Debian 12 Linux Hardening: Implementing CIS Benchmark Level 1

Achieving compliance with the Center for Internet Security (CIS) Benchmark Level 1 requires systematically locking down the kernel, filesystem permissions, network protocol stacks, and access authentication.

This guide details the core configuration blueprints implemented across our infrastructure.

---

1. Kernel Parameter Hardening (/etc/sysctl.d/99-cis.conf)

Networking stacks in standard Debian installations permit packet forwarding and ICMP redirects by default. Restrict these vectors using kernel-level enforcement:

# /etc/sysctl.d/99-cis.conf
# Disable IP packet forwarding (router functions)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Disable ICMP redirect acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Enable TCP SYN Cookies against SYN-flood attacks
net.ipv4.tcp_syncookies = 1

# Ignore ICMP echo broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Log Martians (impossible addresses)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Restrict dmesg access to root
kernel.dmesg_restrict = 1

# Restrict BPF compiler access
kernel.unprivileged_bpf_disabled = 1
net.core.bpf_jit_harden = 2

Apply the changes immediately with:

sysctl --system

---

2. SSH Daemon Baseline (/etc/ssh/sshd_config.d/01-cis.conf)

Modern OpenSSH implementations should enforce modern key exchange algorithms and prevent legacy protocol fallback:

# /etc/ssh/sshd_config.d/01-cis.conf
Port 22
Protocol 2
PermitRootLogin no
MaxAuthTries 3
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
AllowAgentForwarding no
AllowTcpForwarding no

# Explicit MACs and Ciphers
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com

Validate syntax before reloading the daemon:

sshd -t && systemctl reload ssh

[!WARNING] Always verify that your active SSH session remains intact and test a secondary connection in an alternate terminal window prior to closing your current administrative session.

---

3. Filesystem Partition Options

CIS 1.1 recommends mounting temporary and shared memory filesystems with strict execution and node attributes:

Mount Point	Required Options	Description
/tmp	nodev,nosuid,noexec	Prevents executing binaries dropped into world-writable folders
/var/tmp	nodev,nosuid,noexec	Shared temp storage
/dev/shm	nodev,nosuid,noexec	Shared memory filesystem

Inspect active mount flags:

findmnt -l | grep -E '(/tmp|/var/tmp|/dev/shm)'