Checklist · Servers

Linux server baseline

Standard settings for every new Linux server before it takes traffic or joins a cluster.

Owner: SysadminTime: 45 minISO 27001 A.8.9ISO 27001 A.8.5ISO 27001 A.8.15ISO 27001 A.8.20

0 of 27

Build and patching

Built from the approved image or configuration-management role, not by hand.
Operating system is a vendor-supported release with at least 12 months of security updates left.
All pending security updates installed; unattended security updates enabled.
Unused packages, services and compilers removed from the image.
Clock synchronised with the organisation time source; timezone set to UTC.
Hostname, owner, environment and data classification recorded in the asset inventory.

Accounts and SSH

Root login over SSH disabled; password authentication disabled; key-based login only.
Personal accounts only; no shared logins. Service accounts have no interactive shell.
sudo is granted by group, requires authentication, and every use is logged.
Default and vendor accounts removed or locked; empty passwords not permitted.
SSH keys have an owner and an expiry; authorized_keys reviewed against the access list.
MFA or a bastion/session-recording host in front of administrative access.

Network and filesystem

Host firewall default-deny inbound; only the listed service ports open.
Listening ports compared with the expected list (ss -tulpn); nothing unexplained.
Management interfaces (SSH, monitoring) reachable only from the admin network.
/tmp, /var/tmp and /dev/shm mounted noexec,nosuid,nodev where the workload allows it.
World-writable files and directories without the sticky bit: none outside the approved list.
Disk encryption enabled where the host holds regulated or confidential data.

Logging and detection

auditd or equivalent records privileged commands, authentication and changes to /etc.
Logs shipped off the host to central storage; local log tampering does not erase them.
Log retention matches policy and is confirmed on the central side, not just the host.
EDR/antimalware agent installed, reporting and in blocking mode.
Vulnerability scanner can reach the host and the first scan has run.

Handover

Backup job configured and one restore test scheduled.
Monitoring and alert routing to the on-call rota confirmed with a test alert.
Configuration drift check enabled against this baseline.
Build recorded as a change; deviations from the baseline carry an approved exception.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Klar til at komme
videre end klassisk GRC?

14 dages gratis prøve. Intet betalingskort. Cloud eller on-premises.

Book demo Tal med salg →