Amazon Linux 2023 Security Checklist (Ver 1, Rel 2)

16 items · Security · Hard difficulty · 2 hours

Essential Amazon Linux 2023 hardening tasks derived from the DISA STIG.

• Update all system packages

  Run dnf update (or package manager) and reboot if kernel updated.

• Enable automatic security updates

  Install/configure dnf-automatic or equivalent to apply security patches automatically.

• Apply the Amazon Linux 2023 STIG baseline

  Import the DISA XCCDF/SCAP profile and apply the recommended configuration settings.

• Harden SSH: disable root login

  Set PermitRootLogin no in /etc/ssh/sshd_config and restart sshd.

• Harden SSH: disable password authentication

  Set PasswordAuthentication no to require key-based authentication only.

• Restrict SSH access and change default port if appropriate

  Use AllowUsers/AllowGroups and consider a non-default port; document changes for automation.

• Enable and configure host-based firewall

  Use firewalld or nftables to restrict inbound access to required services.

• Open required SSH/service ports in the firewall

  Allow only the specific ports needed (e.g., SSH or application ports).

• Block all other unused inbound ports

  Set default deny for incoming traffic and test application connectivity.

• Disable or remove unnecessary services and packages

  List enabled services, stop and disable anything not required for the server role.

• Install and enable auditd and configure STIG-compliant rules

  Ensure auditd is running and that key events are being recorded per guidance.

• Synchronize system time with an authorized NTP source

  Enable and start chronyd (or ntpd) and ensure time sync persists on boot.

• Enforce strong password and account policies

  Configure PAM (pam_pwquality), password aging, and account lockout policies.

• Audit and correct file and directory permissions

  Find world-writable files and set correct ownership and permissions.

• Require sudo logging and restrict sudo use

  Configure /etc/sudoers to require authentication and to log all commands.

• Deploy monitoring or intrusion-detection agents

  Install approved endpoint monitoring or IDS agents and verify reporting.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.