Menu
Amazon Inspector
User Guide (Version Latest)

Security Best Practices

The rules in this package help determine whether your systems are configured securely.

Important

In this release of Amazon Inspector, you can include in your assessment targets EC2 instances that are running either Linux-based or Windows-based operating systems.

During an assessment run, the rules in all the packages described in this topic generate findings only for the EC2 instances that are running Linux-based operating systems. The rules in these packages do NOT generate findings for EC2 instances that are running Windows-based operating systems.

For more information, see Rules Packages Availability Across Supported Operating Systems.

Disable Root Login over SSH

This rule helps determine whether the SSH daemon is configured to permit logging in to your EC2 instance as root .

Severity: Medium

Finding

There is an instance in your assessment target that is configured to allow users to log in with root credentials over SSH. This increases the likelihood of a successful brute-force attack.

Resolution

We recommend that you configure your EC2 instance to prevent root account logins over SSH. Instead, log in as a non-root user and use sudo to escalate privileges when necessary. To disable SSH root account logins, set PermitRootLogin to no in /etc/ssh/sshd_config and restart sshd.

Support SSH Version 2 Only

This rule helps determine whether your EC2 instances are configured to support SSH protocol version 1.

Severity: Medium

Finding

An EC2 instance in your assessment target is configured to support SSH 1, which contains inherent design flaws that greatly reduce its security.

Resolution

We recommend that you configure EC2 instances in your assessment target to support only SSH 2 and higher. For OpenSSH, you can achieve this by setting Protocol 2 in /etc/ssh/sshd_config. For more information, see man sshd_config.

Disable Password Authentication Over SSH

This rule helps determine whether your EC2 instances are configured to support password authentication over the SSH protocol.

Severity: Medium

Finding

An EC2 instance in your assessment target is configured to support password authentication over SSH. Password authentication is susceptible to brute-force attacks and should be disabled in favor of key-based authentication where possible.

Resolution

We recommend that you disable password authentication over SSH on your EC2 instances and enable support for key-based authentication instead. This significantly reduces the likelihood of a successful brute-force attack. For more information, see https://aws.amazon.com/articles/1233/. If password authentication is supported, it is important to restrict access to the SSH server to trusted IP addresses.

Configure Password Maximum Age

This rule helps determine whether the maximum age for passwords is configured on your EC2 instances.

Severity - Medium

Finding

An EC2 instance in your assessment target is not configured for a maximum age for passwords.

Resolution

If you are using passwords, we recommend that you configure a maximum age for passwords on all EC2 instances in your assessment target. This requires users to regularly change their passwords and reduces the chances of a successful password guessing attack. To fix this issue for existing users, use the chage command. To configure a maximum age for passwords for all future users, edit the PASS_MAX_DAYS field in the /etc/login.defs file.

Configure Password Minimum Length

This rule helps determine whether a minimum length for passwords is configured on your EC2 instances.

Severity: Medium

Finding

An EC2 instance in your assessment target is not configured for a minimum length for passwords.

Resolution

If you are using passwords, we recommend that you configure a minimum length for passwords on all EC2 instances in your assessment target. Enforcing a minimum password length reduces the risk of a successful password guessing attack. To enforce minimum password lengths, set the minlen parameter of pam_cracklib.so in your PAM configuration. For more information, see man pam_cracklib.

Configure Password Complexity

This rule helps determine whether a password complexity mechanism is configured on your EC2 instances.

Severity: Medium

Finding

No password complexity mechanism or restrictions are configured on EC2 instances in your assessment target. This allows users to set simple passwords, thereby increasing the chances of unauthorized users gaining access and misusing accounts.

Resolution

If you are using passwords, we recommend that you configure all EC2 instances in your assessment target to require a level of password complexity. You can do this by using pam_cracklib.so "lcredit", "ucredit", "dcredit", and "ocredit" settings. For more information, see man pam_cracklib.

Enable ASLR

This rule helps determine whether address space layout randomization (ASLR) is enabled on the operating systems of the EC2 instances in your assessment target.

Severity: Medium

Finding

An EC2 instance in your assessment target does not have ASLR enabled.

Resolution

To improve the security of your assessment target, we recommend that you enable ASLR on the operating systems of all EC2 instances in your assessment target by running echo 2 | sudo tee /proc/sys/kernel/randomize_va_space.

Enable DEP

This rule helps determine whether Data Execution Prevention (DEP) is enabled on the operating systems of the EC2 instances in your assessment target.

Severity: Medium

Finding

An EC2 instance in your assessment target does not have DEP enabled.

Resolution

We recommend that you enable DEP on the operating systems of all EC2 instances in your assessment target. Enabling DEP protects your instances from security compromises using buffer-overflow techniques.

Configure Permissions for System Directories

This rule checks permissions on system directories that contain binaries and system configuration information to make sure that only the root user (a user who logs in by using root account credentials) has write permissions for these directories.

Severity: High

Finding

An EC2 instance in your assessment target contains a system directory that is writable by non-root users.

Resolution

To improve the security of your assessment target and to prevent privilege escalation by malicious local users, configure all system directories on all EC2 instances in your assessment target to be writable only by users who log in by using root account credentials.