This is the user guide for Amazon Inspector Classic. For information about the
new Amazon Inspector, see the Amazon Inspector User
Guide. To access the Amazon Inspector Classic console, open the Amazon Inspector console at https://console.aws.amazon.com/inspector/
Security best practices for Amazon Inspector Classic
Use Amazon Inspector Classic rules to help determine whether your systems are configured securely.
Important
Currently, you can include in your assessment targets EC2 instances that are running either Linux-based or Windows-based operating systems.
During an assessment run, the rules described in this section generate findings only for the EC2 instances that are running Linux-based operating systems. The rules do not generate findings for EC2 instances that are running Windows-based operating systems.
For more information, see Amazon Inspector Classic rules packages for supported operating systems.
Topics
Disable root login over SSH
This rule helps determine whether the SSH daemon is configured to permit logging in to your EC2 instance as root .
- Severity
- Finding
-
There is an EC2 instance in your assessment target that is configured to allow users to log in with root credentials over SSH. This increases the likelihood of a successful brute-force attack.
- Resolution
-
We recommend that you configure your EC2 instance to prevent root account logins over SSH. Instead, log in as a non-root user and use
sudo
to escalate privileges when necessary. To disable SSH root account logins, setPermitRootLogin
tono
in the/etc/ssh/sshd_config
file, and then restartsshd
.
Support SSH version 2 only
This rule helps determine whether your EC2 instances are configured to support SSH protocol version 1.
- Severity
- Finding
-
An EC2 instance in your assessment target is configured to support SSH-1, which contains inherent design flaws that greatly reduce its security.
- Resolution
-
We recommend that you configure EC2 instances in your assessment target to support only SSH-2 and later. For OpenSSH, you can achieve this by setting
Protocol 2
in the/etc/ssh/sshd_config
file. For more information, seeman sshd_config
.
Disable password authentication Over SSH
This rule helps determine whether your EC2 instances are configured to support password authentication over the SSH protocol.
- Severity
- Finding
-
An EC2 instance in your assessment target is configured to support password authentication over SSH. Password authentication is susceptible to brute-force attacks and should be disabled in favor of key-based authentication where possible.
- Resolution
-
We recommend that you disable password authentication over SSH on your EC2 instances and enable support for key-based authentication instead. This significantly reduces the likelihood of a successful brute-force attack. For more information, see https://aws.amazon.com/articles/1233/
. If password authentication is supported, it is important to restrict access to the SSH server to trusted IP addresses.
Configure password maximum age
This rule helps determine whether the maximum age for passwords is configured on your EC2 instances.
- Severity
- Finding
-
An EC2 instance in your assessment target is not configured for a maximum age for passwords.
- Resolution
-
If you are using passwords, we recommend that you configure a maximum age for passwords on all EC2 instances in your assessment target. This requires users to regularly change their passwords and reduces the chances of a successful password guessing attack. To fix this issue for existing users, use the chage command. To configure a maximum age for passwords for all future users, edit the
PASS_MAX_DAYS
field in the/etc/login.defs
file.
Configure password minimum length
This rule helps determine whether a minimum length for passwords is configured on your EC2 instances.
- Severity
- Finding
-
An EC2 instance in your assessment target is not configured for a minimum length for passwords.
- Resolution
-
If you are using passwords, we recommend that you configure a minimum length for passwords on all EC2 instances in your assessment target. Enforcing a minimum password length reduces the risk of a successful password guessing attack. You can do this by using the following option in the
pwquality.conf
file:minlen
. For more information, see see https://linux.die.net/man/5/pwquality.conf. If
pwquality.conf
is not available on your instance, you can set theminlen
option using thepam_cracklib.so
module. For more information, seeman pam_cracklib
. The
minlen
option should be set to 14 or greater.
Configure password complexity
This rule helps determine whether a password complexity mechanism is configured on your EC2 instances.
- Severity
- Finding
-
No password complexity mechanism or restrictions are configured on EC2 instances in your assessment target. This allows users to set simple passwords, which increases the chances of unauthorized users gaining access and misusing accounts.
- Resolution
-
If you are using passwords, we recommend that you configure all EC2 instances in your assessment target to require a level of password complexity. You can do this by using the following options in the
pwquality.conf
file:lcredit
,ucredit
,dcredit
, andocredit
. For more information, see https://linux.die.net/man/5/pwquality.conf. If
pwquality.conf
is not available on your instance, you can set thelcredit
,ucredit
,dcredit
, andocredit
options using thepam_cracklib.so
module. For more information, seeman pam_cracklib
. The expected value for each of these options is less than or equal to -1, as shown below:
lcredit <= -1, ucredit <= -1, dcredit<= -1, ocredit <= -1
Additionally, the
remember
option must be set to 12 or greater. For more information, seeman pam_unix
.
Enable ASLR
This rule helps determine whether address space layout randomization (ASLR) is enabled on the operating systems of the EC2 instances in your assessment target.
- Severity
- Finding
-
An EC2 instance in your assessment target does not have ASLR enabled.
- Resolution
-
To improve the security of your assessment target, we recommend that you enable ASLR on the operating systems of all EC2 instances in your target by running echo 2 | sudo tee /proc/sys/kernel/randomize_va_space.
Enable DEP
This rule helps determine whether Data Execution Prevention (DEP) is enabled on the operating systems of the EC2 instances in your assessment target.
Note
This rule is not supported for EC2 instances with ARM processors.
- Severity
- Finding
-
An EC2 instance in your assessment target does not have DEP enabled.
- Resolution
-
We recommend that you enable DEP on the operating systems of all EC2 instances in your assessment target. Enabling DEP protects your instances from security compromises using buffer-overflow techniques.
Configure permissions for system directories
This rule checks permissions on system directories that contain binaries and system configuration information. It checks that only the root user (a user who logs in by using root account credentials) has write permissions for these directories.
- Severity
- Finding
-
An EC2 instance in your assessment target contains a system directory that is writable by non-root users.
- Resolution
-
To improve the security of your assessment target and to prevent privilege escalation by malicious local users, configure all system directories on all EC2 instances in your target to be writable only by users who log in by using root account credentials.