About

Imported from CyberStrikeus/CyberStrike (.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-20-04-lts-benchmark-v3/cis-ubuntu2004-v300-4-3-1/SKILL.md). Install upstream with npx skills add CyberStrikeus/CyberStrike --skill cis-ubuntu2004-v300-4-3-1. Copyright stays with the author.

CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - Control 4.3.1

Name: cis-ubuntu2004-v300-4-3-1
Author: CyberStrikeus

Profile

Level: Level 1 - Server, Level 1 - Workstation
Assessment Status: Automated

Description

nftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.

Notes:

nftables is available in Linux kernel 3.13 and newer
Only one firewall utility should be installed and configured
Changing firewall settings while connected over the network can result in being locked out of the system

Rationale

nftables is a subsystem of the Linux kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Audit Procedure

Command Line

Run the following command to verify that nftables is installed:

dpkg-query -s nftables &>/dev/null && echo "nftables is installed"

Expected Result

nftables is installed

Remediation

Command Line

Run the following command to install nftables:

apt install nftables

Default Value

Not applicable.

References

NIST SP 800-53 Rev. 5: CA-9

CIS Controls

v8 - 4.4 Implement and Manage a Firewall on Servers v8 - 4.5 Implement and Manage a Firewall on End-User Devices v7 - 9.4 Apply Host-based Firewalls or Port Filtering

MITRE ATT&CK Mappings: T1562, T1562.004 | TA0011 | M1031, M1037

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu2004-v300-4-3-1/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberstrikeus-cyberstrike-cis-ubuntu2004-v300-4-3-1.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberstrikeus-cyberstrike-cis-ubuntu2004-v300-4-3-1",
  "kind": "skill",
  "name": "cis-ubuntu2004-v300-4-3-1",
  "description": "Ensure nftables is installed",
  "publisher": "CyberStrikeus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cis",
      "ubuntu",
      "linux",
      "ubuntu-20-04",
      "firewall",
      "nftables",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Ensure nftables is installed"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/CyberStrikeus/CyberStrike",
      "path": ".cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-20-04-lts-benchmark-v3/cis-ubuntu2004-v300-4-3-1/SKILL.md",
      "ref": "df28ccd3dc6d6c02391169121ee2dcdf4a6a132b",
      "url": "https://github.com/CyberStrikeus/CyberStrike/blob/df28ccd3dc6d6c02391169121ee2dcdf4a6a132b/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-20-04-lts-benchmark-v3/cis-ubuntu2004-v300-4-3-1/SKILL.md",
      "key": "CyberStrikeus/CyberStrike/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-linux-20-04-lts-benchmark-v3/cis-ubuntu2004-v300-4-3-1/SKILL.md"
    }
  },
  "instructions": "# CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - Control 4.3.1\n\n## Profile\n\n- **Level:** Level 1 - Server, Level 1 - Workstation\n- **Assessment Status:** Automated\n\n## Description\n\nnftables provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and a new nft userspace command line tool. nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.\n\nNotes:\n\n- nftables is available in Linux kernel 3.13 and newer\n- Only one firewall ",
  "cost": {
    "context_tokens": 411
  }
}

Fetch it by URL: GET /api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu2004-v300-4-3-1/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.