<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: hardening-linux-with-cis-benchmarks
description: >-
  Apply CIS Benchmark controls to Linux systems for security hardening.
  Covers SSH configuration, kernel sysctl parameters, PAM settings,
  filesystem permissions, service disabling, and automated compliance auditing.
domain: cybersecurity
subdomain: blue-team
tags:
  - cis-benchmarks
  - linux-hardening
  - ssh
  - pam
  - sysctl
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1068"]
---

# Hardening Linux with CIS Benchmarks

## Overview

CIS Benchmarks provide prescriptive hardening guidance for Linux distributions.
This skill covers applying Level 1 and Level 2 controls for Ubuntu/Debian and
RHEL/CentOS, including SSH hardening, kernel parameters, PAM configuration,
filesystem permissions, and automated compliance auditing with Ansible.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Root or sudo access | System configuration changes |
| Ansible | Automated auditing and remediation |
| CIS Ansible role | `ansible-cis-ubuntu-2204` or equivalent |
| AIDE | File integrity monitoring |
| auditd | System call auditing |

## Key Concepts

### SSH Hardening (CIS Section 5.1)

```bash
# /etc/ssh/sshd_config hardened settings
Protocol 2
PermitRootLogin no
MaxAuthTries 4
PermitEmptyPasswords no
X11Forwarding no
AllowTcpForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 60
MaxSessions 4
Banner /etc/issue.net
AllowUsers deploy admin
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
```

```bash
# Validate SSH config
sshd -T | grep -i -E "permitrootlogin|maxauthtries|permitemptypasswords|x11forwarding"
```

### Kernel Hardening (sysctl)

```bash
# /etc/sysctl.d/99-cis-hardening.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
kernel.randomize_va_space = 2
kernel.sysrq = 0
kernel.core_uses_pid = 1
fs.suid_dumpable = 0
```

```bash
# Apply and verify
sysctl -p /etc/sysctl.d/99-cis-hardening.conf
sysctl -a | grep -E "rp_filter|syncookies|log_martians|accept_redirects"
```

### PAM Configuration

```bash
# /etc/pam.d/common-auth — account lockout
auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900

# /etc/security/pwquality.conf — password complexity
minlen = 14
minclass = 4
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
maxrepeat = 3
```

### Filesystem Permissions

```bash
# Critical file permissions (CIS Section 6)
chmod 644 /etc/passwd
chmod 000 /etc/shadow
chmod 644 /etc/group
chmod 000 /etc/gshadow
chmod 600 /etc/ssh/sshd_config
chmod 700 /etc/cron.d
chmod 700 /etc/cron.daily
chmod 700 /etc/cron.hourly

# Find world-writable files
find / -xdev -type f -perm -0002 -exec ls -l {} \; 2>/dev/null

# Find SUID/SGID binaries
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
```

### Service Hardening

```bash
# Disable unnecessary services
systemctl disable --now avahi-daemon
systemctl disable --now cups
systemctl disable --now rpcbind
systemctl disable --now nfs-server

# Verify only essential services
systemctl list-unit-files --state=enabled | grep -v '@'
ss -tlnp  # Map each listener to approved inventory
```

### Kernel Module Blacklisting

```bash
# /etc/modprobe.d/cis-blacklist.conf
install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install udf /bin/true
install usb-storage /bin/true
```

## Workflow

1. **Baseline** — `ansible-playbook --check -l target cis-site.yml` to assess current state
2. **Plan** — Review failures, prioritize Level 1 controls first
3. **Apply** — Implement changes (SSH → sysctl → PAM → permissions → services)
4. **Verify** — Re-run audit, confirm failure count decreases
5. **Monitor** — Deploy AIDE for file integrity, auditd for syscall logging
6. **Maintain** — Schedule quarterly re-audits

## Detection

```yaml
title: Hardening Linux With Cis Benchmarks Detection
id: 78e5ba91-d4a1-41aa-ba79-7dc3765891a5
status: experimental
description: Detects suspicious activity related to hardening linux with cis benchmarks techniques in blue team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*hardening*linux*"
  condition: selection
level: medium
tags:
  - attack.t1068
  - attack.defense_evasion
falsepositives:
  - Security team running authorized detection validation tools
```

## Verification

| Check | Method |
|---|---|
| SSH config compliant | `sshd -T` — all parameters match CIS values |
| sysctl applied | `sysctl -a \| grep rp_filter` — returns 1 |
| PAM lockout active | `faillock --user testuser` — after 5 failures |
| File permissions | `stat -c '%a %n' /etc/shadow` — 000 |
| Services minimized | `ss -tlnp` — only approved listeners |
| CIS audit score | Ansible `--check` pass rate > 90% |

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-123](https://csrc.nist.gov/publications/detail/sp/800-123/final)
- [OpenSSH Hardening Guide](https://www.ssh-audit.com/hardening_guides.html)
