Ubuntu 24.04 STIG Compliance

15 items · Security · Medium difficulty · 4 hours

Essential Ubuntu 24.04 STIG steps to harden and secure your server.

• Apply latest Ubuntu 24.04 security updates

  Run apt update && apt upgrade; reboot if required.

• Enable unattended-upgrades for security packages

  Install and configure unattended-upgrades to auto-install security updates.

• Configure UFW firewall

  Install UFW, set default policies, and enable the firewall.

• Deny incoming connections by default in UFW

  Set ufw default deny incoming to reduce exposure.

• Allow SSH and necessary service ports in UFW

  Open only required ports (use service names or explicit ports).

• Harden SSH configuration

  Edit /etc/ssh/sshd_config to enforce secure defaults.

• Disable SSH root login

  Set PermitRootLogin no and restart sshd.

• Enforce SSH key-based authentication and disable passwords

  Set PasswordAuthentication no and allow only authorized keys.

• Create and enforce strong password and account lockout policies

  Use PAM rules, password complexity, expiration, and account lockout.

• Remove or disable unnecessary packages and services

  Audit installed packages and stop/remove unused daemons.

• Install and configure auditd for system auditing

  Enable auditd, persistent logs, and baseline audit rules.

• Enable and verify Secure Boot and kernel module restrictions

  Ensure Secure Boot enabled where supported; restrict unsigned modules.

• Configure sysctl network protections

  Set rp_filter, disable IP forwarding if not needed, and harden ICMP settings.

• Limit sudo access and implement least-privilege

  Review /etc/sudoers, remove NOPASSWD entries, use /etc/sudoers.d.

• Verify permissions on critical system files and directories

  Check /etc, /var, and home directories for improper ownership or modes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.