Levels and the Two Distributions¶
Most Linux pages on this site mark settings with a CIS item number and, where it isn't Level 1, a level. The numbers come from the CIS Linux Mint 22 Benchmark v1.0.0, the same kind of standard the Windows pages use.
What the labels mean¶
Level 1 settings are the baseline: they reduce attack surface without getting in the way of a normal workstation. Do all of them.
Level 2 settings are for a machine where security matters more than convenience. Some are harmless on an image (auditd, root lockout with faillock, the extra audit rules); some break things a README may require (blocking usb-storage, removing the print server, a separate partition for /home that you can't create on a running image). Check the README before each Level 2 item.
Why a Mint 22 benchmark for Mint 21¶
CIS hasn't published a usable Mint 21 benchmark. Mint 21 is Ubuntu 22.04 underneath and Mint 22 is Ubuntu 24.04, and the two differ in almost nothing the benchmark touches. Each item was compared against what Mint 21 ships. The differences that exist:
| Benchmark item | Mint 22 | Mint 21 |
|---|---|---|
| Package sources (1.2.1.2) | Same file, official-package-repositories.list, with the noble Ubuntu base |
Same file with jammy; see Package Sources |
| PAM profiles (5.2.2.x) | pam-auth-update profiles for faillock ship with the OS |
Not shipped; you create the two profile files, which the faillock page shows |
| Password hashing (5.2.3.4.3) | yescrypt default | yescrypt default (Ubuntu 22.04 was the first release to use it); older images may still show sha512 in common-password, which the benchmark also accepts |
| Automatic updates (1.2.2.2) | unattended-upgrades |
Same package; Mint's Update Manager writes the same files |
| Screen lock keys (1.7.2) | org.cinnamon.desktop.* |
Same keys; MATE edition uses org.mate.* |
| AppArmor (1.3.1.x) | Installed and enforcing by default | Same |
nologin in /etc/shells (5.3.3.1) |
Not listed | Not listed |
audit_backlog_limit (6.2.1.4) |
Same | Same |
Everything else is identical.
Debian 12¶
Debian 12 has its own benchmark, the CIS Debian Linux 12 Benchmark v2.0.0. It covers the same ground with the same values and adds a Server profile alongside Workstation, which mostly means a few Workstation Level 2 items (usb-storage, autofs, the print server) become Server Level 1, and wireless drivers are blocked on a server. Its section numbers differ from Mint's; this site cites the Mint numbers as the default and adds "Debian CIS" numbers where the Debian benchmark has something Mint doesn't:
| Where | What the Debian benchmark adds |
|---|---|
| SSH | A full sshd section (Debian CIS 5.1.x): ciphers, key exchange, MACs, MaxStartups, MaxSessions, host-based auth, AllowUsers, config file permissions |
| Kernel Modules | firewire-core, atm, can; wireless drivers on a server |
| Kernel Hardening | systemd-coredump ProcessSizeMax=0 and Storage=none |
| AppArmor | kernel.apparmor_restrict_unprivileged_unconfined = 1 |
| Package Sources | Permissions on the apt key and source files, Signed-By, no weak dependencies (Level 2) |
| Login Banners | pam_motd and file permissions |
| Screen Lock | GDM items by name, WaylandEnable=false (Level 2) |
| Services | chrony as the alternative time service, running as _chrony |
| The Firewall | Default deny outgoing (Level 2) |
| Reading the Logs | rsyslog: installed, running, $FileCreateMode 0640, not listening for remote logs, logrotate |
What changes in practice on Debian:
| Area | Debian 12 |
|---|---|
| Root | Usually has a password, so passwd -S root shows P. The README decides whether that stays; the Root Account page covers it. |
| sudo | The installer only creates the sudo group member if root was given no password. Check getent group sudo. |
| Desktop and login screen | GNOME with GDM (/etc/gdm3/), org.gnome.desktop.* keys instead of org.cinnamon.* |
| Package sources | /etc/apt/sources.list with bookworm, bookworm-updates, and bookworm-security |
| Firewall | ufw isn't installed by default; sudo apt install ufw first |
| AppArmor | Installed and enabled by default since Debian 10 |
apport |
Doesn't exist; skip 1.5.6 |
| Snaps and Flatpak | Neither by default |
| Firefox | firefox-esr, profile in ~/.mozilla/firefox |
The STIG¶
The DISA STIG is the Department of Defense's hardening standard, and CIS publishes it as the CIS Ubuntu 22.04 LTS STIG Benchmark v1.0.0. There's no Mint or Debian STIG, but Mint 21 is Ubuntu 22.04 underneath, so nearly every item applies to it directly, and Debian 12 shares all the same files and tools. Where a page says STIG UBTU-22-…, the row comes from there. STIG items carry a severity instead of a level: CAT I (an attacker could get in or take over directly), CAT II (a meaningful weakness), CAT III (a minor one).
Most of the STIG's 179 items restate CIS rows already on this site. The ones that add something are folded into the pages where they belong, and where CIS and STIG disagree on a number (password age, lockout, minimum length) the tables show both and say which to use. The STIG items left out are the DoD-specific ones: smart card and PIV login, DoD certificate authorities, FIPS mode, offloading audit logs to a remote server, and full-disk encryption, which can't be added to an installed image.
The CIS numbers¶
Tables on this site include the benchmark's item number (for example, 5.2.3.1.1) so you can look up the full rationale and audit procedure in the benchmark itself. The benchmark is free from cisecurity.org.
Try it¶
- Look up two item numbers from any page in the Mint benchmark PDF and read the Impact section.
- Find three Level 2 items a README could forbid and write down what it would have to say.
Build it¶
Nothing yet. This page is the map.