policy:
id: cis-proxmox
file: cis-proxmox.yml
name: CIS Proxmox VE Baseline
description: >
Security Configuration Assessment baseline for Proxmox VE nodes
based on CIS Debian Linux Benchmark, adapted for Proxmox VE
architecture and UFW firewall usage.
references:
- CIS Debian Linux Benchmark v1.0
- Proxmox VE Security Guide
- GDPR Art. 32
- ISO/IEC 27001
platform: linux
requirements:
title: Proxmox VE environment check
description: Ensure this system is a Proxmox VE host
condition: any
rules:
- "c:command -v pveversion"
- "c:dpkg -l proxmox-ve"
- "f:/etc/pve"
checks:
# ------------------------------------------------------------
# ACCOUNT AND AUTHENTICATION
# ------------------------------------------------------------
- id: 91001
title: Ensure no local user accounts have empty passwords
description: >
Ensures that no human user accounts (UID >= 1000)
have empty password fields in /etc/shadow.
condition: all
rules:
- "c:awk -F: '($2 == \"\" && $3 >= 1000 && $1 != \"nobody\"){print $1}' /etc/shadow | wc -l -> r:^0$"
compliance:
- cis: "5.4.1"
- iso27001: "A.9.2.4"
- id: 91002
title: Ensure human user accounts use shadowed passwords
description: >
Ensures that human user accounts (UID >= 1000)
use shadowed passwords.
condition: all
rules:
- "c:awk -F: '($2 != \"x\" && $3 >= 1000 && $1 !~ /^(nobody|pve)$/){print $1}' /etc/passwd | wc -l -> r:^0$"
compliance:
- cis: "5.4.2"
- iso27001: "A.9.2.4"
# ------------------------------------------------------------
# FILE PERMISSIONS
# ------------------------------------------------------------
- id: 91010
title: Ensure permissions on /etc/passwd are configured
condition: all
rules:
- "c:stat -c \"%a %U %G\" /etc/passwd -> r:^644 root root$"
compliance:
- cis: "6.1.2"
- id: 91011
title: Ensure permissions on /etc/shadow are configured
condition: all
rules:
- "c:stat -c \"%a %U %G\" /etc/shadow -> r:^640 root shadow$"
compliance:
- cis: "6.1.3"
- id: 91012
title: Ensure permissions on /etc/group are configured
condition: all
rules:
- "c:stat -c \"%a %U %G\" /etc/group -> r:^644 root root$"
compliance:
- cis: "6.1.4"
- id: 91013
title: Ensure permissions on /etc/gshadow are configured
condition: all
rules:
- "c:stat -c \"%a %U %G\" /etc/gshadow -> r:^640 root shadow$"
compliance:
- cis: "6.1.5"
# ------------------------------------------------------------
# SSH HARDENING (PROXMOX-SAFE)
# ------------------------------------------------------------
- id: 91020
title: Ensure SSH root login is disabled
description: >
Root login over SSH should be disabled.
Proxmox access must be performed via sudo or web UI.
condition: all
rules:
- "f:/etc/ssh/sshd_config -> r:^PermitRootLogin no"
compliance:
- cis: "5.2.8"
- id: 91021
title: Ensure SSH password authentication is disabled
condition: all
rules:
- "f:/etc/ssh/sshd_config -> r:^PasswordAuthentication no"
compliance:
- cis: "5.2.9"
- id: 91022
title: Ensure SSH MaxAuthTries is limited
condition: all
rules:
- "f:/etc/ssh/sshd_config -> r:^MaxAuthTries [1-4]"
compliance:
- cis: "5.2.7"
# ------------------------------------------------------------
# FIREWALL (UFW)
# ------------------------------------------------------------
- id: 91030
title: Ensure UFW is installed
condition: all
rules:
- "c:command -v ufw -> r:.+"
compliance:
- cis: "4.2.1"
- id: 91031
title: Ensure UFW is enabled
condition: all
rules:
- "c:ufw status | grep -q \"Status: active\""
compliance:
- cis: "4.2.2"
- id: 91032
title: Ensure UFW default deny inbound policy
condition: all
rules:
- "c:ufw status verbose | grep -q \"Default: deny (incoming)\""
compliance:
- cis: "4.2.7"
# ------------------------------------------------------------
# LOGGING
# ------------------------------------------------------------
- id: 91040
title: Ensure rsyslog is installed
condition: all
rules:
- "c:command -v rsyslogd -> r:.+"
compliance:
- cis: "4.2.3"
- id: 91041
title: Ensure rsyslog service is enabled
condition: all
rules:
- "c:systemctl is-enabled rsyslog -> r:^enabled$"
compliance:
- cis: "4.2.3"
# ------------------------------------------------------------
# PROXMOX-SPECIFIC
# ------------------------------------------------------------
- id: 91050
title: Ensure Proxmox VE version command is available
condition: all
rules:
- "c:pveversion -> r:pve-manager"
compliance:
- proxmox: "baseline"
