massyn / centos-cis-benchmark

CIS CentOS Linux 7 Benchmark

centos-cis-benchmark

Based on CIS CentOS Linux 7 Benchmark v2.2.0 - 12-27-2017

How to run the audit

To run the audit, execute these steps

git clone https://github.com/massyn/centos-cis-benchmark
cd centos-cis-benchmark
sudo bash run-cis-benchmark.sh

The following tests must be executed manually. These are dependent on your own site configuration, and needs a manual check. By default, the audit scripts will fail these checks.

• 1.2.1 - Ensure package manager repositories are configured (Not Scored)
• 3.4.2 - Ensure /etc/hosts.allow is configured (Scored)
• 3.4.3 - Ensure /etc/hosts.deny is configured (Scored)
• 3.6.4 - Ensure outbound and established connections are configured (Not Scored)
• 5.5 - Ensure root login is restricted to system console (Not Scored)

Remediation

Some remediation scripts are also included, however use them at your own risk. While most of the scripts would correct the problem, they could cause outages on your system, so be sure to have a proper roll back plan before you execute the scripts.

Acknowledgement

• https://github.com/haxorof/centos-bench-security

centos-cis-benchmark's Issues

3.6.5 - Ensure firewall rules exist for all open ports (Scored)

1.2.3 Ensure gpgcheck is globally activated (Scored)

If found in the first one, there's no need to check the remaining paths

4.1.9 Ensure session initiation information is collected (Scored)

Check session vs login...

1.2.2 - Ensure GPG keys are configured (Not Scored)

5.5 - Ensure root login is restricted to system console (Not Scored)

4.3 - Ensure logrotate is configured (Not Scored)

4.2.1.2 - Ensure logging is configured (Not Scored)

4.2.1.5 - Ensure remote rsyslog messages are only accepted on designated log hosts. (Not Scored)

1.1.1.8 Ensure mounting of FAT filesystems is disabled (Scored)

Module checking is not failing correctly

5.4.1.5 - Ensure all users last password change date is in the past (Scored)

Scripts don't fail if they don't have root access

Some tests require root access to operate. Instead of failing, they fail silently with error code 0, giving the impression that everything is ok.

While some of the tests can be run without root access, you should always run the script as root, to ensure all the tests are correctly executed.

This issue is to work through the ones that do not fail correctly, and update the script to fail. For this benchmark, it is better to have a false negative than it is to have a false positive.

Issues checking subfolders may not find the sub-files

Tests that include sub folders, like sysctl.d/*.conf may not find it correctly. Review the tests, and update the bash check to an ls

1.5.3 - Ensure address space layout randomization (ASLR) is enabled (Scored)

If sysctl checks out fine, there is no need to check the files too.

5.2.11 - Ensure only approved MAC algorithms are used (Scored)

2.2.1.2 - Ensure ntp is configured (Scored)

grep -E bug

CIS Benchmark Centos 8

Hi Massyn,

It is great how is divided in test cases. Do you know if there is a Centos 8 repository somewhere else in Github. I was not able to find it, but I think there is one somewhere.

Thank you,
Guillermo

5.2.12 Ensure SSH Idle Timeout Interval is configured (Scored)

Setting of 300 is ok .. Check the logic of -gt vs -ge

2.2.15 Ensure mail transfer agent is configured for local-only mode (Scored)

The test appears to be working in reverse, finding a valid test and failing it.

5.3.2 - Ensure lockout for failed password attempts is configured (Scored)

4.2.2.5 - Ensure remote syslog-ng messages are only accepted on designated log hosts (Not Scored)

3.6.4 - Ensure outbound and established connections are configured (Not Scored)

1.1.18/19/20 - Detect removable media

1.5.1, 1.5.3

Fails when there are no files in /etc/sysctl.d/*

5.3.3 - Ensure password reuse is limited (Scored)

4.2.1.3 - Ensure rsyslog default file permissions configured (Scored)

4.2.2.3 - Ensure syslog-ng default file permissions configured (Scored)

5.4.2 Ensure system accounts are non-login (Scored)

Test is not testing anything.

5.4.1.5 - Ensure all users last password change date is in the past (Scored)

Find a way to read the date from chage that can easly be checked if it is in future or not

1.2.1 - Ensure package manager repositories are configured (Not Scored)

1.1.1.2 - Issue can fail even if the module is not installed

FATAL: Module freevxfs not found.

5.5 - Ensure root login is restricted to system console (Not Scored)

Investigate this a bit more -- it may be a manual check

4.2.2.2 - Ensure logging is configured (Not Scored)