cis-ubuntu2004-v300-2-1-22

name	cis-ubuntu2004-v300-2-1-22
description	Ensure only approved services are listening on a network interface
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","services"]
cis_id	2.1.22
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.1.22 Ensure only approved services are listening on a network interface (Manual)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Services listening on any network interface provide an attack surface for exploitation. Reviewing all services listening on the network is important to identify those that may not be necessary and could potentially be disabled.

Rationale

Services listening on the system pose a potential risk as an attack vector. These services should be reviewed, and if not required, the service should be stopped and disabled, or the software should be removed.

Audit Procedure

Command Line

Run the following command to review all services listening on the system:

# ss -plntu

Review the output to verify all services listening on the system are approved by site policy.

Expected Result

Only approved services should be listening on network interfaces.

Remediation

Command Line

For each unauthorized service:

1. Stop and mask the service:

# systemctl stop <service_name>
# systemctl mask <service_name>

2. If the package is not required, remove it:

# apt purge <package_name>

References

1. NIST SP 800-53 Rev. 5: CM-7

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software		x	x
v7	9.2 Ensure Only Approved Ports, Protocols and Services Are Running		x	x

MITRE ATT&CK Mappings: T1203, T1210, T1543, T1543.002 | TA0008 | M1042