[BESAdmin-Announcements] BigFix Compliance: Updated CIS Checklist for Ubuntu 24.04 LTS Server, published 2026-08-14
Announcements for BES Administrators
besadmin-announcements at bigmail.bigfix.com
Fri Aug 14 06:41:22 PDT 2026
*Product:*
BigFix Compliance
*Title:*
Updated CIS Checklist for Ubuntu 24.04 LTS Server.
*Security Benchmark:*
CIS Ubuntu Linux 24.04 LTS Benchmark, v2.0.0
*Published Sites:*
CIS Checklist for Ubuntu 24.04 LTS Server, site version 5
(The site version is provided for air-gap customers.)
*Details:*
● *Total New Fixlets: 122*
● *Total Updated Fixlets: 129*
● *Total Deleted Fixlets: 101*
● *Total Fixlets in Site: 322*
*New Fixlets:*
● Ensure overlay kernel module is not available
● Ensure firewire-core kernel module is not available
● Ensure /tmp is tmpfs or a separate partition
● Ensure /dev/shm is tmpfs or a separate partition
● Ensure the source.list and .source files use the Signed-By option
● Ensure weak dependencies are configured
● Ensure access to gpg key files are configured
● Ensure access to /etc/apt/trusted.gpg.d directory is configured
● Ensure access to /etc/apt/auth.conf.d directory is configured
● Ensure access to files in the /etc/apt/auth.conf.d/ directory is
configured
● Ensure access to /usr/share/keyrings directory is configured
● Ensure access to /etc/apt/sources.list.d directory is configured
● Ensure access to files in /etc/apt/sources.list.d are configured
● Ensure apparmor packages are installed
● Ensure AppArmor is enabled
● Ensure apparmor_restrict_unprivileged_unconfined is enabled
● Ensure fs.protected_hardlinks is configured
● Ensure fs.protected_symlinks is configured
● Ensure kernel.yama.ptrace_scope is configured
● Ensure fs.suid_dumpable is configured
● Ensure kernel.dmesg_restrict is configured
● Ensure Automatic Error Reporting is configured
● Ensure kernel.kptr_restrict is configured
● Ensure kernel.randomize_va_space is configured
● Ensure core file size is configured
● Ensure systemd-coredump ProcessSizeMax is configured
● Ensure systemd-coredump Storage is configured
● Ensure /etc/motd is configured
● Ensure /etc/issue is configured
● Ensure /etc/issue.net is configured
● Ensure pam_motd is configured
● Ensure sshd warning Banner is configured
● Ensure access to pam_motd file is configured
● Ensure access to sshd warning banner is configured
● Ensure GDM disable-user-list is configured
● Ensure GDM screen lock is configured
● Ensure GDM automount is configured
● Ensure GDM autorun-never is configured
● Ensure Xwayland is configured
● Ensure mail transfer agents are configured for local-only mode
● Ensure telnet server services are not in use
● Ensure nis client is not installed
● Ensure chrony is configured
● Ensure access to /etc/crontab is configured
● Ensure access to /etc/cron.hourly is configured
● Ensure access to /etc/cron.daily is configured
● Ensure access to /etc/cron.weekly is configured
● Ensure access to /etc/cron.monthly is configured
● Ensure access to /etc/cron.yearly is configured
● Ensure access to /etc/cron.d is configured
● Ensure access to crontab is configured
● Ensure access to at is configured
● Ensure wireless interfaces are not available
● Ensure atm kernel module is not available
● Ensure can kernel module is not available
● Ensure net.ipv4.ip_forward is configured
● Ensure net.ipv4.conf.all.forwarding is configured
● Ensure net.ipv4.conf.default.forwarding is configured
● Ensure net.ipv4.conf.all.send_redirects is configured
● Ensure net.ipv4.conf.default.send_redirects is configured
● Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured
● Ensure net.ipv4.icmp_echo_ignore_broadcasts is configured
● Ensure net.ipv4.conf.all.accept_redirects is configured
● Ensure net.ipv4.conf.default.accept_redirects is configured
● Ensure net.ipv4.conf.all.secure_redirects is configured
● Ensure net.ipv4.conf.default.secure_redirects is configured
● Ensure net.ipv4.conf.all.rp_filter is configured
● Ensure net.ipv4.conf.default.rp_filter is configured
● Ensure net.ipv4.conf.all.accept_source_route is configured
● Ensure net.ipv4.conf.default.accept_source_route is configured
● Ensure net.ipv4.conf.all.log_martians is configured
● Ensure net.ipv4.conf.default.log_martians is configured
● Ensure net.ipv4.tcp_syncookies is configured
● Ensure net.ipv6.conf.all.forwarding is configured
● Ensure net.ipv6.conf.default.forwarding is configured
● Ensure net.ipv6.conf.all.accept_redirects is configured
● Ensure net.ipv6.conf.default.accept_redirects is configured
● Ensure net.ipv6.conf.all.accept_source_route is configured
● Ensure net.ipv6.conf.default.accept_source_route is configured
● Ensure net.ipv6.conf.all.accept_ra is configured
● Ensure net.ipv6.conf.default.accept_ra is configured
● Ensure ufw service is configured
● Ensure ufw incoming default is configured
● Ensure ufw outgoing default is configured
● Ensure ufw routed default is configured
● Ensure access to /etc/ssh/sshd_config is configured
● Ensure access to SSH private host key files is configured
● Ensure access to SSH public host key files is configured
● Ensure sshd post-quantum cryptography key exchange algorithms are
configured
● Ensure sshd ListenAddress is configured
● Ensure users must provide password for escalation
● Ensure sudo timestamp_timeout is configured
● Ensure latest version of libpam-modules is installed
● Ensure latest version of libpam-pwquality is installed
● Ensure latest version of cracklib-runtime is installed
● Ensure password length is configured
● Ensure journald service is active
● Ensure rsyslog-gnutls is installed
● Ensure rsyslog forwarding uses gtls
● Ensure rsyslog CA certificates are configured
● Ensure audit_backlog_limit is configured
● Ensure events that modify sethostname and setdomainname are collected
● Ensure events that modify /etc/issue and /etc/issue.net are collected
● Ensure events that modify /etc/hosts and /etc/hostname are collected
● Ensure events that modify /etc/network and /etc/networks are
collected
● Ensure events that modify /etc/netplan are collected
● Ensure events that modify /etc/group information are collected
● Ensure events that modify /etc/passwd information are collected
● Ensure events that modify /etc/shadow and /etc/gshadow are collected
● Ensure events that modify /etc/security/opasswd are collected
● Ensure events that modify /etc/nsswitch.conf file are collected
● Ensure events that modify /etc/pam.conf and /etc/pam.d/ information
are collected
● Ensure access to /etc/passwd is configured
● Ensure access to /etc/passwd- is configured
● Ensure access to /etc/group is configured
● Ensure access to /etc/group- is configured
● Ensure access to /etc/shadow is configured
● Ensure access to /etc/shadow- is configured
● Ensure access to /etc/gshadow is configured
● Ensure access to /etc/gshadow- is configured
● Ensure access to /etc/shells is configured
● Ensure access to /etc/security/opasswd is configured
*Updated Fixlets:*
● Ensure cramfs kernel module is not available
● Ensure freevxfs kernel module is not available
● Ensure hfs kernel module is not available
● Ensure hfsplus kernel module is not available
● Ensure jffs2 kernel module is not available
● Ensure squashfs kernel module is not available
● Ensure udf kernel module is not available
● Ensure usb-storage kernel module is not available
● Ensure unused filesystems kernel modules are not available
● Ensure nosuid option set on /tmp partition
● Ensure noexec option set on /tmp partition
● Ensure separate partition exists for /home
● Ensure nodev option set on /home partition
● Ensure nosuid option set on /home partition
● Ensure separate partition exists for /var
● Ensure nodev option set on /var partition
● Ensure nosuid option set on /var partition
● Ensure separate partition exists for /var/tmp
● Ensure separate partition exists for /var/log
● Ensure separate partition exists for /var/log/audit
● Ensure updates, patches, and additional security software are
installed
● Ensure all AppArmor Profiles are enforcing
● Ensure bootloader password is set
● Ensure access to /etc/motd is configured
● Ensure access to /etc/issue is configured
● Ensure access to /etc/issue.net is configured
● Ensure GDM login banner is configured
● Ensure XDMCP is not enabled
● Ensure autofs services are not in use
● Ensure avahi daemon services are not in use
● Ensure dhcp server services are not in use
● Ensure web server services are not in use
● Ensure ftp server services are not in use
● Ensure dnsmasq services are not in use
● Ensure ldap server services are not in use
● Ensure message access server services are not in use
● Ensure network file system services are not in use
● Ensure nis server services are not in use
● Ensure print server services are not in use
● Ensure rpcbind services are not in use
● Ensure rsync services are not in use
● Ensure samba file server services are not in use
● Ensure snmp services are not in use
● Ensure tftp server services are not in use
● Ensure web proxy server services are not in use
● Ensure telnet client is not installed
● Ensure ftp client is not installed
● Ensure systemd-timesyncd configured with authorized timeserver
● Ensure dccp kernel module is not available
● Ensure rds kernel module is not available
● Ensure sctp kernel module is not available
● Ensure tipc kernel module is not available
● Ensure ufw is installed
● Ensure sshd access is configured
● Ensure sshd Banner is configured
● Ensure sshd Ciphers are configured
● Ensure sshd ClientAliveInterval and ClientAliveCountMax are
configured
● Ensure sshd DisableForwarding is enabled
● Ensure sshd GSSAPIAuthentication is disabled
● Ensure sshd HostbasedAuthentication is disabled
● Ensure sshd IgnoreRhosts is enabled
● Ensure sshd KexAlgorithms is configured
● Ensure sshd LoginGraceTime is configured
● Ensure sshd LogLevel is configured
● Ensure sshd MACs are configured
● Ensure sshd MaxAuthTries is configured
● Ensure sshd MaxStartups is configured
● Ensure sshd MaxSessions is configured
● Ensure sshd PermitEmptyPasswords is disabled
● Ensure sshd PermitRootLogin is disabled
● Ensure sshd PermitUserEnvironment is disabled
● Ensure sshd UsePAM is enabled
● Ensure sudo log file exists
● Ensure re-authentication for privilege escalation is not disabled
globally
● Ensure access to the su command is restricted
● Ensure latest version of pam is installed
● Ensure pam_unix module is enabled
● Ensure pam_pwquality module is enabled
● Ensure pam_pwhistory module is enabled
● Ensure password failed attempts lockout includes root account
● Ensure password complexity is configured
● Ensure password same consecutive characters is configured
● Ensure password quality is enforced for the root user
● Ensure password history remember is configured
● Ensure password history is enforced for the root user
● Ensure pam_pwhistory includes use_authtok
● Ensure pam_unix does not include nullok
● Ensure pam_unix does not include remember
● Ensure pam_unix includes a strong password hashing algorithm
● Ensure minimum password days is configured
● Ensure strong password hashing algorithm is configured
● Ensure inactive password lock is configured
● Ensure all users last password change date is in the past
● Ensure root is the only UID 0 account
● Ensure root path integrity
● Ensure root user umask is configured
● Ensure default user shell timeout is configured
● Ensure default user umask is configured
● Ensure journald is configured to send logs to rsyslog
● Ensure journald log file access is configured
● Ensure journald log file rotation is configured
● Ensure journald Storage is configured
● Ensure journald Compress is configured
● Ensure rsyslog log file creation mode is configured
● Ensure rsyslog logging is configured
● Ensure rsyslog is configured to send logs to a remote log host
● Ensure rsyslog is not configured to receive logs from a remote client
● Ensure logrotate is configured
● Ensure access to all logfiles has been configured
● Ensure auditing for processes that start prior to auditd is enabled
● Ensure system warns when audit logs are low on space
● Ensure changes to system administration scope (sudoers) is collected
● Ensure actions as another user are always logged
● Ensure events that modify the sudo log file are collected
● Ensure events that modify date and time information are collected
● Ensure discretionary access control permission modification events
are collected
● Ensure session initiation information is collected
● Ensure login and logout events are collected
● Ensure file deletion events by users are collected
● Ensure events that modify the system's Mandatory Access Controls are
collected
● Ensure kernel module loading unloading and modification is collected
● Ensure the audit configuration is immutable
● Ensure audit log files group owner is configured
● Ensure audit tools group owner is configured
● Ensure world writable files and directories are secured
● Ensure no files or directories without an owner and a group exist
● Ensure no duplicate UIDs exist
● Ensure no duplicate user names exist
● Ensure local interactive user home directories are configured
*Deleted Fixlets:*
● Configure systemd-journald service
● Ensure overlayfs kernel module is not available
● Ensure /tmp is a separate partition
● Ensure /dev/shm is a separate partition
● Ensure GPG keys are configured
● Ensure package manager repositories are configured
● Ensure AppArmor is installed
● Ensure AppArmor is enabled in the bootloader configuration
● Ensure all AppArmor Profiles are in enforce or complain mode
● Ensure address space layout randomization is enabled
● Ensure ptrace_scope is restricted
● Ensure core dumps are restricted
● Ensure Automatic Error Reporting is not enabled
● Ensure message of the day is configured properly
● Ensure local login warning banner is configured properly
● Ensure remote login warning banner is configured properly
● Ensure GDM is removed
● Ensure GDM disable-user-list option is enabled
● Ensure GDM screen locks when the user is idle
● Ensure GDM screen locks cannot be overridden
● Ensure GDM automatic mounting of removable media is disabled
● Ensure GDM disabling automatic mounting of removable media is not
overridden
● Ensure GDM autorun-never is enabled
● Ensure GDM autorun-never is not overridden
● Ensure mail transfer agent is configured for local-only mode
● Ensure NIS Client is not installed
● Ensure chrony is configured with authorized timeserver
● Ensure permissions on /etc/crontab are configured
● Ensure permissions on /etc/cron.hourly are configured
● Ensure permissions on /etc/cron.daily are configured
● Ensure permissions on /etc/cron.weekly are configured
● Ensure permissions on /etc/cron.monthly are configured
● Ensure permissions on /etc/cron.d are configured
● Ensure crontab is restricted to authorized users
● Ensure at is restricted to authorized users
● Ensure wireless interfaces are disabled
● Ensure ip forwarding is disabled
● Ensure packet redirect sending is disabled
● Ensure bogus icmp responses are ignored
● Ensure broadcast icmp requests are ignored
● Ensure icmp redirects are not accepted
● Ensure secure icmp redirects are not accepted
● Ensure reverse path filtering is enabled
● Ensure source routed packets are not accepted
● Ensure suspicious packets are logged
● Ensure tcp syn cookies is enabled
● Ensure ipv6 router advertisements are not accepted
● Ensure a single firewall configuration utility is in use
● Ensure iptables-persistent is not installed with ufw
● Ensure ufw service is enabled
● Ensure ufw loopback traffic is configured
● Ensure ufw outbound connections are configured
● Ensure ufw firewall rules exist for all open ports
● Ensure ufw default deny firewall policy
● Ensure nftables is installed
● Ensure ufw is uninstalled or disabled with nftables
● Ensure iptables are flushed with nftables
● Ensure a nftables table exists
● Ensure nftables base chains exist
● Ensure nftables loopback traffic is configured
● Ensure nftables outbound and established connections are configured
● Ensure nftables default deny firewall policy
● Ensure nftables service is enabled
● Ensure nftables rules are permanent
● Ensure iptables packages are installed
● Ensure nftables is not in use with iptables
● Ensure ufw is not in use with iptables
● Ensure iptables default deny firewall policy
● Ensure iptables loopback traffic is configured
● Ensure iptables outbound and established connections are configured
● Ensure iptables firewall rules exist for all open ports
● Ensure ip6tables default deny firewall policy
● Ensure ip6tables loopback traffic is configured
● Ensure ip6tables outbound and established connections are configured
● Ensure ip6tables firewall rules exist for all open ports
● Ensure permissions on /etc/ssh/sshd_config are configured
● Ensure permissions on SSH private host key files are configured
● Ensure permissions on SSH public host key files are configured
● Ensure users must provide password for privilege escalation
● Ensure sudo authentication timeout is configured correctly
● Ensure libpam-modules is installed
● Ensure libpam-pwquality is installed
● Ensure minimum password length is configured
● Ensure journald service is enabled and active
● Ensure only one logging system is in use
● Ensure journald ForwardToSyslog is disabled
● Ensure systemd-journal-remote is installed
● Ensure systemd-journal-upload authentication is configured
● Ensure systemd-journal-upload is enabled and active
● Ensure audit_backlog_limit is sufficient
● Ensure events that modify the system's network environment are
collected
● Ensure events that modify user/group information are collected
● Ensure permissions on /etc/passwd are configured
● Ensure permissions on /etc/passwd- are configured
● Ensure permissions on /etc/group are configured
● Ensure permissions on /etc/group- are configured
● Ensure permissions on /etc/shadow are configured
● Ensure permissions on /etc/shadow- are configured
● Ensure permissions on /etc/gshadow are configured
● Ensure permissions on /etc/gshadow- are configured
● Ensure permissions on /etc/shells are configured
● Ensure permissions on /etc/security/opasswd are configured
*Additional details:*
● Both analysis and remediation checks are included
● Some of the checks allow you to use the parameterized setting to enable
customization for compliance evaluation. Note that parameterization and
remediation actions require the creation of a custom site.
Improved few checks by adding the pending restart feature to them. The
pending restart feature works in the following ways:
● The action results will show “Pending Restart” instead of “Fixed” for
those checks which requires OS reboot.
● The check will show relevant for those endpoints until they are rebooted.
● Post reboot of the endpoint the action results will show as “Fixed” and
the check will be compliant.
*Actions to take:*
● To subscribe to the above site, you can use the License Overview
Dashboard to enable and gather the site. Note that you must be entitled to
the BigFix Compliance product and you must be using BigFix version 10.0.7
and later.
●If you use custom sites, update your custom sites accordingly to use the
latest content. You can synchronize your content by using the Synchronize
Custom Checks wizard. For more information, see Using the Synchronize
Custom Checks wizard
<https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html>
*More information:*
To know more about the BigFix Compliance SCM checklists, please see the
following resources:
● BigFix Forum:
https://forum.bigfix.com/c/release-announcements/compliance
● BigFix Compliance SCM Checklists:
https://forum.bigfix.com/c/release-announcements/scm-checklists/86
We hope you find this latest release of SCM content useful and effective.
Thank you!
*– The BigFix Compliance team*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260814/d90cedf9/attachment.html>
More information about the Besadmin-announcements
mailing list