基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-aws-storage-4-6命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | cis-aws-storage-4.6 |
| description | Ensure EC2 Kernel compatibility with Lustre |
| category | cis-storage-services |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","aws","storage","fsx","lustre","kernel","compatibility","ubuntu","level-2"] |
| cis_id | 4.6 |
| cis_benchmark | CIS AWS Storage Services Benchmark v1.0.0 |
| tech_stack | ["aws","linux"] |
| cwe_ids | [] |
| chains_with | ["cis-aws-storage-4.5","cis-aws-storage-4.7"] |
| prerequisites | ["cis-aws-storage-4.2","cis-aws-storage-4.5"] |
| severity_boost | {} |
The latest kernel included with the Ubuntu Amazon EC2 AMI is not compatible with the Lustre service, which is crucial for mounting the cache on your EC2 instance. To downgrade your kernel, specific prerequisites must be met if you are using the default Ubuntu machine image as of November 8, 2023.
The latest kernel version is not supported by Lustre, and meeting the prerequisites for downgrading will allow you to leverage Lustre's high-performance file system capabilities effectively. This ensures optimal data access and processing efficiency on your EC2 instance.
Using an incompatible kernel version will prevent the Lustre client from functioning properly, resulting in inability to mount FSx File Cache and loss of high-performance file system capabilities.
ssh -i "{KEY.pem}" ubuntu@{your-ec2-instance}
uname -r
sudo apt-cache search lustre-client-modules
The EC2 instance should be running a kernel version compatible with Lustre:
Follow the steps to downgrade your kernel to a Lustre-compatible version:
apt-cache search lustre-client-modules
sudo apt-get install -y linux-image-5.15.0-1049-aws
sudo sed -i 's/GRUB_DEFAULT=.\+/GRUB_DEFAULT="Advanced options for Ubuntu>Ubuntu, with Linux 5.15.0-1049-aws"/' /etc/default/grub
sudo reboot
ssh -i "{KEY.pem}" ubuntu@{your-ec2-instance}
sudo apt-get install -y lustre-client-modules-$(uname -r)
# Confirm kernel version
uname -r
# Verify Lustre module installation
dpkg -l | grep lustre
# Check if Lustre module can be loaded
sudo modprobe lustre
lsmod | grep lustre
The default Ubuntu AMI includes the latest kernel which may not be compatible with Lustre. Manual kernel downgrade is required for Lustre compatibility.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account. | ● | ● | ● |
| v8 | 13.11 Tune Security Event Alerting Thresholds Tune security event alerting thresholds monthly, or more frequently. | ● | ||
| v7 | 5.2 Maintain Secure Images Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates. | ● | ● | |
| v7 | 13.4 Only Allow Access to Authorized Cloud Storage or Email Providers Only allow access to authorized cloud storage or email providers. | ● | ● |
Level 2