---
policy: CIS Benchmark for Ubuntu 22.04 LTS
title: CIS Benchmark for Ubuntu 22.04 LTS
id: cis_ubuntu2204
version: 2.0.0
source: https://www.cisecurity.org/cis-benchmarks

levels:
    - id: l1_server
    - id: l2_server
      inherits_from:
          - l1_server
    - id: l1_workstation
    - id: l2_workstation
      inherits_from:
          - l1_workstation

reference_type: cis
product: ubuntu2204

controls:
    - id: 1.1.1.1
      title: Ensure cramfs kernel module is not available (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - kernel_module_cramfs_disabled
      status: automated

    - id: 1.1.1.2
      title: Ensure freevxfs kernel module is not available (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - kernel_module_freevxfs_disabled
      status: automated

    - id: 1.1.1.3
      title: Ensure hfs kernel module is not available (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - kernel_module_hfs_disabled
      status: automated

    - id: 1.1.1.4
      title: Ensure hfsplus kernel module is not available (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - kernel_module_hfsplus_disabled
      status: automated

    - id: 1.1.1.5
      title: Ensure jffs2 kernel module is not available (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - kernel_module_jffs2_disabled
      status: automated

    - id: 1.1.1.6
      title: Ensure squashfs kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_squashfs_disabled
      status: automated

    - id: 1.1.1.7
      title: Ensure udf kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_udf_disabled
      status: automated

    - id: 1.1.1.8
      title: Ensure usb-storage kernel module is not available (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - kernel_module_usb-storage_disabled
      status: automated

    - id: 1.1.2.1.1
      title: Ensure /tmp is a separate partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - partition_for_tmp
      status: automated

    - id: 1.1.2.1.2
      title: Ensure nodev option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_tmp_nodev
      status: automated

    - id: 1.1.2.1.3
      title: Ensure nosuid option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_tmp_nosuid
      status: automated

    - id: 1.1.2.1.4
      title: Ensure noexec option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_tmp_noexec
      status: automated

    - id: 1.1.2.2.1
      title: Ensure /dev/shm is a separate partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - partition_for_dev_shm
      status: automated

    - id: 1.1.2.2.2
      title: Ensure nodev option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_dev_shm_nodev
      status: automated

    - id: 1.1.2.2.3
      title: Ensure nosuid option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_dev_shm_nosuid
      status: automated

    - id: 1.1.2.2.4
      title: Ensure noexec option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_dev_shm_noexec
      status: automated

    - id: 1.1.2.3.1
      title: Ensure separate partition exists for /home (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - partition_for_home
      status: automated

    - id: 1.1.2.3.2
      title: Ensure nodev option set on /home partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_home_nodev
      status: automated

    - id: 1.1.2.3.3
      title: Ensure nosuid option set on /home partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_home_nosuid
      status: automated

    - id: 1.1.2.4.1
      title: Ensure separate partition exists for /var (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - partition_for_var
      status: automated

    - id: 1.1.2.4.2
      title: Ensure nodev option set on /var partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_nodev
      status: automated

    - id: 1.1.2.4.3
      title: Ensure nosuid option set on /var partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_nosuid
      status: automated

    - id: 1.1.2.5.1
      title: Ensure separate partition exists for /var/tmp (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - partition_for_var_tmp
      status: automated

    - id: 1.1.2.5.2
      title: Ensure nodev option set on /var/tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_tmp_nodev
      status: automated

    - id: 1.1.2.5.3
      title: Ensure nosuid option set on /var/tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_tmp_nosuid
      status: automated

    - id: 1.1.2.5.4
      title: Ensure noexec option set on /var/tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_tmp_noexec
      status: automated

    - id: 1.1.2.6.1
      title: Ensure separate partition exists for /var/log (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - partition_for_var_log
      status: automated

    - id: 1.1.2.6.2
      title: Ensure nodev option set on /var/log partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_nodev
      status: automated

    - id: 1.1.2.6.3
      title: Ensure nosuid option set on /var/log partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_nosuid
      status: automated

    - id: 1.1.2.6.4
      title: Ensure noexec option set on /var/log partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_noexec
      status: automated

    - id: 1.1.2.7.1
      title: Ensure separate partition exists for /var/log/audit (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - partition_for_var_log_audit
      status: automated

    - id: 1.1.2.7.2
      title: Ensure nodev option set on /var/log/audit partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_audit_nodev
      status: automated

    - id: 1.1.2.7.3
      title: Ensure nosuid option set on /var/log/audit partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_audit_nosuid
      status: automated

    - id: 1.1.2.7.4
      title: Ensure noexec option set on /var/log/audit partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - mount_option_var_log_audit_noexec
      status: automated

    - id: 1.2.1.1
      title: Ensure GPG keys are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 1.2.1.2
      title: Ensure package manager repositories are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 1.2.2.1
      title: Ensure updates, patches, and additional security software are installed (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 1.3.1.1
      title: Ensure AppArmor is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_apparmor_installed
          - package_apparmor-utils_installed
      status: automated

    - id: 1.3.1.2
      title: Ensure AppArmor is enabled in the bootloader configuration (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - grub2_enable_apparmor
      status: automated

    - id: 1.3.1.3
      title: Ensure all AppArmor Profiles are in enforce or complain mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_apparmor_mode=enforce
          - all_apparmor_profiles_in_enforce_complain_mode
      status: automated

    - id: 1.3.1.4
      title: Ensure all AppArmor Profiles are enforcing (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - all_apparmor_profiles_enforced
      status: automated

    - id: 1.4.1
      title: Ensure bootloader password is set (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - grub2_password
          - grub2_uefi_password
      status: automated

    - id: 1.4.2
      title: Ensure access to bootloader config is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_owner_grub2_cfg
          - file_permissions_grub2_cfg
      status: automated

    - id: 1.5.1
      title: Ensure address space layout randomization is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_kernel_randomize_va_space
      status: automated

    - id: 1.5.2
      title: Ensure ptrace_scope is restricted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_kernel_yama_ptrace_scope_value=1
          - sysctl_kernel_yama_ptrace_scope
      status: automated

    - id: 1.5.3
      title: Ensure core dumps are restricted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - disable_users_coredumps
          - sysctl_fs_suid_dumpable
      status: automated

    - id: 1.5.4
      title: Ensure prelink is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_prelink_removed
      status: automated

    - id: 1.5.5
      title: Ensure Automatic Error Reporting is not enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - service_apport_disabled
      status: automated

    - id: 1.6.1
      title: Ensure message of the day is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - cis_banner_text=cis
          - banner_etc_motd_cis
      status: automated

    - id: 1.6.2
      title: Ensure local login warning banner is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - cis_banner_text=cis
          - banner_etc_issue_cis
      status: automated

    - id: 1.6.3
      title: Ensure remote login warning banner is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - cis_banner_text=cis
          - banner_etc_issue_net_cis
      status: automated

    - id: 1.6.4
      title: Ensure access to /etc/motd is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_motd
          - file_owner_etc_motd
          - file_permissions_etc_motd
      status: automated

    - id: 1.6.5
      title: Ensure access to /etc/issue is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_issue
          - file_owner_etc_issue
          - file_permissions_etc_issue
      status: automated

    - id: 1.6.6
      title: Ensure access to /etc/issue.net is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_issue_net
          - file_owner_etc_issue_net
          - file_permissions_etc_issue_net
      status: automated

    - id: 1.7.1
      title: Ensure GDM is removed (Automated)
      levels:
          - l2_server
      rules:
          - package_gdm_removed
      status: automated

    - id: 1.7.2
      title: Ensure GDM login banner is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - login_banner_text=cis_default
          - dconf_gnome_banner_enabled
          - dconf_gnome_login_banner_text
      status: automated

    - id: 1.7.3
      title: Ensure GDM disable-user-list option is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - dconf_gnome_disable_user_list
      status: automated

    - id: 1.7.4
      title: Ensure GDM screen locks when the user is idle (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - inactivity_timeout_value=15_minutes
          - var_screensaver_lock_delay=5_seconds
          - dconf_gnome_screensaver_idle_delay
          - dconf_gnome_screensaver_lock_enabled
          - dconf_gnome_screensaver_lock_delay
      status: automated

    - id: 1.7.5
      title: Ensure GDM screen locks cannot be overridden (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - dconf_gnome_screensaver_idle_delay
          - dconf_gnome_screensaver_lock_enabled
          - dconf_gnome_screensaver_lock_delay
      status: automated

    - id: 1.7.6
      title: Ensure GDM automatic mounting of removable media is disabled (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - dconf_gnome_disable_automount
          - dconf_gnome_disable_automount_open
      status: automated

    - id: 1.7.7
      title: Ensure GDM disabling automatic mounting of removable media is not overridden (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - dconf_gnome_disable_automount
          - dconf_gnome_disable_automount_open
      status: automated

    - id: 1.7.8
      title: Ensure GDM autorun-never is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: 1.7.9
      title: Ensure GDM autorun-never is not overridden (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - dconf_gnome_disable_autorun
      status: automated

    - id: 1.7.10
      title: Ensure XDMCP is not enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - gnome_gdm_disable_xdmcp
      status: automated

    - id: 2.1.1
      title: Ensure autofs services are not in use (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - service_autofs_disabled
          - package_autofs_removed
      status: automated

    - id: 2.1.2
      title: Ensure avahi daemon services are not in use (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - package_avahi_removed
          - service_avahi-daemon_disabled
      status: automated

    - id: 2.1.3
      title: Ensure dhcp server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_dhcp_removed
          - service_dhcpd_disabled
          - service_dhcpd6_disabled
      status: automated

    - id: 2.1.4
      title: Ensure dns server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_bind_removed
      status: automated

    - id: 2.1.5
      title: Ensure dnsmasq services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_dnsmasq_removed
          - service_dnsmasq_disabled
      status: automated

    - id: 2.1.6
      title: Ensure ftp server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_vsftpd_removed
          - service_vsftpd_disabled
      status: automated

    - id: 2.1.7
      title: Ensure ldap server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_openldap-servers_removed
          - service_slapd_disabled
      status: automated

    - id: 2.1.8
      title: Ensure message access server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_dovecot_removed
          - service_dovecot_disabled
      status: automated

    - id: 2.1.9
      title: Ensure network file system services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_nfs-kernel-server_removed
          - service_nfs_disabled
      status: automated

    - id: 2.1.10
      title: Ensure nis server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_ypserv_removed
          - service_ypserv_disabled
      status: automated

    - id: 2.1.11
      title: Ensure print server services are not in use (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - package_cups_removed
          - service_cups_disabled
      status: automated

    - id: 2.1.12
      title: Ensure rpcbind services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_rpcbind_removed
          - service_rpcbind_disabled
      status: automated

    - id: 2.1.13
      title: Ensure rsync services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_rsync_removed
          - service_rsyncd_disabled
      status: automated

    - id: 2.1.14
      title: Ensure samba file server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_samba_removed
          - service_smb_disabled
      status: automated

    - id: 2.1.15
      title: Ensure snmp services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_net-snmp_removed
          - service_snmpd_disabled
      status: automated

    - id: 2.1.16
      title: Ensure tftp server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_tftp-server_removed
          - service_tftp_disabled
      status: automated

    - id: 2.1.17
      title: Ensure web proxy server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_squid_removed
          - service_squid_disabled
      status: automated

    - id: 2.1.18
      title: Ensure web server services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_httpd_removed
          - package_nginx_removed
          - service_httpd_disabled
          - service_nginx_disabled
      status: automated

    - id: 2.1.19
      title: Ensure xinetd services are not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_xinetd_removed
          - service_xinetd_disabled
      status: automated

    - id: 2.1.20
      title: Ensure X window server services are not in use (Automated)
      levels:
          - l2_server
      rules:
          - package_xorg-x11-server-common_removed
      status: automated

    - id: 2.1.21
      title: Ensure mail transfer agent is configured for local-only mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - has_nonlocal_mta
          - var_postfix_inet_interfaces=loopback-only
          - postfix_network_listening_disabled
      status: automated

    - id: 2.1.22
      title: Ensure only approved services are listening on a network interface (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 2.2.1
      title: Ensure NIS Client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_nis_removed
      status: automated

    - id: 2.2.2
      title: Ensure rsh client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_rsh_removed
      status: automated

    - id: 2.2.3
      title: Ensure talk client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_talk_removed
      status: automated

    - id: 2.2.4
      title: Ensure telnet client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_telnet_removed
      status: automated

    - id: 2.2.5
      title: Ensure ldap client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_openldap-clients_removed
      status: automated

    - id: 2.2.6
      title: Ensure ftp client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_ftp_removed
      status: automated

    - id: 2.3.1.1
      title: Ensure a single time synchronization daemon is in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_timesync_service=systemd-timesyncd
          - package_chrony_installed
          - service_chronyd_enabled
          - service_chronyd_disabled
          - package_timesyncd_installed
          - service_timesyncd_enabled
          - service_timesyncd_disabled
          - ntp_single_service_active
      status: automated

    - id: 2.3.2.1
      title: Ensure systemd-timesyncd configured with authorized timeserver (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_multiple_time_servers=nist
          - service_timesyncd_configured
      status: automated

    - id: 2.3.2.2
      title: Ensure systemd-timesyncd is enabled and running (Manual)
      levels:
          - l1_server
          - l1_workstation
      related_rules:
          - service_timesyncd_enabled
          - service_timesyncd_disabled
      status: automated
      notes: Implemented in 2.3.1.1

    - id: 2.3.3.1
      title: Ensure chrony is configured with authorized timeserver (Manual)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_multiple_time_servers=nist
          - var_multiple_time_pools=nist
          - chronyd_configure_pool_and_server
      status: partial
      notes: |
          Rule does not check or remediate config files included via
          confdir and sourcedir directives.

    - id: 2.3.3.2
      title: Ensure chrony is running as user _chrony (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - chronyd_run_as_chrony_user
      status: automated

    - id: 2.3.3.3
      title: Ensure chrony is enabled and running (Automated)
      levels:
          - l1_server
          - l1_workstation
      related_rules:
          - service_chronyd_enabled
          - service_chronyd_disabled
      status: automated
      notes: Implemented in 2.3.1.1

    - id: 2.4.1.1
      title: Ensure cron daemon is enabled and active (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_cron_installed
          - service_cron_enabled
      status: automated

    - id: 2.4.1.2
      title: Ensure permissions on /etc/crontab are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_crontab
          - file_owner_crontab
          - file_permissions_crontab
      status: automated

    - id: 2.4.1.3
      title: Ensure permissions on /etc/cron.hourly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly
      status: automated

    - id: 2.4.1.4
      title: Ensure permissions on /etc/cron.daily are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_cron_daily
          - file_owner_cron_daily
          - file_permissions_cron_daily
      status: automated

    - id: 2.4.1.5
      title: Ensure permissions on /etc/cron.weekly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_cron_weekly
          - file_owner_cron_weekly
          - file_permissions_cron_weekly
      status: automated

    - id: 2.4.1.6
      title: Ensure permissions on /etc/cron.monthly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_cron_monthly
          - file_owner_cron_monthly
          - file_permissions_cron_monthly
      status: automated

    - id: 2.4.1.7
      title: Ensure permissions on /etc/cron.d are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_cron_d
          - file_owner_cron_d
          - file_permissions_cron_d
      status: automated

    - id: 2.4.1.8
      title: Ensure crontab is restricted to authorized users (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_cron_allow_exists
          - file_cron_deny_not_exist
          - file_groupowner_cron_allow
          - file_owner_cron_allow
          - file_permissions_cron_allow
      status: automated
      notes: |
          Current benchmark requires cron.allow group owned by
          root which will cause cron have no access. See ticket:
          https://workbench.cisecurity.org/tickets/21619

    - id: 2.4.2.1
      title: Ensure at is restricted to authorized users (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_at_allow_exists
          - file_groupowner_at_allow
          - file_owner_at_allow
          - file_permissions_at_allow
          - file_groupowner_at_deny
          - file_owner_at_deny
          - file_permissions_at_deny
      status: automated

    - id: 3.1.1
      title: Ensure IPv6 status is identified (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 3.1.2
      title: Ensure wireless interfaces are disabled (Automated)
      levels:
          - l1_server
      rules:
          - wireless_disable_interfaces
      status: automated

    - id: 3.1.3
      title: Ensure bluetooth services are not in use (Automated)
      levels:
          - l1_server
          - l2_workstation
      rules:
          - service_bluetooth_disabled
      status: automated

    - id: 3.2.1
      title: Ensure dccp kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_dccp_disabled
      status: automated

    - id: 3.2.2
      title: Ensure tipc kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_tipc_disabled
      status: automated

    - id: 3.2.3
      title: Ensure rds kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_rds_disabled
      status: automated

    - id: 3.2.4
      title: Ensure sctp kernel module is not available (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - kernel_module_sctp_disabled
      status: automated

    - id: 3.3.1
      title: Ensure ip forwarding is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv6_conf_all_forwarding
          - sysctl_net_ipv4_ip_forward
      status: automated

    - id: 3.3.2
      title: Ensure packet redirect sending is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects
      status: automated

    - id: 3.3.3
      title: Ensure bogus icmp responses are ignored (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
      status: automated

    - id: 3.3.4
      title: Ensure broadcast icmp requests are ignored (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
      status: automated

    - id: 3.3.5
      title: Ensure icmp redirects are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv6_conf_all_accept_redirects
          - sysctl_net_ipv6_conf_default_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_default_accept_redirects
      status: automated

    - id: 3.3.6
      title: Ensure secure icmp redirects are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects
      status: automated

    - id: 3.3.7
      title: Ensure reverse path filtering is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter
      status: automated

    - id: 3.3.8
      title: Ensure source routed packets are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv6_conf_all_accept_source_route
          - sysctl_net_ipv6_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route
      status: automated

    - id: 3.3.9
      title: Ensure suspicious packets are logged (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
          - sysctl_net_ipv4_conf_default_log_martians
      status: automated

    - id: 3.3.10
      title: Ensure tcp syn cookies is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv4_tcp_syncookies
      status: automated

    - id: 3.3.11
      title: Ensure ipv6 router advertisements are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
          - sysctl_net_ipv6_conf_default_accept_ra
      status: automated

    - id: 4.1.1
      title: Ensure ufw is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_network_filtering_service=nftables
          - package_ufw_installed
      status: automated

    - id: 4.1.2
      title: Ensure iptables-persistent is not installed with ufw (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_iptables-persistent_removed
      status: automated

    - id: 4.1.3
      title: Ensure ufw service is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - check_ufw_active
          - service_ufw_enabled
      status: automated

    - id: 4.1.4
      title: Ensure ufw loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_ufw_loopback_traffic
      status: automated

    - id: 4.1.5
      title: Ensure ufw outbound connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 4.1.6
      title: Ensure ufw firewall rules exist for all open ports (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - ufw_rules_for_open_ports
      status: automated

    - id: 4.1.7
      title: Ensure ufw default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_ufw_default_rule
      status: automated

    - id: 4.2.1
      title: Ensure nftables is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_nftables_installed
      status: automated

    - id: 4.2.2
      title: Ensure ufw is uninstalled or disabled with nftables (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_ufw_removed
      status: automated

    - id: 4.2.3
      title: Ensure iptables are flushed with nftables (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 4.2.4
      title: Ensure a nftables table exists (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_nftables_family=inet
          - var_nftables_table=filter
          - set_nftables_table
      status: automated

    - id: 4.2.5
      title: Ensure nftables base chains exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_nftables_base_chain_names=chain_names
          - var_nftables_base_chain_types=chain_types
          - var_nftables_base_chain_hooks=chain_hooks
          - var_nftables_base_chain_priorities=chain_priorities
          - var_nftables_base_chain_policies=chain_policies
          - set_nftables_base_chain
      status: automated

    - id: 4.2.6
      title: Ensure nftables loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_nftables_loopback_traffic
      status: automated

    - id: 4.2.7
      title: Ensure nftables outbound and established connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 4.2.8
      title: Ensure nftables default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - nftables_ensure_default_deny_policy
      status: automated

    - id: 4.2.9
      title: Ensure nftables service is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - service_nftables_enabled
      status: automated

    - id: 4.2.10
      title: Ensure nftables rules are permanent (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_nftables_master_config_file=etc
          - nftables_rules_permanent
      status: automated

    - id: 4.3.1.1
      title: Ensure iptables packages are installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_iptables-persistent_installed
          - package_iptables_installed
      status: automated

    - id: 4.3.1.2
      title: Ensure nftables is not installed with iptables (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - service_nftables_disabled
      status: automated

    - id: 4.3.1.3
      title: Ensure ufw is uninstalled or disabled with iptables (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_ufw_removed
      status: automated

    - id: 4.3.2.1
      title: Ensure iptables default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_iptables_default_rule
      status: automated

    - id: 4.3.2.2
      title: Ensure iptables loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_loopback_traffic
      status: automated

    - id: 4.3.2.3
      title: Ensure iptables outbound and established connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 4.3.2.4
      title: Ensure iptables firewall rules exist for all open ports (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - iptables_rules_for_open_ports
      status: automated

    - id: 4.3.3.1
      title: Ensure ip6tables default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_ip6tables_default_rule
      status: automated

    - id: 4.3.3.2
      title: Ensure ip6tables loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_ipv6_loopback_traffic
      status: automated

    - id: 4.3.3.3
      title: Ensure ip6tables outbound and established connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 4.3.3.4
      title: Ensure ip6tables firewall rules exist for all open ports (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - ip6tables_rules_for_open_ports
      status: automated

    - id: 5.1.1
      title: Ensure permissions on /etc/ssh/sshd_config are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config
      status: automated

    - id: 5.1.2
      title: Ensure permissions on SSH private host key files are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_permissions_sshd_private_key
      status: automated

    - id: 5.1.3
      title: Ensure permissions on SSH public host key files are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_permissions_sshd_pub_key
      status: automated

    - id: 5.1.4
      title: Ensure sshd access is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_limit_user_access
      status: automated

    - id: 5.1.5
      title: Ensure sshd Banner is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_enable_warning_banner_net
      status: automated

    - id: 5.1.6
      title: Ensure sshd Ciphers are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_use_strong_ciphers
      status: automated

    - id: 5.1.7
      title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_idle_timeout_value=5_minutes
          - var_sshd_set_keepalive=3
          - sshd_set_idle_timeout
          - sshd_set_keepalive
      status: automated

    - id: 5.1.8
      title: Ensure sshd DisableForwarding is enabled (Automated)
      levels:
          - l1_workstation
          - l2_server
      rules:
          - sshd_disable_forwarding
      status: automated

    - id: 5.1.9
      title: Ensure sshd GSSAPIAuthentication is disabled (Automated)
      levels:
          - l1_workstation
          - l2_server
      rules:
          - sshd_disable_gssapi_auth
      status: automated

    - id: 5.1.10
      title: Ensure sshd HostbasedAuthentication is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - disable_host_auth
      status: automated

    - id: 5.1.11
      title: Ensure sshd IgnoreRhosts is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_disable_rhosts
      status: automated

    - id: 5.1.12
      title: Ensure sshd KexAlgorithms is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_strong_kex=cis_ubuntu2204
          - sshd_use_strong_kex
      status: automated

    - id: 5.1.13
      title: Ensure sshd LoginGraceTime is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_sshd_set_login_grace_time=60
          - sshd_set_login_grace_time
      status: automated

    - id: 5.1.14
      title: Ensure sshd LogLevel is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_set_loglevel_info
      status: automated

    - id: 5.1.15
      title: Ensure sshd MACs are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_strong_macs=cis_ubuntu2204
          - sshd_use_strong_macs
      status: automated

    - id: 5.1.16
      title: Ensure sshd MaxAuthTries is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_max_auth_tries_value=4
          - sshd_set_max_auth_tries
      status: automated

    - id: 5.1.17
      title: Ensure sshd MaxSessions is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_sshd_max_sessions=10
          - sshd_set_max_sessions
      status: automated

    - id: 5.1.18
      title: Ensure sshd MaxStartups is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_sshd_set_maxstartups=10:30:60
          - sshd_set_maxstartups
      status: automated

    - id: 5.1.19
      title: Ensure sshd PermitEmptyPasswords is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_disable_empty_passwords
      status: automated

    - id: 5.1.20
      title: Ensure sshd PermitRootLogin is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_disable_root_login
      status: automated

    - id: 5.1.21
      title: Ensure sshd PermitUserEnvironment is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_do_not_permit_user_env
      status: automated

    - id: 5.1.22
      title: Ensure sshd UsePAM is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sshd_enable_pam
      status: automated

    - id: 5.2.1
      title: Ensure sudo is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_sudo_installed
      status: automated

    - id: 5.2.2
      title: Ensure sudo commands use pty (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sudo_add_use_pty
      status: automated

    - id: 5.2.3
      title: Ensure sudo log file exists (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sudo_custom_logfile
      status: automated

    - id: 5.2.4
      title: Ensure users must provide password for privilege escalation (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - sudo_require_authentication
      status: automated

    - id: 5.2.5
      title: Ensure re-authentication for privilege escalation is not disabled globally (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - sudo_remove_no_authenticate
      status: automated

    - id: 5.2.6
      title: Ensure sudo authentication timeout is configured correctly (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_sudo_timestamp_timeout=15_minutes
          - sudo_require_reauthentication
      status: automated

    - id: 5.2.7
      title: Ensure access to the su command is restricted (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_pam_wheel_group_for_su=cis
          - ensure_pam_wheel_group_empty
          - use_pam_wheel_group_for_su
      status: automated

    - id: 5.3.1.1
      title: Ensure latest version of pam is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_pam_runtime_installed
      status: automated

    - id: 5.3.1.2
      title: Ensure libpam-modules is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_pam_modules_installed
      status: automated

    - id: 5.3.1.3
      title: Ensure libpam-pwquality is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_pam_pwquality_installed
      status: automated

    - id: 5.3.2.1
      title: Ensure pam_unix module is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_unix_enabled
      status: automated

    - id: 5.3.2.2
      title: Ensure pam_faillock module is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_passwords_pam_faillock_enabled
      status: automated

    - id: 5.3.2.3
      title: Ensure pam_pwquality module is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_pwquality_enabled
      status: automated

    - id: 5.3.2.4
      title: Ensure pam_pwhistory module is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_pwhistory_enabled
      status: automated

    - id: 5.3.3.1.1
      title: Ensure password failed attempts lockout is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_passwords_pam_faillock_deny=4
          - accounts_passwords_pam_faillock_deny
      status: automated

    - id: 5.3.3.1.2
      title: Ensure password unlock time is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_passwords_pam_faillock_unlock_time=900
          - accounts_passwords_pam_faillock_unlock_time
      status: automated

    - id: 5.3.3.1.3
      title: Ensure password failed attempts lockout includes root account (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_accounts_passwords_pam_faillock_root_unlock_time=60
          - accounts_passwords_pam_faillock_root_unlock_time
      status: automated

    - id: 5.3.3.2.1
      title: Ensure password number of changed characters is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_difok=2
          - accounts_password_pam_difok
      status: automated

    - id: 5.3.3.2.2
      title: Ensure minimum password length is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_minlen=14
          - accounts_password_pam_minlen
      status: automated

    - id: 5.3.3.2.3
      title: Ensure password complexity is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_minclass=4
          - var_password_pam_dcredit=1
          - var_password_pam_lcredit=1
          - var_password_pam_ocredit=1
          - var_password_pam_ucredit=1
          - accounts_password_pam_minclass
          - accounts_password_pam_dcredit
          - accounts_password_pam_lcredit
          - accounts_password_pam_ocredit
          - accounts_password_pam_ucredit
      status: manual

    - id: 5.3.3.2.4
      title: Ensure password same consecutive characters is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_maxrepeat=3
          - accounts_password_pam_maxrepeat
      status: automated

    - id: 5.3.3.2.5
      title: Ensure password maximum sequential characters is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_maxsequence
      status: automated

    - id: 5.3.3.2.6
      title: Ensure password dictionary check is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_dictcheck=1
          - accounts_password_pam_dictcheck
      status: automated

    - id: 5.3.3.2.7
      title: Ensure password quality checking is enforced (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_enforcing=1
          - accounts_password_pam_enforcing
      status: automated

    - id: 5.3.3.2.8
      title: Ensure password quality is enforced for the root user (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_enforce_root
      status: automated

    - id: 5.3.3.3.1
      title: Ensure password history remember is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_pam_remember=24
          - accounts_password_pam_pwhistory_remember
      status: automated

    - id: 5.3.3.3.2
      title: Ensure password history is enforced for the root user (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_pwhistory_enforce_root
      status: automated

    - id: 5.3.3.3.3
      title: Ensure pam_pwhistory includes use_authtok (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_pwhistory_use_authtok
      status: automated

    - id: 5.3.3.4.1
      title: Ensure pam_unix does not include nullok (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_empty_passwords_unix
      status: automated

    - id: 5.3.3.4.2
      title: Ensure pam_unix does not include remember (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_unix_no_remember
      status: automated

    - id: 5.3.3.4.3
      title: Ensure pam_unix includes a strong password hashing algorithm (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_password_hashing_algorithm_pam=yescrypt
          - set_password_hashing_algorithm_systemauth
      status: automated

    - id: 5.3.3.4.4
      title: Ensure pam_unix includes use_authtok (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_pam_unix_authtok
      status: automated

    - id: 5.4.1.1
      title: Ensure password expiration is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_maximum_age_login_defs=365
          - accounts_maximum_age_login_defs
          - accounts_password_set_max_life_existing
      status: automated

    - id: 5.4.1.2
      title: Ensure minimum password age is configured (Manual)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_accounts_minimum_age_login_defs=1
          - accounts_minimum_age_login_defs
          - accounts_password_set_min_life_existing
      status: automated

    - id: 5.4.1.3
      title: Ensure password expiration warning days is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_password_warn_age_login_defs=7
          - accounts_password_warn_age_login_defs
      status: automated

    - id: 5.4.1.4
      title: Ensure strong password hashing algorithm is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - set_password_hashing_algorithm_logindefs
          - var_password_hashing_algorithm=cis_ubuntu2204
      status: automated
      notes: Rule allows either SHA512 or YESCRYPT

    - id: 5.4.1.5
      title: Ensure inactive password lock is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_account_disable_post_pw_expiration=45
          - account_disable_post_pw_expiration
          - accounts_set_post_pw_existing
      status: automated

    - id: 5.4.1.6
      title: Ensure all users last password change date is in the past (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_last_change_is_in_past
      status: automated

    - id: 5.4.2.1
      title: Ensure root is the only UID 0 account (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_no_uid_except_zero
      status: automated

    - id: 5.4.2.2
      title: Ensure root is the only GID 0 account (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_root_gid_zero
      status: automated

    - id: 5.4.2.3
      title: Ensure group root is the only GID 0 group (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - groups_no_zero_gid_except_root
      status: automated

    - id: 5.4.2.4
      title: Ensure root password is set (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - ensure_root_access_controlled
      status: automated
      notes: |
          This rule doesn't come with a remediation, as the exact requirement allows root to either
          have a password or be locked.

    - id: 5.4.2.5
      title: Ensure root path integrity (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_root_path_dirs_no_write
          - root_path_all_dirs
          - root_path_no_dot
          - no_dirs_unowned_by_root
      status: automated

    - id: 5.4.2.6
      title: Ensure root user umask is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_umask_root
      status: automated

    - id: 5.4.2.7
      title: Ensure system accounts do not have a valid login shell (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_shelllogin_for_systemaccounts
      status: automated

    - id: 5.4.2.8
      title: Ensure accounts without a valid login shell are locked (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_invalid_shell_accounts_unlocked
      status: automated

    - id: 5.4.3.1
      title: Ensure nologin is not listed in /etc/shells (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - no_nologin_in_shells
      status: automated

    - id: 5.4.3.2
      title: Ensure default user shell timeout is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_tmout=15_min
          - accounts_tmout
      status: automated

    - id: 5.4.3.3
      title: Ensure default user umask is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - var_accounts_user_umask=027
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_login_defs
          - accounts_umask_etc_profile
      status: automated

    - id: 6.1.1
      title: Ensure AIDE is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - aide_build_database
          - package_aide_installed
      status: automated

    - id: 6.1.2
      title: Ensure filesystem integrity is regularly checked (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - aide_periodic_cron_checking
      status: automated

    - id: 6.1.3
      title: Ensure cryptographic mechanisms are used to protect the integrity of audit tools (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - aide_check_audit_tools
      status: automated

    - id: 6.2.1.1.1
      title: Ensure journald service is enabled and active (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - service_systemd-journald_enabled
      status: automated

    - id: 6.2.1.1.2
      title: Ensure journald log file access is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 6.2.1.1.3
      title: Ensure journald log file rotation is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 6.2.1.1.4
      title: Ensure journald ForwardToSyslog is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - journald_disable_forward_to_syslog
      status: automated

    - id: 6.2.1.1.5
      title: Ensure journald Storage is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - journald_storage
      status: automated

    - id: 6.2.1.1.6
      title: Ensure journald Compress is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - journald_compress
      status: automated

    - id: 6.2.1.2.1
      title: Ensure systemd-journal-remote is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - package_systemd-journal-remote_installed
      status: automated

    - id: 6.2.1.2.2
      title: Ensure systemd-journal-remote authentication is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - systemd_journal_upload_server_tls
          - systemd_journal_upload_url
      status: automated

    - id: 6.2.1.2.3
      title: Ensure systemd-journal-upload is enabled and active (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - service_systemd-journal-upload_enabled
      status: automated

    - id: 6.2.1.2.4
      title: Ensure systemd-journal-remote service is not in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - socket_systemd-journal-remote_disabled
      status: automated

    - id: 6.2.2.1
      title: Ensure access to all logfiles has been configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupownerships_var_log_apt
          - file_groupownerships_var_log_gdm
          - file_groupownerships_var_log_gdm3
          - file_groupownerships_var_log_landscape
          - file_groupownerships_var_log_sssd
          - file_groupowner_var_log_auth
          - file_groupowner_var_log_cloud_init
          - file_groupowner_var_log_journal
          - file_groupowner_var_log_lastlog
          - file_groupowner_var_log_localmessages
          - file_groupowner_var_log_messages
          - file_groupowner_var_log_secure
          - file_groupowner_var_log_syslog
          - file_groupowner_var_log_waagent
          - file_groupowner_var_log_wbtmp
          - file_ownerships_var_log_apt
          - file_ownerships_var_log_gdm
          - file_ownerships_var_log_gdm3
          - file_ownerships_var_log_landscape
          - file_ownerships_var_log_sssd
          - file_owner_var_log_auth
          - file_owner_var_log_cloud_init
          - file_owner_var_log_journal
          - file_owner_var_log_lastlog
          - file_owner_var_log_localmessages
          - file_owner_var_log_messages
          - file_owner_var_log_secure
          - file_owner_var_log_syslog
          - file_owner_var_log_waagent
          - file_owner_var_log_wbtmp
          - file_permissions_var_log_apt
          - file_permissions_var_log_auth
          - file_permissions_var_log_cloud-init
          - file_permissions_var_log_gdm
          - file_permissions_var_log_gdm3
          - file_permissions_var_log_lastlog
          - file_permissions_var_log_cloud-init
          - file_permissions_var_log_localmessages
          - file_permissions_var_log_messages
          - file_permissions_var_log_secure
          - file_permissions_var_log_sssd
          - file_permissions_var_log_syslog
          - file_permissions_var_log_waagent
          - file_permissions_var_log_wbtmp
          - file_groupownerships_var_log
          - file_ownerships_var_log
          - permissions_local_var_log
      status: automated

    - id: 6.3.1.1
      title: Ensure auditd packages are installed (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - package_audit_installed
          - package_audit-audispd-plugins_installed
      status: automated

    - id: 6.3.1.2
      title: Ensure auditd service is enabled and active (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - service_auditd_enabled
      status: automated

    - id: 6.3.1.3
      title: Ensure auditing for processes that start prior to auditd is enabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - grub2_audit_argument
          - zipl_audit_argument
      status: automated

    - id: 6.3.1.4
      title: Ensure audit_backlog_limit is sufficient (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192
          - zipl_audit_backlog_limit_argument
      status: automated

    - id: 6.3.2.1
      title: Ensure audit log storage size is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_auditd_max_log_file=6
          - auditd_data_retention_max_log_file
      status: automated

    - id: 6.3.2.2
      title: Ensure audit logs are not automatically deleted (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_auditd_max_log_file_action=keep_logs
          - auditd_data_retention_max_log_file_action
      status: automated

    - id: 6.3.2.3
      title: Ensure system is disabled when audit logs are full (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_auditd_disk_error_action=cis_ubuntu2204
          - var_auditd_disk_full_action=cis_ubuntu2204
          - auditd_data_disk_error_action
          - auditd_data_disk_full_action
      status: automated

    - id: 6.3.2.4
      title: Ensure system warns when audit logs are low on space (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_auditd_action_mail_acct=root
          - var_auditd_space_left_action=email
          - var_auditd_admin_space_left_action=halt
          - auditd_data_retention_action_mail_acct
          - auditd_data_retention_admin_space_left_action
          - auditd_data_retention_space_left_action
      status: automated

    - id: 6.3.3.1
      title: Ensure changes to system administration scope (sudoers) is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_sysadmin_actions
      status: automated

    - id: 6.3.3.2
      title: Ensure actions as another user are always logged (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_suid_auid_privilege_function
      status: automated

    - id: 6.3.3.3
      title: Ensure events that modify the sudo log file are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_sudo_log_events
      status: automated

    - id: 6.3.3.4
      title: Ensure events that modify date and time information are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_time_adjtimex
          - audit_rules_time_clock_settime
          - audit_rules_time_settimeofday
          - audit_rules_time_watch_localtime
      status: automated

    - id: 6.3.3.5
      title: Ensure events that modify the system's network environment are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_networkconfig_modification
      status: automated

    - id: 6.3.3.6
      title: Ensure use of privileged commands are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_privileged_commands
      status: automated

    - id: 6.3.3.7
      title: Ensure unsuccessful file access attempts are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_ftruncate
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
      status: automated

    - id: 6.3.3.8
      title: Ensure events that modify user/group information are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow
          - audit_rules_usergroup_modification_nsswitch_conf
          - audit_rules_usergroup_modification_pam_conf
          - audit_rules_usergroup_modification_pamd
      status: automated

    - id: 6.3.3.9
      title: Ensure discretionary access control permission modification events are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lchown
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr
      status: automated

    - id: 6.3.3.10
      title: Ensure successful file system mounts are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_media_export
      status: automated

    - id: 6.3.3.11
      title: Ensure session initiation information is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_session_events
      status: automated

    - id: 6.3.3.12
      title: Ensure login and logout events are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - var_accounts_passwords_pam_faillock_dir=run
          - audit_rules_login_events_faillock
          - audit_rules_login_events_lastlog
      status: automated

    - id: 6.3.3.13
      title: Ensure file deletion events by users are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat
      status: automated

    - id: 6.3.3.14
      title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_mac_modification_etc_apparmor
          - audit_rules_mac_modification_etc_apparmor_d
      status: automated

    - id: 6.3.3.15
      title: Ensure successful and unsuccessful attempts to use the chcon command are recorded (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_execution_chcon
      status: automated

    - id: 6.3.3.16
      title: Ensure successful and unsuccessful attempts to use the setfacl command are recorded (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_execution_setfacl
      status: automated

    - id: 6.3.3.17
      title: Ensure successful and unsuccessful attempts to use the chacl command are recorded (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_execution_chacl
      status: automated

    - id: 6.3.3.18
      title: Ensure successful and unsuccessful attempts to use the usermod command are recorded (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_privileged_commands_usermod
      status: automated

    - id: 6.3.3.19
      title: Ensure kernel module loading unloading and modification is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_kernel_module_loading_delete
          - audit_rules_kernel_module_loading_init
          - audit_rules_kernel_module_loading_finit
          - audit_rules_privileged_commands_kmod
      status: automated

    - id: 6.3.3.20
      title: Ensure the audit configuration is immutable (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - audit_rules_immutable
      status: automated

    - id: 6.3.3.21
      title: Ensure the running and on disk configuration is the same (Manual)
      levels:
          - l2_server
          - l2_workstation
      status: manual

    - id: 6.3.4.1
      title: Ensure audit log files mode is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_permissions_var_log_audit
      status: automated

    - id: 6.3.4.2
      title: Ensure audit log files owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_ownership_var_log_audit_stig
      status: automated

    - id: 6.3.4.3
      title: Ensure audit log files group owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_group_ownership_var_log_audit
      status: automated

    - id: 6.3.4.4
      title: Ensure the audit log file directory mode is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - directory_permissions_var_log_audit
      status: automated

    - id: 6.3.4.5
      title: Ensure audit configuration files mode is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_permissions_etc_audit_auditd
          - file_permissions_etc_audit_rules
          - file_permissions_etc_audit_rulesd
      status: automated

    - id: 6.3.4.6
      title: Ensure audit configuration files owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_ownership_audit_configuration
      status: automated

    - id: 6.3.4.7
      title: Ensure audit configuration files group owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_groupownership_audit_configuration
      status: automated

    - id: 6.3.4.8
      title: Ensure audit tools mode is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_permissions_audit_binaries
      status: automated

    - id: 6.3.4.9
      title: Ensure audit tools owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_ownership_audit_binaries
      status: automated

    - id: 6.3.4.10
      title: Ensure audit tools group owner is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      rules:
          - file_groupownership_audit_binaries
      status: automated

    - id: 7.1.1
      title: Ensure permissions on /etc/passwd are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd
      status: automated

    - id: 7.1.2
      title: Ensure permissions on /etc/passwd- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_permissions_backup_etc_passwd
      status: automated

    - id: 7.1.3
      title: Ensure permissions on /etc/group are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group
      status: automated

    - id: 7.1.4
      title: Ensure permissions on /etc/group- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_backup_etc_group
          - file_owner_backup_etc_group
          - file_permissions_backup_etc_group
      status: automated

    - id: 7.1.5
      title: Ensure permissions on /etc/shadow are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_shadow
          - file_owner_etc_shadow
          - file_permissions_etc_shadow
      status: automated

    - id: 7.1.6
      title: Ensure permissions on /etc/shadow- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_permissions_backup_etc_shadow
      status: automated

    - id: 7.1.7
      title: Ensure permissions on /etc/gshadow are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow
          - file_permissions_etc_gshadow
      status: automated

    - id: 7.1.8
      title: Ensure permissions on /etc/gshadow- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow
          - file_permissions_backup_etc_gshadow
      status: automated

    - id: 7.1.9
      title: Ensure permissions on /etc/shells are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_owner_etc_shells
          - file_groupowner_etc_shells
          - file_permissions_etc_shells
      status: automated

    - id: 7.1.10
      title: Ensure permissions on /etc/security/opasswd are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_owner_etc_security_opasswd
          - file_groupowner_etc_security_opasswd
          - file_permissions_etc_security_opasswd
          - file_owner_etc_security_opasswd_old
          - file_groupowner_etc_security_opasswd_old
          - file_permissions_etc_security_opasswd_old
      status: automated

    - id: 7.1.11
      title: Ensure world writable files and directories are secured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - file_permissions_unauthorized_world_writable
      status: automated

    - id: 7.1.12
      title: Ensure no files or directories without an owner and a group exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_files_unowned_by_user
          - file_permissions_ungroupowned
      status: automated

    - id: 7.1.13
      title: Ensure SUID and SGID files are reviewed (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 7.2.1
      title: Ensure accounts in /etc/passwd use shadowed passwords (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_password_all_shadowed
      status: automated

    - id: 7.2.2
      title: Ensure /etc/shadow password fields are not empty (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_empty_passwords_etc_shadow
      status: automated

    - id: 7.2.3
      title: Ensure all groups in /etc/passwd exist in /etc/group (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - gid_passwd_group_same
      status: automated

    - id: 7.2.4
      title: Ensure shadow group is empty (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - ensure_shadow_group_empty
      status: automated

    - id: 7.2.5
      title: Ensure no duplicate UIDs exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - account_unique_id
      status: automated

    - id: 7.2.6
      title: Ensure no duplicate GIDs exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - group_unique_id
      status: automated

    - id: 7.2.7
      title: Ensure no duplicate user names exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - account_unique_name
      status: automated

    - id: 7.2.8
      title: Ensure no duplicate group names exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - group_unique_name
      status: automated

    - id: 7.2.9
      title: Ensure local interactive user home directories are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - accounts_user_interactive_home_directory_exists
          - file_groupownership_home_directories
          - file_ownership_home_directories
          - file_permissions_home_directories
      status: automated

    - id: 7.2.10
      title: Ensure local interactive user dot files access is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      rules:
          - no_rsh_trust_files
          - no_forward_files
          - no_netrc_files
          - accounts_user_dot_user_ownership
          - accounts_user_dot_group_ownership
          - var_user_initialization_files_regex=all_dotfiles
          - file_permission_user_init_files
          - file_permission_user_bash_history
      status: automated
