CIS Linux Hardening Checklist: Commands and Audit Evidence

Our earlier Linux server hardening checklist for 2026 covered the full baseline from initial provisioning to firewall and SSH setup. When an external auditor or security team reviews your fleet against a Center for Internet Security (CIS) Benchmark, the conversation gets more specific: how do you verify that each CIS Level 1 control is actually active in runtime, and what evidence do you save for the audit folder?

Reading a 700-page CIS Benchmark PDF for Ubuntu 24.04 LTS, Debian 12, RHEL 9, or Rocky Linux 9 can feel overwhelming, yet 90% of practical Level 1 findings on server fleets come down to six control families. This guide gives you the exact runtime verification and remediation commands for each family, plus the artifacts to retain for Linux server compliance.

CIS Level 1 Linux control families and audit evidence

1. Filesystem Partitions and Unused Kernel Modules (CIS Section 1.1)

CIS Level 1 expects world-writable directories (/tmp, /var/tmp, /dev/shm) to be mounted with nodev, nosuid, and noexec so an attacker who lands a file via a web application cannot execute a binary or setuid payload directly from temporary storage.

Verify the live mounts (not just /etc/fstab, which might not match what is currently mounted):

# Verify mount options on temporary filesystems
findmnt -kn /tmp /var/tmp /dev/shm

# Ensure systemd's tmp.mount or /etc/fstab enforces nodev,nosuid,noexec
sudo mount -o remount,nodev,nosuid,noexec /tmp
sudo mount -o remount,nodev,nosuid,noexec /dev/shm

Disable uncommon filesystem kernel modules (cramfs, freevxfs, jffs2, hfs, hfsplus, usb-storage on cloud servers) so an unprivileged local user cannot trigger a kernel vulnerability in an obscure filesystem driver:

cat <<'EOF' | sudo tee /etc/modprobe.d/cis-filesystems.conf
install cramfs /bin/false
install freevxfs /bin/false
install hfs /bin/false
install hfsplus /bin/false
install usb-storage /bin/false
EOF

2. Package GPG Verification and Security Patching (CIS Section 1.2 / 1.9)

Every CIS Linux benchmark includes controls for package manager integrity and timely security updates. First, verify that GPG signature checking is globally enforced so a compromised mirror cannot serve unsigned packages:

# On RHEL, Rocky Linux, AlmaLinux, and Amazon Linux 2023: every repo must have gpgcheck=1
grep -rn "^gpgcheck" /etc/dnf/dnf.conf /etc/yum.repos.d/

# On Ubuntu and Debian: confirm AllowUnauthenticated is never enabled
grep -rn "AllowUnauthenticated" /etc/apt/

Second, auditors check that security updates are applied on a defined cadence and that you can prove no Critical or High CVEs sit past your SLA. For single-host command flows, see Ubuntu server patching, RHEL patching step by step, and SUSE patching with zypper. For fleet-wide evidence, pair native package managers with continuous CVE scanning for Linux.

3. Mandatory Access Control: SELinux or AppArmor (CIS Section 1.3 / 1.6)

Disabling SELinux (SELINUX=disabled) or AppArmor is an automatic failure in any CIS Level 1 audit. Verify that Mandatory Access Control is enabled in enforcing mode and that no unconfined daemons are running unexpectedly:

# RHEL, Rocky Linux, AlmaLinux, CentOS
sestatus
getenforce                              # must output: Enforcing
ps -eZ | grep unconfined_service_t      # should return no production daemons

# Ubuntu and Debian
sudo aa-status                          # verify profiles are in enforce mode

If an application fails under SELinux, use ausearch -m AVC -ts recent | audit2why to write a targeted policy module rather than setting the entire host to Permissive.

4. SSH Server Hardening and the Drop-In Trap (CIS Section 5.1)

The single most common false sense of security on modern Linux servers is editing /etc/ssh/sshd_config without checking /etc/ssh/sshd_config.d/*.conf. OpenSSH uses first-match-wins evaluation: if /etc/ssh/sshd_config has Include /etc/ssh/sshd_config.d/*.conf at the top of the file, any directive set inside 50-cloud-init.conf overrides the bottom of sshd_config.

Always audit and collect evidence using sshd -T, which prints the effective runtime configuration:

# Audit effective OpenSSH settings against CIS Level 1
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|permitemptypasswords|kbdinteractiveauthentication|maxauthtries|logingracetime|x11forwarding|allowtcpforwarding|clientaliveinterval|clientalivecountmax|loglevel)'

To enforce CIS Level 1 settings reliably across drop-in configurations, place your hardening file at /etc/ssh/sshd_config.d/00-cis-hardening.conf (so 00- sorts first) with 0600 permissions:

sudo install -m 0600 /dev/null /etc/ssh/sshd_config.d/00-cis-hardening.conf
cat <<'EOF' | sudo tee /etc/ssh/sshd_config.d/00-cis-hardening.conf
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 4
LoginGraceTime 60
ClientAliveInterval 300
ClientAliveCountMax 3
X11Forwarding no
LogLevel VERBOSE
EOF

# Validate syntax before reloading sshd
sudo sshd -t && sudo systemctl reload sshd

5. Kernel Network Parameters and Host Firewalls (CIS Section 3.3 & 4.x)

CIS Level 1 hardens the Linux network stack via sysctl against ICMP redirects, source-routed packets, and Martian packet spoofing, and requires a default-deny host firewall even inside a private VPC security group:

cat <<'EOF' | sudo tee /etc/sysctl.d/60-cis-network.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
fs.suid_dumpable = 0
EOF

sudo sysctl --system

Verify listening sockets and active firewall enforcement for your audit evidence pack:

# List every process listening on TCP/UDP sockets
sudo ss -tulpn

# Verify active firewall rules (Ubuntu/Debian ufw, RHEL firewalld, or native nftables)
sudo ufw status verbose || sudo firewall-cmd --list-all || sudo nft list ruleset

6. System Auditing with auditd (CIS Section 6.2)

When an incident happens or an auditor tests change control (SOC 2 CC6.8 / CC7.2, PCI DSS 10.2), kernel-level auditd rules prove whether /etc/passwd, /etc/shadow, /etc/sudoers, or system time were modified:

cat <<'EOF' | sudo tee /etc/audit/rules.d/50-cis-baseline.rules
# Watch identity and authentication files
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

# Watch sudoers and privilege escalation configuration
-w /etc/sudoers -p wa -k scope
-w /etc/sudoers.d -p wa -k scope

# Watch SSH daemon configuration changes
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/sshd_config.d -p wa -k sshd_config

# Lock the audit configuration until next reboot (CIS 6.2.2.4)
-e 2
EOF

sudo augenrules --load
sudo auditctl -l

Collecting Continuous Patch and Vulnerability Evidence Alongside CIS

Static CIS hardening (sshd, sysctl, mount, auditd) changes rarely once baked into your golden AMI or Ansible role. The control family that drifts every single week is package vulnerabilities and security patching — new CVEs drop daily, and auditors ask for a complete history of how fast critical advisories were patched across the examination period (see SOC 2 compliance: meeting patch management requirements).

SysWard closes the continuous half of your hardening program:

• Live package inventory and CVE matching across Ubuntu, Debian, RHEL, Rocky Linux, CentOS, SUSE, and Amazon Linux.
• Grouped patch rollouts with reboot tracking (needs-restarting -r, /var/run/reboot-required, zypper ps).
• Exportable audit trail showing every patch event with hostname, package, before/after versions, timestamp, and initiating user.

Try it on your own servers — start free with 5 agents, no credit card required.