Ubuntu hardened repository in combination with DISA-STIG

[Jos.maliepaard]

Hi all,

Does someone have any experience with a hardened repository on Ubuntu and DISA-STIG compliancy. It seems to be working, but are there some caveats to be kept in mind?

[bct44]

Hello, i don't know if you're considering to harden your OS with nist security profile.
There is a KB about it on V11:
https://www.veeam.com/kb4250

Normally it's fixed on v12 but didn't had the opportunity to test it for the moment.

[HannesK]

Hello,
and welcome to the forums.

It seems to be working

that's how it should be The UMASK issue is fixed in V12. We are testing with DISA-STIG hardening on Ubuntu 20.04 (mentioned in this blog post) and plan official documentation on this.

Just curious: which distro are you using and how did you apply DISA STIG hardening (script, ansible...).

but are there some caveats to be kept in mind?

the only thing that comes into my mind with huge impact would be AIDE scanning the backup files. That should be avoided.

Best regards,
Hannes