Ubuntu 20.04 STIG Checklist

18 items · Security · Hard difficulty · 4 hours

STIG-aligned hardening checklist for Ubuntu 20.04 LTS.

• Update system packages

  Run apt update and apt full-upgrade; reboot if kernel or critical packages updated.

• Enable unattended security updates

  Install and configure unattended-upgrades to apply security updates automatically.

• Remove unused packages and services

  Audit installed packages and purge unneeded software and daemons.

• Configure UFW firewall and enable default deny incoming

  Enable ufw, set default deny incoming, allow only required ports (e.g., SSH).

• Configure SSH settings

  Harden SSH configuration to reduce remote access risk.

• Disable SSH root login

  Set PermitRootLogin no in /etc/ssh/sshd_config and restart sshd.

• Restrict SSH to protocol 2 and strong ciphers

  Disable SSH v1, enable key auth, and configure modern ciphers/KEX suites.

• Enforce password policies: complexity and expiration

  Configure PAM and login.defs for complexity, history, and maximum age.

• Harden sudoers: remove NOPASSWD and limit admin access

  Review /etc/sudoers and /etc/sudoers.d to restrict privilege escalation.

• Enable and configure auditd for system auditing

  Install auditd, enable persistent logging, and add rules for auth, ssh, and sudo.

• Enable AppArmor and ensure profiles enforced

  Ensure AppArmor service is active and critical profiles are in enforce mode.

• Harden sysctl networking settings

  Set net.ipv4.ip_forward=0, rp_filter, and other recommended kernel network sysctls.

• Disable unused filesystem modules

  Blacklist modules like cramfs and squashfs to reduce attack surface.

• Set secure permissions on /etc and sensitive files

  Ensure /etc permissions and restrict access to passwd, shadow, keys, and certs.

• Configure NTP/chrony and enforce time sync

  Install and configure chrony or ntp, enable service and pin trusted servers.

• Download and apply Canonical Ubuntu 20.04 STIG SCAP content

  Retrieve DISA/Canonical XCCDF and SCAP content for 20.04 to reference benchmarks.

• Install and run a vulnerability scanner (SCAP/OVAL)

  Scan the host against the STIG benchmark to find deviations and remediate findings.

• Document changes and create rollback plan

  Log all configuration changes, backups, and rollback steps for each hardening action.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.