| 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - lsmod | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.3 Ensure mounting of jffs2 filesystems is disabled - modprobe | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.1.7 Ensure mounting of udf filesystems is disabled - modprobe | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2 Ensure /tmp is configured - mount | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.2 Ensure /tmp is configured - systemctl | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.3 Ensure nodev option set on /tmp partition | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.19 Ensure nosuid option set on removable media partitions | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.1.20 Ensure noexec option set on removable media partitions | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.2.1 Ensure package manager repositories are configured | CIS Debian Family Workstation L1 v1.0.0 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 1.4.1 Ensure AIDE is installed - aide | CIS Debian Family Workstation L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.4.1 Ensure AIDE is installed - aide-common | CIS Debian Family Workstation L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.4.2 Ensure filesystem integrity is regularly checked | CIS Debian Family Workstation L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 1.5.3 Ensure authentication required for single user mode | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 1.6.1 Ensure XD/NX support is enabled | CIS Debian Family Workstation L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 1.6.2 Ensure address space layout randomization (ASLR) is enabled | CIS Debian Family Workstation L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 1.6.4 Ensure core dumps are restricted - processsizemax | CIS Debian Family Workstation L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.4 Ensure suspicious packets are logged - net.ipv4.conf.all.log_martians = 1 | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 3.3.7 Ensure Reverse Path Filtering is enabled - files net.ipv4.conf.default.rp_filter = 1 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.7 Ensure Reverse Path Filtering is enabled - net.ipv4.conf.default.rp_filter = 1 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.8 Ensure TCP SYN Cookies is enabled - files net.ipv4.tcp_syncookies = 1 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.8 Ensure TCP SYN Cookies is enabled - net.ipv4.tcp_syncookies = 1 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.9 Ensure IPv6 router advertisements are not accepted - files net.ipv6.conf.all.accept_ra = 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.3.9 Ensure IPv6 router advertisements are not accepted - net.ipv6.conf.default.accept_ra = 0 | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 3.6.1.3 Ensure ufw service is enabled - systemctl | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.1.4 Ensure loopback traffic is configured - allow out v4 | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.2.1 Ensure nftables is installed | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.2.3 Ensure iptables are flushed - v6 | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.1.3 Ensure Uncomplicated Firewall is not installed or disabled | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.2.1 Ensure default deny firewall policy - FORWARD | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.2.2 Ensure loopback traffic is configured - INPUT | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.3.1 Ensure IPv6 default deny firewall policy - Chain FORWARD | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.3.3 Ensure IPv6 outbound and established connections are configured | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.3.3.4 Ensure IPv6 firewall rules exist for all open ports | CIS Debian Family Server L1 v1.0.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.1.7 Ensure rsyslog is not configured to receive logs from a remote client | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT |
| 4.2.2.1 Ensure journald is configured to send logs to rsyslog | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.1 Ensure cron daemon is enabled and running - is-enabled | CIS Debian Family Server L1 v1.0.0 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.7 Ensure permissions on /etc/cron.d are configured | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.1.8 Ensure cron is restricted to authorized users - cron.allow | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.1.9 Ensure at is restricted to authorized users - at.deny | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.2.13 Ensure only strong MAC algorithms are used | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.15 Ensure SSH Idle Timeout Interval is configured - ClientAliveInterval | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.3.3 Ensure password reuse is limited | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.4.1.2 Ensure minimum days between password changes is configured - login.defs | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.1.5 Ensure all users last password change date is in the past | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.4 Ensure default user umask is 027 or more restrictive - /etc/pam.d/common-session | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 5.5 Ensure root login is restricted to system console | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
| 6.1.7 Ensure permissions on /etc/shadow- are configured | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.3 Ensure all users' home directories exist | CIS Debian Family Server L1 v1.0.0 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.9 Ensure no users have .rhosts files | CIS Debian Family Server L1 v1.0.0 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.16 Ensure no duplicate group names exist | CIS Debian Family Server L1 v1.0.0 | Unix | ACCESS CONTROL |
