CIS - Ubuntu 24.04

• CIS - Ubuntu 24.04
  • Disclaimer
  • Notes
  • Requirements
  • Role Variables
    • Run only setup per section
    • Variables not included in CIS as additional extend
    • Variables which are recommended by CIS, but disable in this role by default
    • Variable for special usage between server and client
    • Variables to check and set for own purpose
    • Variable rules implemented, but only print information for manual check
  • Dependencies
  • Example Playbook
  • Definitions
    • Profile
  • CIS - List of Recommendations
  • License
  • Resources

This Ansible role is designed to configure Ubuntu 24.04 to comply with the CIS Ubuntu Linux Benchmark v1.0.0. It automates the application of hardening recommendations to enhance system security. While this role can help mitigate common security risks, it is essential to tailor the configurations to your specific environment.

Based on CIS Ubuntu Linux 24.04 LTS Benchmark v1.0.0.

Tested with:

• Ubuntu 24.04

Disclaimer

[!DANGER]

This role makes significant changes to your system that could break functionality. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted. While based on industry-standard security guidelines (CIS), it is recommended to review these changes, especially when applied to existing systems.

This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review thoroughly this role for any site specific changes before applying them to production systems.

Strongly advise testing in a staging environment before applying in production.

Notes

• section :: 4.3 Configure nftables
  • is configured, but not in deep tested (default ufw is used from section 4.2)
• section :: 4.4 Configure iptables
  • is configured, but not in deep tested (default ufw is used from section 4.2)
• section :: 5.3 Pluggable Authentication Modules :: 5.4 User Accounts and Environment
  • could be tested deeper, base tests are performed and for secure only used for fresh os install
• section :: 6.1.2.1 Configure systemd-journal-remote
  • is configured, but not in deep tested (default not setup with remote logging)
• section :: 6.1.3.6 Ensure rsyslog is configured to send logs to a remote log host
  • is configured, but not in deep tested (default not setup with remote logging)

Requirements

Before using this role, ensure that your system meets the following requirements:

• Python >= 3.12
• Ansible >= 2.16
• SSH access to the target machine.

Install required tools and libraries:

$sudo apt install python3 python3-pip sshpass
$python3 -m pip install ansible ansible-lint yamllint --break-system-packages

For run tests with molecule, you need also to install:

$python3 -m pip install molecule molecule-plugins[docker] --break-system-packages

Role Variables

Run only setup per section

Default all section are active and will performed

cis_ubuntu2404_section1: true
cis_ubuntu2404_section2: true
cis_ubuntu2404_section3: true
cis_ubuntu2404_section4: true
cis_ubuntu2404_section5: true
cis_ubuntu2404_section6: true
cis_ubuntu2404_section7: true

Variables not included in CIS as additional extend

# Extend the default sshd_config hardening to remove unnecessary comments and empty lines.
# 'true' by default.
cis_ubuntu2404_rule_5_1_0: true

# Extend the default sshd_config hardening, which not defined within CIS,
# by include more configuration based on https://infosec.mozilla.org/guidelines/openssh.html.
# 'true' by default.
cis_ubuntu2404_rule_5_1_23: true

# Avoid SSH login lockout by specifying the user and public key for SSH access.
# Lockout will happen when 'cis_ubuntu2404_rule_5_1_19', 'cis_ubuntu2404_rule_5_1_20' and 'cis_ubuntu2404_rule_5_1_23' are used.
# Ensure that a valid SSH public key is provided, or set this rule to false.
# 'false' by default, when 'cis_ubuntu2404_rule_5_1_24_ssh_pub_key' not defined.
cis_ubuntu2404_rule_5_1_24: true
cis_ubuntu2404_rule_5_1_24_ssh_user: "{{ ansible_user }}"
cis_ubuntu2404_rule_5_1_24_ssh_pub_key: "<ADD_PUB_KEY>"

# Set for auditd inside auditd.conf the key for 'log_file' to be save in upcoming configurations
# 'true' by default.
cis_ubuntu2404_rule_6_2_4_0: true

Variables which are recommended by CIS, but disable in this role by default

change default configured values, to be CIS recommended if needed

# NOTE: the way AppAmor with aa-complain/aa-enforce is executed runs into error and stops ansible
#       for that it is general disable, enable as you need and you know what you are doing
# Ensure all AppArmor Profiles are complain
# NOTE: will perform Profiles as complain mode
cis_ubuntu2404_rule_1_3_1_3: false
# Ensure all AppArmor Profiles are enforcing
# NOTE: will perform Profiles as enforcing mode
cis_ubuntu2404_rule_1_3_1_4: false

# Ensure bootloader password is set
cis_ubuntu2404_set_boot_pass: false
cis_ubuntu2404_disable_boot_pass: true

# Active journal send logs to a remote log host
# do not forget set related variables 'cis_ubuntu2404_set_journal_upload_*'
cis_ubuntu2404_set_journal_upload: false
cis_ubuntu2404_set_journal_upload_url: <SET_REMOTE_URL>

# Active rsyslog upload to remote log collection
# do not forget set related variables 'cis_ubuntu2404_set_rsyslog_remote_*'
cis_ubuntu2404_set_rsyslog_remote: false
cis_ubuntu2404_set_rsyslog_remote_target: <SET_REMOTE_URL>

Variable for special usage between server and client

Check services which will removed or disabled, which maybe needed, for example especial for client usage

# will disable USB storage, if USB storage is needed set to 'false'
cis_ubuntu2404_rule_1_1_1_9: true

# will remove bluetooth service, if bluetooth is needed set to 'false'
cis_ubuntu2404_rule_3_1_3: true
cis_ubuntu2404_rule_3_1_3_remove: true

# will disable auto mount, if auto mount is needed set to 'true'
cis_ubuntu2404_allow_autofs: false

# will purge gdm/gui, if gui is needed set to 'true'
# if 'true' is set, recommended configs will perform in rules 1.7.2 - 1.7.10
cis_ubuntu2404_allow_gdm_gui: false

# will purge printer service, if printer service is need set to 'true'
cis_ubuntu2404_allow_cups: false

# will disable ipv6 complete, if ipv6 is needed set to 'true'
cis_ubuntu2404_required_ipv6: false

# will install and config AIDE, if not needed set to 'false'
cis_ubuntu2404_install_aide: true
cis_ubuntu2404_config_aide: true

Variables to check and set for own purpose

# With rule 'cis_ubuntu2404_rule_1_1_1_10' multiple filesystem will be disabled if they are vulnerable
# if you know you would need filesystem, from vulnerable list 'cis_ubuntu2404_fs_known_vulnerable', which not listed below,
# update the list as needed.
# By default the tasks will check which filesystem are current in use and will not disable them, also if not listed in 'cis_ubuntu2404_fs_ignored'
cis_ubuntu2404_fs_ignored: # these filesystem won't be disabled
  - xfs
  - vfat
  - ext2
  - ext3
  - ext4

# choose time synchronization (cis_ubuntu2404_rule_2_3_1_1)
cis_ubuntu2404_time_synchronization_service: chrony # chrony | systemd-timesyncd
cis_ubuntu2404_time_synchronization_time_server:
  - uri: time.cloudflare.com
    config: iburst
  - uri: ntp.ubuntu.com
    config: iburst

# cron allow users  (cis_ubuntu2404_rule_2_4_1_8)
cis_ubuntu2404_cron_allow_users:
  - root
# at allow users  (cis_ubuntu2404_rule_2_4_2_1)
cis_ubuntu2404_at_allow_users:
  - root

# choose firewall (cis_ubuntu2404_rule_4_*)
cis_ubuntu2404_firewall: ufw # ufw | nftables | iptables

# allows/denies for users/groups (4 possible variables can be used/activated)
# put 'null' or list of users (comma separated user list)
# default set to add ssh as group to allow use ssh (do not forget add group to user)
#cis_ubuntu2404_ssh_allow_users: root,user
#cis_ubuntu2404_ssh_allow_groups: root,ssh
#cis_ubuntu2404_ssh_deny_users: root,user
#cis_ubuntu2404_ssh_deny_groups: root,ssh

cis_ubuntu2404_ssh_permit_root_login: "no"
cis_ubuntu2404_ssh_port: 22
cis_ubuntu2404_ssh_authentication_methods: "publickey"
cis_ubuntu2404_ssh_password_authentication: "no"

# pw quality policies
cis_ubuntu2404_faillock_deny: 5
cis_ubuntu2404_faillock_unlock_time: 900
cis_ubuntu2404_faillock_minlen: 14
cis_ubuntu2404_password_complexity:
  - key: "minclass"
    value: "3"
  - key: "dcredit"
    value: "-1"
  - key: "ucredit"
    value: "-1"
  - key: "ocredit"
    value: "-1"
  - key: "lcredit"
    value: "-1"

# journald log file rotation (cis_ubuntu2404_rule_6_1_1_3)
cis_ubuntu2404_journald_system_max_use: 4G
cis_ubuntu2404_journald_system_keep_free: 8G
cis_ubuntu2404_journald_runtime_max_use: 256M
cis_ubuntu2404_journald_runtime_keep_free: 512M
cis_ubuntu2404_journald_max_file_sec: 1month

Variable rules implemented, but only print information for manual check

# SECTION1 | 1.2.1.1 | Ensure GPG keys are configured
cis_ubuntu2404_rule_1_2_1_1: true
# SECTION1 | 1.2.1.2 | Ensure package manager repositories are configured
cis_ubuntu2404_rule_1_2_1_2: true

# SECTION2 | 2.1.22 | Ensure only approved services are listening on a network interface
cis_ubuntu2404_rule_2_1_22: true

# SECTION5 | 5.4.2.1 | Ensure root is the only UID 0 account
cis_ubuntu2404_rule_5_4_2_1: true
# SECTION5 | 5.4.2.2 | Ensure root is the only GID 0 account
cis_ubuntu2404_rule_5_4_2_2: true
# SECTION5 | 5.4.2.3 | Ensure group root is the only GID 0 group
cis_ubuntu2404_rule_5_4_2_3: true
# SECTION5 | 5.4.2.5 | Ensure root path integrity
cis_ubuntu2404_rule_5_4_2_5: true
# SECTION5 | 5.4.2.7 | Ensure system accounts do not have a valid login shell
cis_ubuntu2404_rule_5_4_2_7: true

# SECTION6 | 6.1.1.2 | Ensure journald log file access is configured
cis_ubuntu2404_rule_6_1_1_2: true

# SECTION7 | 7.1.12 | Ensure no files or directories without an owner and a group exist
cis_ubuntu2404_rule_7_1_12: true
# SECTION7 | 7.1.13 | Ensure SUID and SGID files are reviewed
cis_ubuntu2404_rule_7_1_13: true

# SECTION7 | 7.2.3 | Ensure all groups in /etc/passwd exist in /etc/group
cis_ubuntu2404_rule_7_2_3: true
# SECTION7 | 7.2.5 | Ensure no duplicate UIDs exist
cis_ubuntu2404_rule_7_2_5: true
# SECTION7 | 7.2.6 | Ensure no duplicate GIDs exist
cis_ubuntu2404_rule_7_2_6: true
# SECTION7 | 7.2.7 | Ensure no duplicate user names exist
cis_ubuntu2404_rule_7_2_7: true
# SECTION7 | 7.2.8 | Ensure no duplicate group names exist
cis_ubuntu2404_rule_7_2_8: true

Dependencies

Developed and testes with Ansible 2.16

Example Playbook

Example usage can be found also here.

- name: CIS | install on clients
  become: true
  remote_user: "{{ ansible_user }}"
  hosts:
    - clients
  roles:
    - role: ansible-cis-ubuntu-2404
      cis_ubuntu2404_section1: true
      cis_ubuntu2404_section2: true
      cis_ubuntu2404_section3: true
      cis_ubuntu2404_section4: true
      cis_ubuntu2404_section5: true
      cis_ubuntu2404_section6: true
      cis_ubuntu2404_section7: true
      # -------------------------
      cis_ubuntu2404_rule_5_1_24: true
      cis_ubuntu2404_rule_5_1_24_ssh_user: "{{ ansible_user }}"
      cis_ubuntu2404_rule_5_1_24_ssh_pub_key: "<ADD_PUB_KEY>"
      # -------------------------
      cis_ubuntu2404_rule_1_3_1_3: true # AppArmor complain mode
      cis_ubuntu2404_rule_1_3_1_4: false # AppArmor enforce mode
      # -------------------------
      cis_ubuntu2404_set_boot_pass: false # bootloader password (disabled)
      cis_ubuntu2404_disable_boot_pass: true # bootloader password (disabled with cis_ubuntu2404_set_boot_pass)
      # -------------------------
      cis_ubuntu2404_rule_3_1_3: false # bluetooth service
      cis_ubuntu2404_rule_3_1_3_remove: false # bluetooth service
      # -------------------------
      cis_ubuntu2404_allow_gdm_gui: true
      cis_ubuntu2404_allow_autofs: true # Disable auto mount, set to true to allow it and not disable
      cis_ubuntu2404_rule_1_1_1_9: false # Disable USB Storage, set to false to not disable
      cis_ubuntu2404_time_synchronization_service: chrony # chrony | systemd-timesyncd
      cis_ubuntu2404_time_synchronization_time_server:
        - uri: time.cloudflare.com
          config: iburst
        - uri: ntp.ubuntu.com
          config: iburst
      cis_ubuntu2404_allow_cups: true
      # -------------------------
      cis_ubuntu2404_install_aide: "{{ cis_setup_aide | default(false) | bool }}"
      cis_ubuntu2404_config_aide: "{{ cis_setup_aide | default(false) | bool }}"
      # -------------------------
      cis_ubuntu2404_journald_system_max_use: 4G
      cis_ubuntu2404_journald_system_keep_free: 8G
      cis_ubuntu2404_journald_runtime_max_use: 256M
      cis_ubuntu2404_journald_runtime_keep_free: 512M
      cis_ubuntu2404_journald_max_file_sec: 1month
      # -------------------------
      cis_ubuntu2404_required_ipv6: "{{ cis_ipv6_required | default(false) | bool }}"
      cis_ubuntu2404_firewall: ufw
      # -------------------------
      cis_ubuntu2404_cron_allow_users:
        - root
      cis_ubuntu2404_at_allow_users:
        - root
      # -------------------------
      cis_ubuntu2404_faillock_deny: 5
      cis_ubuntu2404_faillock_unlock_time: 900
      cis_ubuntu2404_faillock_minlen: 8
      cis_ubuntu2404_password_complexity:
        - key: "minclass"
          value: "3"
        - key: "dcredit"
          value: "-1"
        - key: "ucredit"
          value: "-1"
        - key: "ocredit"
          value: "-1"
        - key: "lcredit"
          value: "-1"
      # -------------------------

Definitions

Profile

A collection of recommendations for securing a technology or a supporting platform. Most benchmarks include at least a Level 1 and Level 2 Profile. Level 2 extends Level 1 recommendations and is not a standalone profile. The Profile Definitions section in the benchmark provides the definitions as they pertain to the recommendations included for the technology.

For Level 1 and Level 2 and the split into Server and Workstation, are defined by tags in the tasks by:

• server_l1
• server_l2
• workstation_l1
• workstation_l2

For more specific description see the CIS pdf file on page 18.

CIS - List of Recommendations

License

MIT

Resources

• https://downloads.cisecurity.org/#/
• https://github.com/MVladislav/ansible-cis-ubuntu-2204