[BESAdmin-Announcements] BigFix Compliance: Updated CIS Checklist for Debian Linux 12, published 2026-09-14
Announcements for BES Administrators
besadmin-announcements at bigmail.bigfix.com
Wed Sep 16 08:03:53 PDT 2026
*Product:*
BigFix Compliance
*Title:*
Updated CIS Checklist for Debian Linux 12
*Security Benchmark:*
CIS Debian Linux 12 Benchmark, V2.0.0
*Published Sites:*
CIS Checklist for Debian Linux 12, site version 4
(The site version is provided for air-gap customers.)
*Details: *
● Total New Fixlets: 83
● Total Updated Fixlets: 86
● Total Deleted Fixlets: 49
● Total Fixlets in Site: 327
*New Fixlets:*
● Ensure access to /etc/apt/auth.conf.d directory is configured
● Ensure access to /etc/apt/sources.list.d directory is configured
● Ensure access to /etc/apt/trusted.gpg.d directory is configured
● Ensure access to /etc/cron.yearly is configured
● Ensure access to /usr/share/keyrings directory is configured
● Ensure access to crontab is configured
● Ensure access to files in /etc/apt/sources.list.d are configured
● Ensure access to files in the /etc/apt/auth.conf.d/ directory is
configured
● Ensure access to pam_motd file is configured
● Ensure access to sshd warning banner is configured
● Ensure atm kernel module is not available
● Ensure Automatic Error Reporting is configured
● Ensure can kernel module is not available
● Ensure cryptographic mechanisms are used to protect the integrity of
audit tools
● Ensure events that modify /etc/group information are collected
● Ensure events that modify /etc/hosts and /etc/hostname are collected
● Ensure events that modify /etc/issue and /etc/issue.net are collected
● Ensure events that modify /etc/netplan are collected
● Ensure events that modify /etc/network and /etc/networks are
collected
● Ensure events that modify /etc/nsswitch.conf file are collected
● Ensure events that modify /etc/pam.conf and /etc/pam.d/ information
are collected
● Ensure events that modify /etc/passwd information are collected
● Ensure events that modify /etc/security/opasswd are collected
● Ensure events that modify /etc/shadow and /etc/gshadow are collected
● Ensure events that modify sethostname and setdomainname are collected
● Ensure firewire-core kernel module is not available
● Ensure fs.protected_hardlinks is configured
● Ensure fs.protected_symlinks is configured
● Ensure fs.suid_dumpable is configured
● Ensure GDM automount is configured
● Ensure GDM autorun-never is configured
● Ensure GDM disable-user-list is configured
● Ensure journald is configured to send logs to rsyslog
● Ensure kernel.dmesg_restrict is configured
● Ensure kernel.kptr_restrict is configured
● Ensure latest version of cracklib-runtime is installed
● Ensure net.ipv4.conf.all.accept_redirects is configured
● Ensure net.ipv4.conf.all.accept_source_route is configured
● Ensure net.ipv4.conf.all.forwarding is configured
● Ensure net.ipv4.conf.all.log_martians is configured
● Ensure net.ipv4.conf.all.rp_filter is configured
● Ensure net.ipv4.conf.all.secure_redirects is configured
● Ensure net.ipv4.conf.all.send_redirects is configured
● Ensure net.ipv4.conf.default.accept_redirects is configured
● Ensure net.ipv4.conf.default.accept_source_route is configured
● Ensure net.ipv4.conf.default.forwarding is configured
● Ensure net.ipv4.conf.default.log_martians is configured
● Ensure net.ipv4.conf.default.rp_filter is configured
● Ensure net.ipv4.conf.default.secure_redirects is configured
● Ensure net.ipv4.conf.default.send_redirects is configured
● Ensure net.ipv4.icmp_echo_ignore_broadcasts is configured
● Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured
● Ensure net.ipv4.ip_forward is configured
● Ensure net.ipv4.tcp_syncookies is configured
● Ensure net.ipv6.conf.all.accept_ra is configured
● Ensure net.ipv6.conf.all.accept_redirects is configured
● Ensure net.ipv6.conf.all.accept_source_route is configured
● Ensure net.ipv6.conf.all.forwarding is configured
● Ensure net.ipv6.conf.default.accept_ra is configured
● Ensure net.ipv6.conf.default.accept_redirects is configured
● Ensure net.ipv6.conf.default.accept_source_route is configured
● Ensure net.ipv6.conf.default.forwarding is configured
● Ensure overlay kernel module is not available
● Ensure pam_motd is configured
● Ensure rsyslog forwarding uses gtls
● Ensure rsyslog is configured to send logs to a remote log host
● Ensure rsyslog is installed
● Ensure rsyslog is not configured to receive logs from a remote client
● Ensure rsyslog log file creation mode is configured
● Ensure rsyslog service is enabled and active
● Ensure rsyslog-gnutls is installed
● Ensure sshd ListenAddress is configured
● Ensure sshd post-quantum cryptography key exchange algorithms are
configured
● Ensure sshd warning Banner is configured
● Ensure sudo timestamp_timeout is configured
● Ensure systemd-coredump ProcessSizeMax is configured
● Ensure systemd-coredump Storage is configured
● Ensure telnet server services are not in use
● Ensure the source.list and .source files use the Signed-By option
● Ensure ufw incoming default is configured
● Ensure ufw routed default is configured
● Ensure weak dependencies are configured
● Ensure Xwayland is configured
*Updated Fixlets:*
● Ensure /etc/issue is configured
● Ensure /etc/issue.net is configured
● Ensure /etc/motd is configured
● Ensure access to /etc/motd is configured
● Ensure access to /etc/security/opasswd is configured
● Ensure access to /etc/ssh/sshd_config is configured
● Ensure access to all logfiles has been configured
● Ensure access to at is configured
● Ensure access to the su command is restricted
● Ensure actions as another user are always logged
● Ensure all AppArmor Profiles are enforcing
● Ensure audit configuration files mode is configured
● Ensure audit configuration files owner is configured
● Ensure audit log files mode is configured
● Ensure audit log files owner is configured
● Ensure audit tools mode is configured
● Ensure audit tools owner is configured
● Ensure chrony is running as user _chrony
● Ensure dccp kernel module is not available
● Ensure default user shell timeout is configured
● Ensure dhcp server services are not in use
● Ensure file deletion events by users are collected
● Ensure filesystem integrity is regularly checked
● Ensure ftp client is not installed
● Ensure GDM login banner is configured
● Ensure GDM screen lock is configured
● Ensure group root is the only GID 0 group
● Ensure IPv6 status is identified
● Ensure journald Compress is configured
● Ensure kernel.randomize_va_space is configured
● Ensure kernel.yama.ptrace_scope is configured
● Ensure latest version of libpam-modules is installed
● Ensure latest version of libpam-pwquality is installed
● Ensure latest version of pam is installed
● Ensure local interactive user dot files access is configured
● Ensure local interactive user home directories are configured
● Ensure mail transfer agents are configured for local-only mode
● Ensure minimum password days is configured
● Ensure no duplicate GIDs exist
● Ensure no duplicate group names exist
● Ensure no duplicate UIDs exist
● Ensure no duplicate user names exist
● Ensure pam_unix includes a strong password hashing algorithm
● Ensure pam_unix includes use_authtok
● Ensure pam_unix module is enabled
● Ensure password complexity is configured
● Ensure password dictionary check is enabled
● Ensure password expiration is configured
● Ensure password failed attempts lockout includes root account
● Ensure prelink is not installed
● Ensure rds kernel module is not available
● Ensure root account access is controlled
● Ensure root path integrity
● Ensure root user umask is configured
● Ensure rsh client is not installed
● Ensure sctp kernel module is not available
● Ensure sshd access is configured
● Ensure sshd Ciphers are configured
● Ensure sshd ClientAliveInterval and ClientAliveCountMax are
configured
● Ensure sshd DisableForwarding is enabled
● Ensure sshd GSSAPIAuthentication is disabled
● Ensure sshd HostbasedAuthentication is disabled
● Ensure sshd IgnoreRhosts is enabled
● Ensure sshd KexAlgorithms is configured
● Ensure sshd LogLevel is configured
● Ensure sshd MACs are configured
● Ensure sshd MaxAuthTries is configured
● Ensure sshd MaxSessions is configured
● Ensure sshd MaxStartups is configured
● Ensure sshd PermitEmptyPasswords is disabled
● Ensure sshd PermitRootLogin is disabled
● Ensure sshd PermitUserEnvironment is disabled
● Ensure sshd UsePAM is enabled
● Ensure sudo commands use pty
● Ensure system is disabled when audit logs are full
● Ensure system warns when audit logs are low on space
● Ensure telnet client is not installed
● Ensure tipc kernel module is not available
● Ensure usb-storage kernel module is not available
● Ensure use of privileged commands are collected
● Ensure users must provide password for escalation
● Ensure web proxy server services are not in use
● Ensure web server services are not in use
● Ensure world writable files and directories are secured
● Ensure X window server services are not in use
● Ensure XDMCP is not enabled
*Deleted Fixlets:*
● Ensure a nftables table exists
● Ensure all AppArmor Profiles are in enforce or complain mode
● Ensure bogus icmp responses are ignored
● Ensure broadcast icmp requests are ignored
● Ensure core dumps are restricted
● Ensure crontab is restricted to authorized users
● Ensure events that modify the system's network environment are
collected
● Ensure events that modify user/group information are collected
● Ensure GDM automatic mounting of removable media is disabled
● Ensure GDM autorun-never is enabled
● Ensure GDM autorun-never is not overridden
● Ensure GDM disable-user-list option is enabled
● Ensure GDM disabling automatic mounting of removable media is not
overridden
● Ensure GDM is removed
● Ensure GDM screen locks cannot be overridden
● Ensure icmp redirects are not accepted
● Ensure ip forwarding is disabled
● Ensure ip6tables default deny firewall policy
● Ensure ip6tables loopback traffic is configured
● Ensure iptables are flushed with nftables
● Ensure iptables default deny firewall policy
● Ensure iptables loopback traffic is configured
● Ensure iptables packages are installed
● Ensure iptables-persistent is not installed with ufw
● Ensure ipv6 router advertisements are not accepted
● Ensure journald ForwardToSyslog is disabled
● Ensure nftables base chains exist
● Ensure nftables default deny firewall policy
● Ensure nftables is installed
● Ensure nftables is not installed with iptables
● Ensure nftables loopback traffic is configured
● Ensure nftables outbound and established connections are configured
● Ensure nftables rules are permanent
● Ensure nftables service is enabled
● Ensure only one logging system is in use
● Ensure packet redirect sending is disabled
● Ensure reverse path filtering is enabled
● Ensure secure icmp redirects are not accepted
● Ensure source routed packets are not accepted
● Ensure sudo authentication timeout is configured correctly
● Ensure suspicious packets are logged
● Ensure systemd-journal-remote authentication is configured
● Ensure systemd-journal-remote is installed
● Ensure systemd-journal-upload is enabled and active
● Ensure tcp syn cookies is enabled
● Ensure ufw default deny firewall policy
● Ensure ufw is uninstalled or disabled with iptables
● Ensure ufw is uninstalled or disabled with nftables
● Ensure ufw loopback traffic is configured
*Additional details:*
● Both analysis and remediation checks are included.
● Some of the checks allow you to use the parameterized setting to
enable customization for compliance evaluation. Note that parameterization
and remediation actions require the creation of a custom site.
● Improved a few checks by adding the pending restart feature to them.
The pending restart feature works in the following ways:
● The action results will show “Pending Restart” instead of “Fixed”
for those checks which require OS reboot.
● The check will show relevant for those endpoints until they are
rebooted.
● Post reboot of the endpoint the action results will show as “Fixed”
and the check will be compliant.
*Action to take:*
● To subscribe to the above site, you can use the License Overview
Dashboard to enable and gather the site. Note that you must be entitled to
the BigFix Compliance product and you must be using BigFix version 10.0.0
and later.
● If you use custom sites, update your custom sites accordingly to use
the latest content. You can synchronize your content by using the
Synchronize Custom Checks wizard. For more information, see Using the
Synchronize Custom Checks wizard
<https://help.hcltechsw.com/bigfix/11.0/compliance/Compliance/SCM_Users_Guide/c_using_synchronize_custom_checks_wiz.html>
*More information: *To know more about the BigFix Compliance SCM
checklists, please see the following resources:
● BigFix Forum:
*Compliance (Release Announcements)*
<https://forum.bigfix.com/c/release-announcements/compliance/63>
This category is used by HCL to announce new releases for BigFix Compliance.
● BigFix Compliance SCM Checklists:
*SCM Checklists*
<https://forum.bigfix.com/c/release-announcements/scm-checklists/86>
This category is the central reference for all SCM Checklists supported by
BigFix Compliance. It covers the complete list of active checklists across
all supported frameworks and platforms, including CIS, DISA STIG, PCI DSS,
NIST, and more, along with site name, version details, and supported OS
versions.
We hope you find this latest release of SCM content useful and effective.
Thank you!
*– The BigFix Compliance team*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260916/f3f7aa65/attachment.html>
More information about the Besadmin-announcements
mailing list