linux Linux CIS Vulnerability Reference

• 1.1.1 Unused/exotic filesystem kernel modules not disabled (cramfs, freevxfs, hfs, hfsplus, jffs2, overlayfs, squashfs, udf, usb-storage) — each is a rarely-needed legacy filesystem driver that expands attack surface for local privilege escalation. (L1, mostly Automated)
• 1.1.2 Partition hardening — /tmp, /dev/shm, /var/tmp should be separate partitions/mounts with nodev,nosuid,noexec; /home, /var, /var/log, /var/log/audit should be separate partitions with nodev,nosuid. On a CyberPatriot image these are usually a single partition already, so full remediation may not be realistic — but the mount-option hardening (noexec/nosuid/nodev) can often still be applied via mount -o remount even without repartitioning. (L1, some Automated some Manual)
• 1.2 Package Management — GPG keys for repos configured/valid, repo list sane (no unauthorized/malicious repos added), all available security updates installed. (L1)
• 1.3 Mandatory Access Control — AppArmor installed, enabled in the bootloader, and all profiles in enforce (not just complain) mode — a "complain-mode-only" AppArmor install gives a false sense of security since it logs but doesn't block. (L1)
• 1.4 Bootloader — GRUB password set, bootloader config file permissions restricted (chmod 600) — without this, physical/console access lets someone edit boot parameters to get a root shell. (L1)
• 1.5 Process hardening — ASLR enabled (kernel.randomize_va_space=2), ptrace_scope restricted, core dumps restricted, prelink not installed (prelink defeats ASLR), Apport/automatic error reporting disabled (can leak sensitive data in crash reports). (L1)
• 1.6 Command line warning banners — MOTD, /etc/issue, /etc/issue.net configured with a generic (non-identifying — no OS/version/kernel info) warning banner, and file permissions on those files restricted. (L1)
• 1.7 GNOME Display Manager (if a GUI is installed) — login banner set, disable-user-list enabled (don't show a clickable user list on the lock screen), screen auto-locks on idle and that lock setting can't be overridden by the user, automount/autorun of removable media disabled, XDMCP disabled (unencrypted remote X11). (L1)

• 2.1 Server services — any unneeded service installed and running: autofs, avahi, dhcp server, dns server, dnsmasq, samba, ftp, message access (dovecot/imap/pop3), nfs, nis, print server (cups), rpcbind, rsync, snmp, tftp, web server (apache/nginx), xinetd, X window system (on a headless server) — this maps directly to the "Disable & Purge Unnecessary Packages" section already in the master checklist; the CIS list is a good completeness check. (L1)
• 2.2 Client services — obsolete network clients (nis, rsh, talk, telnet, ldap client utils if unused) shouldn't be installed even if the corresponding server isn't running, since they're an easy path for an attacker who's already got local access to pivot. (L1)
• 2.3 Time synchronization — chrony or systemd-timesyncd installed and configured (not just installed with defaults) — without a synced clock, Kerberos-style time-sensitive auth and log correlation both break. (L1)
• 2.4 Cron/at daemon enabled and restricted to authorized users only via /etc/cron.allow and /etc/at.allow (with .deny files removed if present). (L1)

• 3.1 Kernel network parameters (sysctl) — IP forwarding disabled (unless the box is meant to route), packet redirect sending disabled, bogus ICMP responses ignored, broadcast ICMP requests ignored, source-routed packets not accepted, secure ICMP redirects not accepted, reverse path filtering enabled, TCP SYN cookies enabled. This is exactly what's already in the master checklist's sysctl section — CIS confirms it's high-value, not just community folklore. (L1)
• 3.2/3.3 Uncommon network protocols disabled (dccp, sctp, rds, tipc) if not required — reduces kernel attack surface from protocols that are rarely audited/used. (L1)
• 3.4/3.5 Wireless interfaces disabled if not required (ip link should show no wireless up on a server image); IPv6 disabled at the kernel level if not in use (fewer competitions grade IPv6, but an unmanaged/unhardened IPv6 stack is still a live attack surface even if "unused"). (L1/L2)

• 4.x A single firewall utility installed and enabled (not multiple conflicting ones — e.g. both ufw and raw iptables rules active), default-deny policy on input (and ideally forward), loopback traffic explicitly permitted, outbound and established connections permitted, all other inbound denied by default with only required ports explicitly allowed. Maps directly to the firewall section already in the master checklist. (L1)

• 5.1 SSH Server — file permissions on /etc/ssh/sshd_config restricted, PermitRootLogin no, PermitEmptyPasswords no, strong Ciphers/MACs/KexAlgorithms only (disable weak/legacy algorithms), LoginGraceTime ≤60s, MaxAuthTries ≤4, MaxSessions limited, X11Forwarding no unless required, banner configured, ClientAliveInterval/ClientAliveCountMax set (auto-disconnect idle sessions), AllowTcpForwarding and AllowAgentForwarding disabled unless required. The master checklist's SSH section covers the big ones (PermitRootLogin, X11Forwarding, MaxAuthTries) — the Ciphers/MACs/KexAlgorithms hardening is a common gap. (L1, a couple L2)
• 5.2 Privilege escalation (sudo) — sudo installed and package integrity verified, sudo requires re-authentication (no blanket NOPASSWD for everything), sudo PTY/logging enabled (Defaults use_pty, Defaults logfile=...), su command restricted to a defined group. (L1)
• 5.3 PAM — pam_faillock/pam_tally2 configured for account lockout on repeated failures, password quality module (pam_pwquality) enforcing minlen/complexity, password reuse prevented (remember=), password hashing algorithm is SHA-512 or stronger (never MD5/DES), default umask restrictive (027 or 077). (L1)
• 5.4 User accounts and environment — all accounts have a password set or are locked (no accounts with an empty password field), root is the only UID 0 account, root's PATH doesn't contain a relative or world-writable directory, all users' home directories exist and are owned/permission-restricted correctly, no .netrc/.forward/.rhosts files present (legacy trust files that bypass normal auth), default group for root is GID 0, shell timeout (TMOUT) configured to auto-logout idle interactive sessions. (L1)

• 6.1 System logging — journald/rsyslog (or both) configured, log file permissions restricted, logs forwarded to a remote log host if the scenario calls for it, journald configured to persist logs to disk (not just volatile memory — a reboot shouldn't erase your evidence trail), logrotate configured. (L1)
• 6.2 System auditing (auditd) — installed, enabled, and configured with actual audit rules, not just "installed and running with an empty ruleset." High-value rule categories: changes to date/time, user/group info (/etc/passwd, /etc/group, /etc/shadow), network environment, MAC policy (AppArmor/SELinux), login/logout events, session initiation, permission-change events (chmod/chown/setxattr), unsuccessful unauthorized file access attempts, use of privileged commands, successful mount operations, file deletion events, sudoers changes, kernel module load/unload. The master checklist's auditctl -e 1 step only turns auditd on — it doesn't add any of these rules by itself, which is the actual gap CIS calls out. (L1)
• 6.3 Integrity checking — AIDE (or equivalent) installed and a periodic cron job configured to run it, not just a one-time install. (L1/L2)

• 7.1 System file permissions — permissions on /etc/passwd, /etc/passwd-, /etc/group, /etc/group-, /etc/shadow, /etc/shadow-, /etc/gshadow are correctly restrictive; no world-writable files exist anywhere on the filesystem; no unowned/ungrouped files exist; SUID/SGID files on the system match an expected baseline (flag anything unexpected). (L1)
• 7.2 Local user/group settings — no duplicate UIDs/GIDs/usernames/group names, shadow group is empty, all users' primary group exists, no legacy + entries in passwd/shadow/group (an ancient NIS artifact that can bypass auth if present), all home directories exist with correct ownership/permissions, root path integrity confirmed.

Cross-check each [ ] item above against Linux_Master_Checklist.md. The two areas most often under-covered in community checklists are 5.1 SSH cipher/MAC/KexAlgorithm hardening and 6.2 actual auditd rule content (vs. just enabling the daemon) — pay extra attention there.