Canonical Ubuntu 20.04 LTS STIG Checklist

17 items · Security · Medium difficulty · 2 hours

Harden Ubuntu 20.04 with this STIG-based security checklist.

• Update system packages

  Install all available package updates and security patches.

• Enable automatic security updates

  Configure unattended-upgrades to auto-install security updates.

• Verify time synchronization

  Ensure chrony or ntp is configured and syncing system time.

• Configure the firewall (ufw)

  Set default deny inbound, allow only required ports and enable logging.

• Harden SSH configuration

  Apply STIG-oriented SSH settings to reduce remote access risks.

• Disable root login over SSH

  Prevent direct root SSH access; require sudo from normal accounts.

• Disable password authentication and use SSH keys

  Allow only public-key authentication for interactive SSH logins.

• Limit SSH access and enable rate-limiting

  Restrict allowed IPs, use AllowUsers/AllowGroups and rate-limit attempts.

• Install and enable auditd

  Enable system auditing to record security-relevant events.

• Configure audit rules for sensitive files and actions

  Audit changes to /etc, user admin actions, and login events.

• Enable and enforce AppArmor profiles

  Ensure AppArmor is active and critical services have enforced profiles.

• Disable unused services and remove unnecessary packages

  Stop and remove services/packages that are not required for operation.

• Set secure permissions on /etc/passwd and /etc/shadow

  Verify ownership and mode to prevent unauthorized access.

• Install and configure AIDE or other file-integrity monitoring

  Initialize a baseline and schedule regular integrity checks.

• Apply sysctl network hardening

  Disable IP forwarding, enable rp_filter and tcp_syncookies, and tighten net settings.

• Restrict cron and at usage; review scheduled jobs

  Lock down /etc/cron.allow, /etc/cron.d, and remove unauthorized jobs.

• Review and enforce least-privilege for user accounts

  Remove inactive accounts, restrict sudoers, and audit privileged users.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.