Guide to the Secure Configuration of Ubuntu 14.04

with profile Profile for ANSSI DAT-NT28 Minimal Level
This profile contains items to be applied systematically.
This guide presents a catalog of security-relevant configuration settings for Ubuntu 14.04. It is a rendering of content structured in the eXtensible Configuration Checklist Description Format (XCCDF) in order to support security automation. The SCAP content is is available in the scap-security-guide package which is developed at https://www.open-scap.org/security-policies/scap-security-guide.

Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. The creators of this guidance assume no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.
Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

Revision History

Current version: 0.1.41

  • draft (as of 2018-10-09)

Platforms

  • cpe:/o:canonical:ubuntu_linux:14.04

Table of Contents

  1. Services
    1. APT service configuration
    2. Deprecated services
  2. System Settings
    1. Installing and Maintaining Software
    2. File Permissions and Masks

Checklist

contains 19 rules

Services   [ref]group

The best protection against vulnerable software is running less software. This section describes how to review the software which Ubuntu 14.04 installs on a system and disable software which is not needed. It then enumerates the software packages installed on a default Ubuntu 14.04 system and provides guidance about which ones can be safely disabled.

Ubuntu 14.04 provides a convenient minimal install option that essentially installs the bare necessities for a functional system. When building Ubuntu 14.04 systems, it is highly recommended to select the minimal packages and then build up the system from there.

contains 5 rules

APT service configuration   [ref]group

The apt service manage the package management and update of the whole system. Its configuration need to be properly defined to ensure efficient security updates, packages and repository authentication and proper lifecycle management.

contains 1 rule

Disable unauthenticated repositories in APT configuration   [ref]rule

Unauthenticated repositories should not be used for updates.

Rationale:

Repositories hosts all packages that will be intsalled on the system during update. If a repository is not authenticated, the associated packages can't be trusted, and then should not be installed localy.

Severity:  unknown

References:  NT28(R15)

Deprecated services   [ref]group

Some deprecated software services impact the overall system security due to their behavior (leak of confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.

contains 4 rules

Uninstall the nis package   [ref]rule

The support for Yellowpages should not be installed unless it is required.

Rationale:

NIS is the historical SUN service for central account management, more and more replaced by LDAP. NIS does not support efficiently security constraints, ACL, etc. and should not be used.

Severity:  low

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:disable
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
#     package_remove telnet-server
#
function package_remove {

# Load function arguments into local variables
local package="$1"

# Check sanity of the input
if [ $# -ne "1" ]
then
  echo "Usage: package_remove 'package_name'"
  echo "Aborting."
  exit 1
fi

if which dnf ; then
  if rpm -q --quiet "$package"; then
    dnf remove -y "$package"
  fi
elif which yum ; then
  if rpm -q --quiet "$package"; then
    yum remove -y "$package"
  fi
elif which apt-get ; then
  apt-get remove -y "$package"
else
  echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
  echo "Aborting."
  exit 1
fi

}

package_remove nis
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
  package:
    name: nis
    state: absent
  tags:
    - package_nis_removed
    - low_severity
    - disable_strategy
    - low_complexity
    - low_disruption
Remediation Puppet snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
include remove_nis

class remove_nis {
  package { 'nis':
    ensure => 'purged',
  }
}

Uninstall the telnet server   [ref]rule

The telnet daemon should be uninstalled.

Rationale:

telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.

Severity:  high

References:  NT007(R03), AC-17(8), CM-7

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:disable
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
#     package_remove telnet-server
#
function package_remove {

# Load function arguments into local variables
local package="$1"

# Check sanity of the input
if [ $# -ne "1" ]
then
  echo "Usage: package_remove 'package_name'"
  echo "Aborting."
  exit 1
fi

if which dnf ; then
  if rpm -q --quiet "$package"; then
    dnf remove -y "$package"
  fi
elif which yum ; then
  if rpm -q --quiet "$package"; then
    yum remove -y "$package"
  fi
elif which apt-get ; then
  apt-get remove -y "$package"
else
  echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
  echo "Aborting."
  exit 1
fi

}

package_remove telnetd
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd is removed
  package:
    name: telnetd
    state: absent
  tags:
    - package_telnetd_removed
    - high_severity
    - disable_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-17(8)
    - NIST-800-53-CM-7
Remediation Puppet snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd

class remove_telnetd {
  package { 'telnetd':
    ensure => 'purged',
  }
}

Uninstall the ssl compliant telnet server   [ref]rule

The telnet daemon, even with ssl support, should be uninstalled.

Rationale:

telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.

Severity:  high

References:  NT007(R02), AC-17(8), CM-7

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:disable
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
#     package_remove telnet-server
#
function package_remove {

# Load function arguments into local variables
local package="$1"

# Check sanity of the input
if [ $# -ne "1" ]
then
  echo "Usage: package_remove 'package_name'"
  echo "Aborting."
  exit 1
fi

if which dnf ; then
  if rpm -q --quiet "$package"; then
    dnf remove -y "$package"
  fi
elif which yum ; then
  if rpm -q --quiet "$package"; then
    yum remove -y "$package"
  fi
elif which apt-get ; then
  apt-get remove -y "$package"
else
  echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
  echo "Aborting."
  exit 1
fi

}

package_remove telnetd-ssl
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
  package:
    name: telnetd-ssl
    state: absent
  tags:
    - package_telnetd-ssl_removed
    - high_severity
    - disable_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-17(8)
    - NIST-800-53-CM-7
Remediation Puppet snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl

class remove_telnetd-ssl {
  package { 'telnetd-ssl':
    ensure => 'purged',
  }
}

Uninstall the inet-based telnet server   [ref]rule

The inet-based telnet daemon should be uninstalled.

Rationale:

telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.

Severity:  high

References:  NT007(R03), AC-17(8), CM-7

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:disable
# Function to remove packages on RHEL, Fedora, Debian, and possibly other systems.
#
# Example Call(s):
#
#     package_remove telnet-server
#
function package_remove {

# Load function arguments into local variables
local package="$1"

# Check sanity of the input
if [ $# -ne "1" ]
then
  echo "Usage: package_remove 'package_name'"
  echo "Aborting."
  exit 1
fi

if which dnf ; then
  if rpm -q --quiet "$package"; then
    dnf remove -y "$package"
  fi
elif which yum ; then
  if rpm -q --quiet "$package"; then
    yum remove -y "$package"
  fi
elif which apt-get ; then
  apt-get remove -y "$package"
else
  echo "Failed to detect available packaging system, tried dnf, yum and apt-get!"
  echo "Aborting."
  exit 1
fi

}

package_remove inetutils-telnetd
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
  package:
    name: inetutils-telnetd
    state: absent
  tags:
    - package_inetutils-telnetd_removed
    - high_severity
    - disable_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-17(8)
    - NIST-800-53-CM-7
Remediation Puppet snippet:   (show)

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd

class remove_inetutils-telnetd {
  package { 'inetutils-telnetd':
    ensure => 'purged',
  }
}

System Settings   [ref]group

Contains rules that check correct system settings.

contains 14 rules

Installing and Maintaining Software   [ref]group

The following sections contain information on security-relevant choices during the initial operating system installation process and the setup of software updates.

contains 2 rules

Sudo   [ref]group

Sudo, which stands for \"su 'do'\", provides the ability to delegate authority to certain users, groups of users, or system administrators. When configured for system users and/or groups, Sudo can allow a user or group to execute privileged commands that normally only root is allowed to execute.

For more information on Sudo and addition Sudo configuration options, see https://www.sudo.ws.

contains 2 rules

Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate   [ref]rule

The sudo !authenticate option, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the !authenticate option does not exist in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale:

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.

Severity:  medium

Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD   [ref]rule

The sudo NOPASSWD tag, when specified, allows a user to execute commands using sudo without having to authenticate. This should be disabled by making sure that the NOPASSWD tag does not exist in /etc/sudoers configuration file or any sudo configuration snippets in /etc/sudoers.d/.

Rationale:

Without re-authentication, users may access resources or perform tasks for which they do not have authorization.

When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate.

Severity:  medium

File Permissions and Masks   [ref]group

Traditional Unix security relies heavily on file and directory permissions to prevent unauthorized users from reading or modifying files to which they should not have access.

Several of the commands in this section search filesystems for files or directories with certain characteristics, and are intended to be run on every local partition on a given system. When the variable PART appears in one of the commands below, it means that the command is intended to be run repeatedly, with the name of each local partition substituted for PART in turn.

The following command prints a list of all xfs partitions on the local system, which is the default filesystem for Red Hat Enterprise Linux 7 installations:

$ mount -t xfs | awk '{print $3}'
For any systems that use a different local filesystem type, modify this command as appropriate.

contains 12 rules

Verify Permissions on Important Files and Directories   [ref]group

Permissions for many files on a system must be set restrictively to ensure sensitive information is properly protected. This section discusses important permission restrictions which can be verified to ensure that no harmful discrepancies have arisen.

contains 12 rules
contains 12 rules

Verify Permissions on shadow File   [ref]rule

To properly set the permissions of /etc/shadow, run the command:

$ sudo chmod 0640 /etc/shadow

Rationale:

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Severity:  medium

References:  6.1.3, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chmod 0640 /etc/shadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Ensure permission 0640 on /etc/shadow
  file:
    path: /etc/shadow
    mode: 0640
  tags:
    - file_permissions_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify User Who Owns shadow File   [ref]rule

To properly set the owner of /etc/shadow, run the command:

$ sudo chown root /etc/shadow 

Rationale:

The /etc/shadow file contains the list of local system accounts and stores password hashes. Protection of this file is critical for system security. Failure to give ownership of this file to root provides the designated owner with access to sensitive information which could weaken the system security posture.

Severity:  medium

References:  6.1.3, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chown 0 /etc/shadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: 0
  when: file_exists.stat.exists
  tags:
    - file_owner_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify User Who Owns group File   [ref]rule

To properly set the owner of /etc/group, run the command:

$ sudo chown root /etc/group 

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:  medium

References:  6.1.4, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chown 0 /etc/group
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: 0
  when: file_exists.stat.exists
  tags:
    - file_owner_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify Permissions on group File   [ref]rule

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:  medium

References:  6.1.4, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chmod 0644 /etc/group
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Ensure permission 0644 on /etc/group
  file:
    path: /etc/group
    mode: 0644
  tags:
    - file_permissions_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify Group Who Owns gshadow File   [ref]rule

To properly set the group owner of /etc/gshadow, run the command:

$ sudo chgrp root /etc/gshadow

Rationale:

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.5, AC-6

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chgrp 42 /etc/gshadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists

- name: Ensure group owner 42 on /etc/gshadow
  file:
    path: /etc/gshadow
    group: 42
  when: file_exists.stat.exists
  tags:
    - file_groupowner_etc_gshadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6

Verify Group Who Owns passwd File   [ref]rule

To properly set the group owner of /etc/passwd, run the command:

$ sudo chgrp root /etc/passwd

Rationale:

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.2, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chgrp 0 /etc/passwd
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: 0
  when: file_exists.stat.exists
  tags:
    - file_groupowner_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify Group Who Owns shadow File   [ref]rule

To properly set the group owner of /etc/shadow, run the command:

$ sudo chgrp root /etc/shadow

Rationale:

The /etc/shadow file stores password hashes. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.3, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chgrp 42 /etc/shadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists

- name: Ensure group owner 42 on /etc/shadow
  file:
    path: /etc/shadow
    group: 42
  when: file_exists.stat.exists
  tags:
    - file_groupowner_etc_shadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify User Who Owns gshadow File   [ref]rule

To properly set the owner of /etc/gshadow, run the command:

$ sudo chown root /etc/gshadow 

Rationale:

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.5, AC-6

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chown 0 /etc/gshadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/gshadow
  stat:
    path: /etc/gshadow
  register: file_exists

- name: Ensure owner 0 on /etc/gshadow
  file:
    path: /etc/gshadow
    owner: 0
  when: file_exists.stat.exists
  tags:
    - file_owner_etc_gshadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6

Verify Group Who Owns group File   [ref]rule

To properly set the group owner of /etc/group, run the command:

$ sudo chgrp root /etc/group

Rationale:

The /etc/group file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Severity:  medium

References:  6.1.4, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chgrp 0 /etc/group
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: 0
  when: file_exists.stat.exists
  tags:
    - file_groupowner_etc_group
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify Permissions on gshadow File   [ref]rule

To properly set the permissions of /etc/gshadow, run the command:

$ sudo chmod 0000 /etc/gshadow

Rationale:

The /etc/gshadow file contains group password hashes. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.5, AC-6

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chmod 0640 /etc/gshadow
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Ensure permission 0640 on /etc/gshadow
  file:
    path: /etc/gshadow
    mode: 0640
  tags:
    - file_permissions_etc_gshadow
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6

Verify User Who Owns passwd File   [ref]rule

To properly set the owner of /etc/passwd, run the command:

$ sudo chown root /etc/passwd 

Rationale:

The /etc/passwd file contains information about the users that are configured on the system. Protection of this file is critical for system security.

Severity:  medium

References:  6.1.2, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chown 0 /etc/passwd
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: 0
  when: file_exists.stat.exists
  tags:
    - file_owner_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2

Verify Permissions on passwd File   [ref]rule

To properly set the permissions of /etc/passwd, run the command:

$ sudo chmod 0644 /etc/passwd

Rationale:

If the /etc/passwd file is writable by a group-owner or the world the risk of its compromise is increased. The file contains the list of accounts on the system and associated information, and protection of this file is critical for system security.

Severity:  medium

References:  6.1.2, 5.5.2.2, AC-6, Req-8.7.c

Remediation Shell script:   (show)

Complexity:low
Disruption:low
Strategy:configure

chmod 0644 /etc/passwd
Remediation Ansible snippet:   (show)

Complexity:low
Disruption:low
Strategy:configure
- name: Ensure permission 0644 on /etc/passwd
  file:
    path: /etc/passwd
    mode: 0644
  tags:
    - file_permissions_etc_passwd
    - medium_severity
    - configure_strategy
    - low_complexity
    - low_disruption
    - NIST-800-53-AC-6
    - PCI-DSS-Req-8.7.c
    - CJIS-5.5.2.2
Red Hat and Red Hat Enterprise Linux are either registered trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.