Policy Rules
CIS Ubuntu Linux 24.04 LTS Benchmark: 85 Checks
CIS Benchmark checks for Ubuntu Linux 24.04 LTS: filesystems, services, networking, the host firewall, access control, and logging and auditing.
The Center for Internet Security (CIS) is a nonprofit that publishes the CIS Benchmarks: consensus-developed secure configuration guides for operating systems, cloud platforms, and applications. Each benchmark enumerates numbered recommendations, most assigned a Level 1 (broadly safe hardening) or Level 2 (defense-in-depth, may reduce functionality) profile, together with the audit procedure and remediation for each. Wartiva maps a benchmark's recommendations onto policy rules so an endpoint's observed configuration can be assessed against the published baseline.
- High 8
- Medium 76
- Low 1
No checks match your filter.
1 Initial Setup 30 checks
- Ensure nodev option set on /tmp partition
- Ensure noexec option set on /tmp partition
- Ensure nosuid option set on /tmp partition
- Ensure /tmp is tmpfs or a separate partition
- Ensure nodev option set on /dev/shm partition
- Ensure noexec option set on /dev/shm partition
- Ensure nosuid option set on /dev/shm partition
- Ensure /dev/shm is tmpfs or a separate partition
- Ensure nodev option set on /home partition
- Ensure nosuid option set on /home partition
- Ensure separate partition exists for /home
- Ensure nodev option set on /var partition
- Ensure nosuid option set on /var partition
- Ensure separate partition exists for /var
- Ensure nodev option set on /var/tmp partition
- Ensure noexec option set on /var/tmp partition
- Ensure nosuid option set on /var/tmp partition
- Ensure separate partition exists for /var/tmp
- Ensure nodev option set on /var/log partition
- Ensure noexec option set on /var/log partition
- Ensure nosuid option set on /var/log partition
- Ensure separate partition exists for /var/log
- Ensure nodev option set on /var/log/audit partition
- Ensure noexec option set on /var/log/audit partition
- Ensure nosuid option set on /var/log/audit partition
- Ensure separate partition exists for /var/log/audit
- Ensure apparmor is installed
- Ensure apparmor-utils is installed
- Ensure Automatic Error Reporting is configured
- Ensure prelink is not installed
2 Services 31 checks
- Ensure autofs services are not in use
- Ensure avahi daemon services are not in use
- Ensure dhcp server services are not in use
- Ensure dns server services are not in use
- Ensure dnsmasq services are not in use
- Ensure ftp server services are not in use
- Ensure ldap server services are not in use
- Ensure message access server services are not in use
- Ensure network file system services are not in use
- Ensure nis server services are not in use
- Ensure print server services are not in use
- Ensure rpcbind services are not in use
- Ensure rsync services are not in use
- Ensure samba file server services are not in use
- Ensure snmp services are not in use
- Ensure telnet server services are not in use
- Ensure tftp server services are not in use
- Ensure web proxy server services are not in use
- Ensure web server services are not in use
- Ensure X window server services are not in use
- Ensure xinetd services are not in use
- Ensure ftp client is not installed
- Ensure ldap client is not installed
- Ensure nis client is not installed
- Ensure rsh client is not installed
- Ensure talk client is not installed
- Ensure telnet client is not installed
- Ensure systemd-timesyncd is enabled and running
- Ensure chrony is enabled and running
- Ensure chrony is running as user _chrony
- Ensure cron daemon is enabled and active
3 Network 1 check
4 Host Based Firewall 2 checks
5 Access Control 9 checks
- Ensure sudo is installed
- Ensure all users last password change date is in the past
- Ensure inactive password lock is configured
- Ensure minimum password days is configured
- Ensure password expiration is configured
- Ensure password expiration warning days is configured
- Ensure system accounts do not have a valid login shell
- Ensure root is the only UID 0 account
- Ensure root is the only GID 0 account
6 Logging and Auditing 10 checks
- Ensure journald service is active
- Ensure systemd-journal-remote service is not in use
- Ensure rsyslog service is enabled and active
- Ensure rsyslog is installed
- Ensure rsyslog-gnutls is installed
- Ensure auditd service is enabled and active
- Ensure auditd is installed
- Ensure audispd-plugins is installed
- Ensure aide is installed
- Ensure aide-common is installed
7 System Maintenance 2 checks
See your environment the way it really exists
Wartiva is in early access. Request your spot and talk to the team that built the endpoint platform they always wished they had.