CIS Level 2 - Linux Guidelines

For more details about Center for Internet Security (CIS) please refer to this document.

Instruction steps

Install the UA client

bash
Copy

Set up the Ubuntu Security Guide

Bash
Copy

Check SCAP Content Overview (Security Content Automation Protocol)

Bash
Copy

Auditing an Ubuntu System for DISA-STIG Compliance

Bash
Copy

The report is generated in /var/lib/usg/

Applying the CIS rules to a set of systems

There are 2 ways to apply CIS rules.

Method 1: directly using usg command - recommend

Bash
Copy

Method 2: using usg to generate a script and then run the script

Bash
Copy

Notes:

  • A reboot is required to take effect after applying the fix.
  • CIS Level 2 requires /tmp folder to be mounted in a separate partition. Please ensure that the new partition has enough disk space for MetaDefender Core to run.

Running fix for Ubuntu 24.04

When generating the fix script in Ubuntu 24.04, there will be 2 rules (in the generated script - fix.sh) that change the permission and owner of the folder /var/log:

#240: xccdf_org.ssgproject.content_rule_file_groupownerships_var_log

#255: xccdf_org.ssgproject.content_rule_file_ownerships_var_log

These 2 rules will change the permission and owner of the product log also var/log/ometascan .

To prevent this, before running the fix script, the user needs to add metascan group, for example, with rule #240.

Bash
Copy

Also do the same with rule #255 to prevent update permission and the owner of var/log/ometascan

Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard