Hardening Ubuntu Server 24.04 LTS with CIS Benchmarks

Executive Summary

This project implements a complete security hardening solution for Ubuntu Server 24.04 LTS, combining CIS Benchmark v1.0.0 controls with Lynis security auditing and comprehensive security tooling. The solution provides both standalone Bash scripts for manual execution and a production-ready Ansible role for automated deployment at scale.

Key Results

Key Features

• 30+ CIS Controls across 6 security domains (Levels 1 and 2)
• Lynis Integration with automated scoring and improvement tracking
• Security Tools Suite including AIDE, rkhunter, chkrootkit, and Fail2Ban
• Enterprise nftables Firewall with SSH rate limiting and default-deny policy
• Complete Workflow Automation from initial analysis to final reporting
• Ansible Vault Integration for secure GRUB password management

Project Scope

Security Domains Covered

CIS Controls Implemented

Architecture

Hardening Workflow

The solution implements a six-phase hardening workflow:

Design Principles

True Idempotency

The Ansible role prioritizes native modules over shell commands:

Secret Management

Control 1.4.1 (GRUB bootloader password) uses Ansible Vault for encryption:

# group_vars/all/vault.yml (encrypted)
cis_grub_password_hash: "grub.pbkdf2.sha512.600000.ABC123..."

This eliminates interactive password prompts, enabling CI/CD pipeline compatibility.

Level-Based Profiles

The role supports both CIS Level 1 and Level 2 profiles:

Level 1 (default): Practical security for most environments

• Audit rules without immutable flag
• AppArmor profiles as-is

Level 2: Enhanced security for high-risk environments

• Immutable audit configuration (requires reboot to modify)
• All AppArmor profiles in enforce mode
• Compiler removal option

Hardening Results

Kernel Security Parameters

SSH Hardening Applied

AppArmor Improvements

Applied 119 profiles in enforce mode, eliminating all unconfined profiles.

Security Tools Integration

Installed Security Tools

Lynis Score Progression

Additional Lynis Improvements Applied

nftables Firewall Configuration

The firewall implements a hardened configuration with SSH rate limiting:

Features

• Default-Deny Policy: All incoming traffic blocked by default
• Stateful Filtering: Established/related connections allowed
• SSH Rate Limiting: 4 connections/minute per source IP (anti-brute-force)
• ICMP Control: Essential ICMP types only (echo, unreachable, time-exceeded)
• IPv6 Blocking: Complete IPv6 traffic blocking (configurable)
• Logging: Rate-limited logging of dropped packets

Configuration

table inet filter {
    set ssh_limit {
        type ipv4_addr
        size 65535
        flags dynamic,timeout
        timeout 1m
    }

    chain input {
        type filter hook input priority 0; policy drop;
        
        ct state established,related accept
        ct state invalid drop
        iif "lo" accept
        iif != "lo" ip daddr 127.0.0.0/8 drop
        
        # ICMP essential types
        ip protocol icmp icmp type { echo-reply, destination-unreachable, 
            echo-request, time-exceeded, parameter-problem } accept
        
        # SSH with rate limiting
        tcp dport 22 ct state new add @ssh_limit { 
            ip saddr limit rate 4/minute burst 8 packets 
        } accept
        tcp dport 22 ct state new drop
        
        # Log and drop everything else
        limit rate 5/minute burst 10 packets log prefix "nftables-dropped: "
        counter drop
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        counter drop
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

table ip6 filter {
    chain input { type filter hook input priority 0; policy drop; }
    chain forward { type filter hook forward priority 0; policy drop; }
    chain output { type filter hook output priority 0; policy drop; }
}

Usage

Full Automated Workflow (Bash)

# Clone the repository
git clone https://github.com/xoelrdgz/hardening-project.git
cd hardening-project

# Run complete hardening with all features
sudo ./scripts/00-cis-hardening-main.sh full

# With custom firewall ports
sudo ./scripts/00-cis-hardening-main.sh full --ssh-port 22 --tcp-ports 80,443

Step-by-Step Execution

# Phase 1: Initial analysis with Lynis
sudo ./scripts/00-cis-hardening-main.sh analyze --phase initial

# Phase 2: Install security tools
sudo ./scripts/00-cis-hardening-main.sh tools

# Phase 3: Apply CIS controls
sudo ./scripts/00-cis-hardening-main.sh harden

# Phase 4: Lynis improvements
sudo ./scripts/00-cis-hardening-main.sh lynis-improve

# Phase 5: Configure firewall
sudo ./scripts/00-cis-hardening-main.sh firewall

# Phase 6: Generate report
sudo ./scripts/00-cis-hardening-main.sh analyze --phase post
sudo ./scripts/00-cis-hardening-main.sh report

Ansible Deployment

cd ansible

# Install dependencies
ansible-galaxy collection install -r requirements.yml

# Dry run (check mode)
ansible-playbook site.yml --check --diff --ask-vault-pass

# Apply Level 1 hardening
ansible-playbook site.yml --ask-vault-pass

# Apply Level 2 hardening
ansible-playbook site.yml -e "cis_level=2" --ask-vault-pass

# Run specific sections
ansible-playbook site.yml --tags "security_tools,lynis_improvements" --ask-vault-pass

Validation

After applying hardening controls:

# Run Lynis audit
sudo lynis audit system

# Verify kernel parameters
sysctl kernel.randomize_va_space    # Expected: 2
sysctl kernel.yama.ptrace_scope     # Expected: 2
sysctl net.ipv4.ip_forward          # Expected: 0
sysctl net.ipv4.tcp_syncookies      # Expected: 1

# Verify security services
systemctl is-enabled auditd fail2ban nftables

# Verify firewall
nft list ruleset

# Verify file integrity tools
aide --check
rkhunter --check

# Verify AppArmor (all profiles enforced)
aa-status | grep -E "profiles|processes"

# Verify mount options
findmnt /tmp -o OPTIONS | grep noexec
findmnt /dev/shm -o OPTIONS | grep noexec

Technical Highlights

Challenges Solved

Key Learnings

• Enterprise security hardening requires systematic, auditable approaches
• Automation with proper safeguards prevents operational incidents
• Security tools integration provides defense-in-depth
• Lynis scoring provides measurable security improvement metrics
• Handler-based notifications allow controlled maintenance windows
• Documentation is critical for reproducibility and compliance audits