Using the UA client to enable the CIS benchmarking tool

Overview

Duration: 2:00

What is the CIS benchmarking tool?

The Center for Internet Security (CIS) has published hardening benchmarks for all Ubuntu LTS versions since Ubuntu 12.04 LTS. These hardening benchmarks are meant to be best-practice security configurations. Canonical has developed a tool that automates the process of hardening and auditing Ubuntu LTS images based on the published CIS benchmarks, enabling you to harden an image within minutes.

In this tutorial, we will learn how Ubuntu Advantage for Infrastructure and Ubuntu Pro customers, as well as personal users taking advantage of their free access to Ubuntu Advantage for Infrastructure, can use the Ubuntu Advantage client (UA client) to enable the CIS benchmarking tool on Ubuntu 16.04 and 18.04 LTS machines. (Customers who would like to use the tool to harden an Ubuntu 20.04 image currently need to contact our Support Team to request access to the packages.)

Please note that using the UA client to access the CIS benchmarking tool is currently in beta.

Understanding the UA client

The Ubuntu Advantage (UA) client is a tool designed to automate access to UA services like Extended Security Maintenance (ESM), CIS, FIPS, and more. The client is available for all Ubuntu LTS releases, however some services, such as the CIS benchmarking tool, are in beta or are not available for all Ubuntu LTS releases.

What you’ll learn:

  • How to check which version of the UA client is installed on your machine and how to update it if necessary
  • How to attach the UA client to your Ubuntu Advantage account using your UA token
  • How to enable the CIS benchmarking tool on your Ubuntu machine

What you’ll need:

Checking the UA client

Duration: 4:00

In this step, we will check which version of the UA client we have installed, because we need at least version 26.2 to enable the CIS benchmarking tool. We will then update our UA client if needed.

To see which version of the UA client you have installed, run:

$ apt-cache policy ubuntu-advantage-tools

ubuntu-advantage-tools:

Installed: 10ubuntu0.16.04.1

Candidate: 10ubuntu0.16.04.1

Version table:

*** 10ubuntu0.16.04.1 500

500 http://azure.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages

100 /var/lib/dpkg/status

We need at least version 26.2 and we have 10ubuntu0.16.04.1, so we now need to add the UA Client PPA from Launchpad and upgrade our UA package (skip this step if you are already running at least 26.2):

$ sudo add-apt-repository ppa:ua-client/stable
$ sudo apt update
$ sudo apt install ubuntu-advantage-tools

Now we have the correct version running!

$ ua version

26.3~16.04.1

Finally, we should remove the Launchpad PPA containing the UA client, otherwise we might be pulling newer versions of the UA tools in the future that we might not really want:

$ sudo add-apt-repository --remove ppa:ua-client/stable

Retrieving your UA token from the Ubuntu Advantage dashboard and attaching it to the UA client

Duration: 5:00

If you are enabling the CIS tool on an Ubuntu Pro instance, you can skip this step and go straight to step 4! For non-Pro images, your UA token is used to connect the UA client you have installed on your machines to your Ubuntu Advantage for Infrastructure subscription.

Let’s first check whether we have already attached our UA token to the UA client by running :

$ sudo ua status

SERVICE AVAILABLE DESCRIPTION

esm-infra yes UA Infra: Extended Security Maintenance (ESM)

fips yes NIST-certified FIPS modules

fips-updates yes Uncertified security updates to FIPS modules

livepatch yes Canonical Livepatch service

This machine is not attached to a UA subscription.

See https://ubuntu.com/advantage

We can see that this is not yet attached to a UA subscription. Let’s fix that now.

Your UA token can be found on your Ubuntu Advantage dashboard. To access your dashboard, you need an Ubuntu One account. If you still need to create one, ensure that you use the email address used to purchase your subscription.

The Ubuntu One account functions as a Single Sign On, so once logged in we can go straight to the Ubuntu Advantage dashboard at ubuntu.com/advantage. Then click on the ‘Machines’ column in the Your Paid Subscriptions table to reveal your token.

Now we’re ready to attach our UA token to the UA client:

$ sudo ua attach <your_ua_token>

Enabling default service esm-infra

Updating package lists

ESM Infra enabled

Enabling default service livepatch

Canonical livepatch enabled.

This machine is now attached to ‘your account name’

SERVICE ENTITLED STATUS DESCRIPTION

esm-infra yes enabled UA Infra: Extended Security Maintenance (ESM)

fips yes n/a NIST-certified FIPS modules

fips-updates yes n/a Uncertified security updates to FIPS modules

livepatch yes enabled Canonical Livepatch service

Don’t worry that you cannot see the CIS service at this stage - because it is still in beta, it does not appear here yet.

Enabling the CIS tool

Duration: 3:00

Now it is time to enable the CIS tool. First, we want to run the following command to see the CIS service and its status:

$ ua status --all

We should see an output like this (please note that some people may still not see the CIS service at this point, but you can still enable it in the next step):

SERVICE ENTITLED STATUS DESCRIPTION

cc-eal yes n/a Common Criteria EAL2 Provisioning Packages

cis yes n/a Center for Internet Security Audit Tools

esm-apps no — UA Apps: Extended Security Maintenance (ESM)

esm-infra yes enabled UA Infra: Extended Security Maintenance (ESM)

fips yes n/a NIST-certified FIPS modules

fips-updates yes n/a Uncertified security updates to FIPS modules

livepatch yes enabled Canonical Livepatch service

Enable services with: ua enable

Now we’re ready to enable CIS with the --beta flag:

$ sudo ua enable cis --beta

One moment, checking your subscription first

Updating package lists

Installing CIS Audit packages

CIS Audit enabled

Configure and run the CIS benchmarking tool

Duration: 10:00

You have successfully enabled the CIS benchmarking tool and are ready to use it to harden your Ubuntu machine. Now you can proceed with the next steps from the “Configure and run CIS Benchmark rule” section of the Ubuntu’s documentation about CIS for Ubuntu 18.04 and Ubuntu 16.04 to complete the hardening process.

Congratulations!

Duration: 1:00

Congratulations, you have successfully used the UA client to harden your Ubuntu image!

Add here a Pro subscription