Canonical Ubuntu 22.04 LTS STIG Checklist

18 items · Security · Medium difficulty · 4 hours

Essential Ubuntu 22.04 STIG steps to harden systems and verify compliance.

• Update package lists

  Run apt update to refresh package metadata.

• Upgrade installed packages

  Run apt upgrade -y to install available updates.

• Apply kernel and firmware updates

  Install kernel/firmware updates and reboot if required.

• Enable unattended security updates

  Install and configure unattended-upgrades for security patches.

• Run SCAP/XCCDF benchmark scan and save report

  Use DISA SCAP content to generate and archive a compliance report.

• Harden SSH configuration

  Edit /etc/ssh/sshd_config to restrict access and stronger settings.

• Disable root login over SSH

  Set PermitRootLogin no in sshd_config and restart sshd.

• Require SSH keys and disable password auth

  Set PasswordAuthentication no and use authorized_keys only.

• Restrict SSH access and limit users

  Use AllowUsers/AllowGroups or firewall rules to limit login sources.

• Configure and enable UFW firewall

  Allow required ports, deny by default, then enable and log.

• Install and enable auditd

  Install auditd, enable service, and load baseline rules.

• Configure log rotation and remote syslog

  Ensure logs rotate and forward to a central collector if available.

• Set password policy and PAM rules

  Enforce complexity, aging, and lockout via /etc/pam.d and login.defs.

• Lock and remove inactive user accounts

  Disable or remove accounts inactive for a defined period (e.g., 90 days).

• Enable AppArmor and enforce profiles

  Ensure AppArmor is active and critical profiles are in enforce mode.

• Configure kernel sysctl hardening

  Apply recommended sysctl settings (e.g., rp_filter, disable IP forwarding).

• Install and configure Fail2Ban

  Block repeated authentication failures to reduce brute-force attacks.

• Remove unused packages and disable unnecessary services

  Uninstall unneeded packages and stop/disable idle services.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.