Canonical Ubuntu 22.04 LTS STIG — Ver 2, Rel 6

16 items · Security · Hard difficulty · 2 hours

Practical Ubuntu 22.04 STIG steps to harden and comply with DISA guidance.

• Update package lists and apply all security updates

  Run apt update and install available security patches to reduce known vulnerabilities.

• Enable unattended security upgrades

  Install and configure unattended-upgrades to automatically apply security updates.

• Remove unused packages and snaps

  Purge software you don't need to shrink attack surface and limit automatic services.

• Disable and mask unnecessary services

  Disable services like avahi or cups if not required using systemctl disable --now.

• Harden SSH configuration

  Apply STIG-recommended SSH settings to limit remote access risks.

• Disable root login via SSH

  Set PermitRootLogin no in /etc/ssh/sshd_config and restart sshd.

• Disable password authentication and require keys

  Set PasswordAuthentication no and use key-based auth only.

• Configure and enable UFW firewall

  Set default deny incoming, allow outgoing, and enable UFW.

• Install and configure fail2ban or rate-limiting

  Protect SSH and other services from brute-force login attempts.

• Enforce strong password and account policies

  Configure PAM, minimum length, complexity, and password aging policies.

• Enable and configure auditd logging

  Record security-relevant events and ensure log retention meets policy.

• Apply AppArmor profiles and enforce critical profiles

  Ensure AppArmor is enabled and essential profiles are in enforce mode.

• Set secure kernel sysctl values

  Harden network and kernel settings (e.g., disable IP forwarding if unused).

• Find and fix world-writable files and insecure permissions

  Locate and correct files with overly permissive ownership/permissions.

• Disable IPv6 if not required by environment

  Turn off IPv6 system-wide when not in use to reduce attack vectors.

• Download and validate DISA SCAP/XCCDF content and run benchmark

  Use DISA SCAP/XCCDF content to scan and report STIG compliance status.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.