Security Best Practices
The rules in this package help determine whether your systems are configured securely.
Important
In this release of Amazon Inspector, you can include in your assessment targets EC2 instances that are running either Linux-based or Windows-based operating systems.
During an assessment run, the rules in all the packages described in this topic generate findings only for the EC2 instances that are running Linux-based operating systems. The rules in these packages do NOT generate findings for EC2 instances that are running Windows-based operating systems.
For more information, see Rules Packages Availability Across Supported Operating Systems.
Topics
Disable Root Login over SSH
This rule helps determine whether the SSH daemon is configured to permit logging in to your EC2 instance as root .
Severity: Medium
Finding
There is an instance in your assessment target that is configured to allow users to log in with root credentials over SSH. This increases the likelihood of a successful brute-force attack.
Resolution
We recommend that you configure your EC2 instance to prevent root account logins over SSH. Instead, log in as a non-root user and use sudo to escalate privileges when necessary. To disable SSH root account logins, set PermitRootLogin to no in /etc/ssh/sshd_config and restart sshd.
Support SSH Version 2 Only
This rule helps determine whether your EC2 instances are configured to support SSH protocol version 1.
Severity: Medium
Finding
An EC2 instance in your assessment target is configured to support SSH 1, which contains inherent design flaws that greatly reduce its security.
Resolution
We recommend that you configure EC2 instances in your assessment target to support only SSH 2 and higher. For OpenSSH, you can achieve this by setting Protocol 2 in /etc/ssh/sshd_config. For more information, see man sshd_config.
Disable Password Authentication Over SSH
This rule helps determine whether your EC2 instances are configured to support password authentication over the SSH protocol.
Severity: Medium
Finding
An EC2 instance in your assessment target is configured to support password authentication over SSH. Password authentication is susceptible to brute-force attacks and should be disabled in favor of key-based authentication where possible.
Resolution
We recommend that you disable password authentication over SSH on your EC2 instances and enable support for key-based authentication instead. This significantly reduces the likelihood of a successful brute-force attack. For more information, see https://aws.amazon.com/articles/1233/. If password authentication is supported, it is important to restrict access to the SSH server to trusted IP addresses.
Configure Password Maximum Age
This rule helps determine whether the maximum age for passwords is configured on your EC2 instances.
Severity - Medium
Finding
An EC2 instance in your assessment target is not configured for a maximum age for passwords.
Resolution
If you are using passwords, we recommend that you configure a maximum age for passwords on all EC2 instances in your assessment target. This requires users to regularly change their passwords and reduces the chances of a successful password guessing attack. To fix this issue for existing users, use the chage command. To configure a maximum age for passwords for all future users, edit the PASS_MAX_DAYS field in the /etc/login.defs file.
Configure Password Minimum Length
This rule helps determine whether a minimum length for passwords is configured on your EC2 instances.
Severity: Medium
Finding
An EC2 instance in your assessment target is not configured for a minimum length for passwords.
Resolution
If you are using passwords, we recommend that you configure a minimum length for passwords on all EC2 instances in your assessment target. Enforcing a minimum password length reduces the risk of a successful password guessing attack. To enforce minimum password lengths, set the minlen parameter of pam_cracklib.so in your PAM configuration. For more information, see man pam_cracklib.
Configure Password Complexity
This rule helps determine whether a password complexity mechanism is configured on your EC2 instances.
Severity: Medium
Finding
No password complexity mechanism or restrictions are configured on EC2 instances in your assessment target. This allows users to set simple passwords, thereby increasing the chances of unauthorized users gaining access and misusing accounts.
Resolution
If you are using passwords, we recommend that you configure all EC2 instances in your assessment target to require a level of password complexity. You can do this by using pwquality.conf "lcredit", "ucredit", "dcredit", and "ocredit" settings. For more information, see https://linux.die.net/man/5/pwquality.conf . If pwquality.conf is not available on your instance, you can set the "lcredit", "ucredit", "dcredit", and "ocredit" settings using pam_cracklib.so. For more information, see man pam_cracklib.
Enable ASLR
This rule helps determine whether address space layout randomization (ASLR) is enabled on the operating systems of the EC2 instances in your assessment target.
Severity: Medium
Finding
An EC2 instance in your assessment target does not have ASLR enabled.
Resolution
To improve the security of your assessment target, we recommend that you enable ASLR on the operating systems of all EC2 instances in your assessment target by running echo 2 | sudo tee /proc/sys/kernel/randomize_va_space.
Enable DEP
This rule helps determine whether Data Execution Prevention (DEP) is enabled on the operating systems of the EC2 instances in your assessment target.
Severity: Medium
Finding
An EC2 instance in your assessment target does not have DEP enabled.
Resolution
We recommend that you enable DEP on the operating systems of all EC2 instances in your assessment target. Enabling DEP protects your instances from security compromises using buffer-overflow techniques.
Configure Permissions for System Directories
This rule checks permissions on system directories that contain binaries and system configuration information to make sure that only the root user (a user who logs in by using root account credentials) has write permissions for these directories.
Severity: High
Finding
An EC2 instance in your assessment target contains a system directory that is writable by non-root users.
Resolution
To improve the security of your assessment target and to prevent privilege escalation by malicious local users, configure all system directories on all EC2 instances in your assessment target to be writable only by users who log in by using root account credentials.
