Amazon Linux 2023 STIG Hardening

21 items · Security · Medium difficulty · 2 hours

Practical Amazon Linux 2023 STIG tasks to harden systems and meet compliance.

• Apply all available OS updates and security patches

  Include kernel and package updates; reboot if required.

• Enable and configure automatic security updates

  Use dnf-automatic or a managed patching solution and test before production.

• Disable unused services and daemons
• List active services and identify unneeded ones

  Use systemctl list-units --type=service to inventory running services.

• Stop and disable identified unused services

  Use systemctl stop/disable or mask for services not required by role.

• Mask services that must remain unavailable

  Use systemctl mask to prevent activation by dependencies.

• Secure SSH configuration
• Disable root SSH login

  Set PermitRootLogin no in /etc/ssh/sshd_config.

• Enforce key-based authentication and disable password auth

  Set PasswordAuthentication no and deploy authorized_keys for admins.

• Restrict SSH algorithms and ciphers to approved list

  Use only protocol 2 and modern ciphers per policy.

• Configure firewall to restrict inbound traffic

  Use firewalld or nftables; allow only required ports and sources.

• Configure and enable auditd to capture security events

  Ensure audit rules persist and logs are retained per retention policy.

• Configure centralized logging or forward logs to a SIEM

  Use rsyslog/remote logging or a cloud logging service for retention and analysis.

• Enforce strong password and account policies

  Set complexity, minimum length, lockout, and expiration in PAM and /etc/login.defs.

• Disable or remove unnecessary packages

  Uninstall packages not required for the host role to reduce attack surface.

• Set secure permissions on /etc/passwd and /etc/shadow

  Ensure /etc/shadow is owned by root and not world-readable.

• Disable unused kernel modules and apply sysctl hardening

  Harden net.ipv4 settings and disable IP forwarding if not needed.

• Find and review SUID/SGID binaries

  Locate SUID/SGID files and remove or restrict ones that are unnecessary.

• Enable FIPS mode or apply approved crypto policies

  Enable only if required by policy; test applications for compatibility.

• Ensure time synchronization is configured and secured

  Use chrony, restrict NTP servers, and ensure RTC sync if required.

• Run vulnerability scans and record findings

  Use OpenSCAP or authorized scanners and remediate high-risk findings.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.