cis-ubuntu2004-v300-4-2-7

name	cis-ubuntu2004-v300-4-2-7
description	Ensure ufw firewall rules exist for all open ports
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","firewall","ufw"]
cis_id	4.2.7
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 - Control 4.2.7

Profile

• Level: Level 1 - Server, Level 1 - Workstation
• Assessment Status: Automated

Description

Services and ports can be accepted or explicitly rejected.

Note:

• Changing firewall settings while connected over network can result in being locked out of the system
• The remediation command opens up the port to traffic from all sources. Consult ufw documentation and set any restrictions in compliance with site policy

Rationale

To reduce the attack surface of a system, all services and ports should be blocked unless required.

• Any ports that have been opened on non-loopback addresses need firewall rules to govern traffic.
• Without a firewall rule configured for open ports, the default firewall policy will drop all packets to these ports.
• Required ports should have a firewall rule created to allow approved connections in accordance with local site policy.
• Unapproved ports should have an explicit deny rule created.

Audit Procedure

Command Line

Run the following script to verify a firewall rule exists for all open ports:

#!/usr/bin/env bash

{
  unset a_ufwout
  unset a_openports

  # Read UFW Ports
  while read -r l_ufwport; do
    [ -n "$l_ufwport" ] && a_ufwout+=("$l_ufwport")
  done < <(ufw show raw 2>&1 |grep -Po 'dpt:\K\d+' |sort -u)

  # Read Multiport Rules
  while read -r l_multiport; do
    for port in $(echo "$l_multiport" | awk -F'--dports ' '{print $2}' | awk -F' '  |   );
  
       [[  == *:* ]]; 
        IFS=  -r start_port end_port <<< 
         ((i=start_port; i<=end_port; i++)); 
          a_ufwout+=()
        
      
        a_ufwout+=()
      
    
   < /etc/ufw/user.rules

  
    -r l_openport; 
    [ -n  ] && a_openports+=()
   < <(ss -tuln | awk  |
   -u)

  
  a_diff=()

  
   [[ -n  ]]; 
     -e 
  
     -e 
  
}