTROL

1.6.1.3 Ensure SELinux policy is configured
1.6.1.3 Ensure SELinux policy is configured - 'Policy from config file'

ACCESS CONTROL

1.6.1.3 Ensure SELinux policy is configured - 'SELINUXTYPE'

ACCESS CONTROL

1.6.1.4 Ensure no unconfined daemons exist

ACCESS CONTROL

1.6.2.1 Ensure AppArmor is not disabled in bootloader configuration

SYSTEM AND INFORMATION INTEGRITY

1.6.2.2 Ensure all AppArmor Profiles are enforcing

ACCESS CONTROL

1.6.2.2 Ensure all AppArmor Profiles are enforcing - 'complian mode'

ACCESS CONTROL

1.6.2.2 Ensure all AppArmor Profiles are enforcing - 'profiles loaded'

ACCESS CONTROL

1.6.2.2 Ensure all AppArmor Profiles are enforcing - 'unconfined processes'

ACCESS CONTROL

1.6.3 Ensure SELinux or AppArmor are installed

ACCESS CONTROL

4.1.1.1 Ensure audit log storage size is configured

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - 'action_mail_acct'

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - 'admin_space_left_action'

AUDIT AND ACCOUNTABILITY

4.1.1.2 Ensure system is disabled when audit logs are full - 'space_left_action'

AUDIT AND ACCOUNTABILITY

4.1.1.3 Ensure audit logs are not automatically deleted

AUDIT AND ACCOUNTABILITY

4.1.2 Ensure auditd service is enabled
4.1.3 Ensure auditing for processes that start prior to auditd is enabled - '/boot/grub/grub.cfg'

AUDIT AND ACCOUNTABILITY

4.1.3 Ensure auditing for processes that start prior to auditd is enabled - '/etc/default/grub'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - '/etc/localtime'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'adjtimex - 64bit'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'adjtimex'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'auditctl /etc/localtime'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'auditctl adjtimex (64-bit)'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'auditctl adjtimex'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'auditctl clock_settime (64-bit)'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'auditctl clock_settime'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'clock_settime - 64bit'

AUDIT AND ACCOUNTABILITY

4.1.4 Ensure events that modify date and time information are collected - 'clock_settime'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - '/etc/group'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - '/etc/gshadow'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - '/etc/passwd'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - '/etc/security/opasswd'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - '/etc/shadow'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - 'auditctl group'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - 'auditctl gshadow'

AUDIT AND ACCOUNTABILITY

4.1.5 Ensure events that modify user/group information are collected - 'auditctl opasswd'

AUDIT AND ACCOUNTABILITY