🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Linux for Cybersecurity › Lesson 10
TEC-CYBE44-04 · Lesson 10 · 14.5 clock hours · lab

Linux Hardening: CIS Benchmark Implementation

Objective. Students apply a structured subset of CIS Benchmark controls to harden a stock Ubuntu Server installation and verify compliance using a manual audit checklist.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is a CIS Benchmark?

The Center for Internet Security (CIS) publishes Benchmarks — detailed, consensus-based configuration guides for operating systems, applications, and network devices. The CIS Ubuntu Linux Benchmark provides a numbered list of controls, each describing a specific security setting, the rationale behind it, and the exact commands needed to audit and remediate it. Controls are organized into two profile levels: Level 1 covers low-risk, broadly applicable settings; Level 2 adds stricter controls suited to high-security environments. In this lab you work with a representative 20-control subset drawn from both levels.

Why Harden a Stock Installation?

A default Ubuntu Server installation is designed for broad compatibility, not maximum security. Many services are enabled that a production server does not need. Kernel network parameters may allow behaviors useful for development but dangerous in production. Password policies are often permissive. Without hardening, a stock server is exposed to well-known attack paths: brute-force SSH login, exploitation of unnecessary services, and privilege escalation through weak account controls.

NIST SP 800-123 (Guide to General Server Security) establishes the principle that servers should be hardened before they are deployed — not patched reactively after a breach. CIS Benchmarks operationalize that principle with specific, testable controls.

The Audit-Remediate-Verify Cycle

Hardening follows three repeating phases.

Audit: Run the checklist against the stock VM. For each control, record Pass, Fail, or Not Applicable (N/A). A control is N/A when the checked component is absent from the system by design. Document your baseline score: the number of controls passing divided by the number that are applicable.

Remediate: For every failing control, apply the fix. Common remediation actions include editing configuration files with a text editor, running a single privileged command, disabling a systemd unit, or adding a line to a PAM module configuration. Always make a backup copy of any file before editing it — for example, `sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak`.

Verify: Re-run every checklist item. Your post-hardening score should meet or exceed the 80% threshold required to pass this lab.

Key Configuration Areas

Filesystem Controls

Separate mount points for `/tmp`, `/var`, and `/home` limit the blast radius of a disk-filling attack or a world-writable directory exploit. The benchmark specifies mount options such as `nodev`, `nosuid`, and `noexec` on partitions that do not need device files or executable code.

Services

Every running service is an attack surface. The benchmark directs you to disable services that are not required — for example, legacy protocols such as `rsh`, `telnet`, and `tftp`. Use `systemctl disable --now <service>` to stop and permanently disable a unit.

Network Parameters

The Linux kernel exposes network behavior through the `/proc/sys` interface, configured persistently in `/etc/sysctl.conf` (or files under `/etc/sysctl.d/`). Important hardening parameters include:

After editing `sysctl.conf`, apply changes immediately with `sudo sysctl -p`.

SSH Configuration

SSH is the primary remote-management protocol. The `/etc/ssh/sshd_config` file controls its behavior. Key settings to verify:

After editing, always validate the configuration with `sudo sshd -t` before restarting the service. A syntax error in `sshd_config` can lock you out of the server.

Logging

The benchmark requires that `rsyslog` or `systemd-journald` is active and configured to send logs to persistent storage. Remote log forwarding to a SIEM or syslog server is recommended so that an attacker who gains root cannot erase local evidence.

Account and Password Policies

PAM (Pluggable Authentication Modules) enforces password complexity and account lockout. The relevant file is `/etc/pam.d/common-password` for password rules and `/etc/pam.d/common-auth` for lockout. The `pam_pwquality` module enforces minimum length, complexity, and reuse history. `/etc/login.defs` sets password aging: `PASS_MAX_DAYS`, `PASS_MIN_DAYS`, and `PASS_WARN_AGE`.

Writing the Hardening Report

A client-facing report has a clear structure: executive summary, scope, methodology, findings (baseline vs. post-hardening score), and a control-by-control table. For each remediated control, state what the setting was, what it is now, and why the change reduces risk. Use plain language — assume the reader understands business risk but not Linux internals.

Safety and Operational Caution

Hardening a live production server without a maintenance window and rollback plan can cause outages. In this lab you work on a dedicated VM specifically to avoid impacting real systems. Always snapshot your VM before beginning remediation so you can revert if a change causes the system to become unreachable. Never apply hardening changes to systems you do not have written authorization to modify — unauthorized access, even well-intentioned, violates the Computer Fraud and Abuse Act and similar state laws.

Key terms9

CIS BenchmarkA consensus-based, publicly available configuration guide published by the Center for Internet Security that provides specific, testable controls for securing an operating system or application.
Attack surfaceThe sum of all points on a system where an unauthorized user could attempt to enter or extract data; reducing the number of running services reduces the attack surface.
sysctlA Linux utility and kernel interface used to read and write kernel parameters at runtime; settings in /etc/sysctl.conf persist across reboots.
PAM (Pluggable Authentication Modules)A Linux framework that allows system administrators to configure authentication policies — such as password complexity and account lockout — by editing module configuration files rather than recompiling applications.
HardeningThe process of configuring a system to reduce its vulnerability by disabling unnecessary services, enforcing strong authentication, and applying security-relevant settings based on a recognized standard.
Baseline scoreThe initial audit result before any remediation — the count of controls passing, failing, or not applicable on a stock system, used as a reference point to measure improvement.
systemd unitA configuration file that defines and controls a service, socket, device, or other resource managed by the systemd init system; units can be enabled, disabled, started, or stopped with systemctl.
PermitRootLoginAn SSH daemon directive in /etc/ssh/sshd_config that controls whether the root account can log in directly over SSH; setting it to 'no' forces use of a regular account and sudo.
NIST SP 800-123A National Institute of Standards and Technology special publication titled Guide to General Server Security; it provides framework-level guidance for securing servers before and after deployment.
In class: Use a provided CIS Ubuntu Linux Benchmark audit checklist (20 controls covering filesystem, services, network, logging, and account policies); audit a stock VM and record a baseline score — number of controls passed, failed, or not applicable. · Remediate every failing control from the audit by editing configuration files, running commands, or modifying systemd unit files; re-run the checklist to demonstrate improvement and record the post-hardening score. · Compare the stock and hardened VMs side-by-side using a structured diff of key configuration files (/etc/sysctl.conf, /etc/ssh/sshd_config, /etc/pam.d/common-password); write a two-page hardening report suitable for a client, explaining each change and its security impact.
Materials: Two Linux VMs (one stock, one being hardened), CIS Ubuntu Linux Benchmark, text editors, diff utility, NIST SP 800-123, CompTIA Security+ exam objective list (Implementation domain)
Check: Post-hardening checklist score reviewed by instructor; pass = 80% or more of the 20 controls passing, and hardening report covers all remediated controls with accurate explanations.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — Implementation
1. A stock Ubuntu Server has IP forwarding enabled. Which file should a technician edit to disable it persistently across reboots?
CompTIA Security+ — Implementation
2. During an SSH hardening review, a technician runs 'sudo sshd -t' after editing sshd_config. What is the purpose of this command?
CompTIA Security+ — Implementation
3. A CIS Benchmark control requires that the /tmp partition be mounted with the 'noexec' option. Which attack technique does this most directly mitigate?
CompTIA Security+ — Implementation
4. Which PAM configuration file is most relevant when enforcing a minimum password length and complexity policy on an Ubuntu system?
CompTIA CySA+ — Security Operations
5. After completing a CIS Benchmark audit of a stock VM, 6 of the 20 controls are marked Not Applicable and 7 of the remaining 14 pass. What is the baseline pass rate calculated against applicable controls only?
CompTIA Security+ — Implementation
6. A technician sets 'net.ipv4.conf.all.accept_redirects = 0' in sysctl.conf. Which threat does this control most directly address?
ISC2 CC — Security Principles
7. Which NIST publication provides framework-level guidance that supports the principle of hardening servers before they are deployed?
CompTIA CySA+ — Security Operations
8. A student's post-hardening checklist shows 17 of 20 controls passing and 1 marked Not Applicable. Does this meet the lab pass threshold?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →