AKS CIS compliance for Ubuntu 22.04 and 24.04 by jepio · Pull Request #7061 · Azure/AgentBaker

jepio · 2025-09-19T15:26:30Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
This PR brings AKS Ubuntu 22.04 and 24.04 images into compliance with CIS L1 as much as possible (~89% pass). Deviations will be explained in our docs. We now also have a test for regressions compared to compliance baseline.

Some of the implemented changes:

grub password
root password config - ensure waagent doesn't remove what was configured
pam configuration
sshd configuration
more stricter modprobe config
install apparmor utils
make apparmor enablement explicit (it is already implicitly enabled so no functional change)
remove ftp/telnet packages

Which issue(s) this PR fixes:

Fixes #

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
tested upgrade from previous version
commits are GPG signed and Github marks them as verified

Special notes for your reviewer:

Release note:

none

cameronmeissner · 2025-09-29T21:00:07Z


  - task: CopyFiles@2
-    condition: and(eq(variables.OS_SKU, 'Ubuntu'), in(variables.OS_VERSION, '22.04', '24.04'), eq(variables.FEATURE_FLAGS, 'None'))
+    condition: and(eq(variables.OS_SKU, 'Ubuntu'), in(variables.OS_VERSION, '22.04', '24.04'), in(variables.FEATURE_FLAGS, 'None', 'cvm'))


why disabling CVM?

Previously we scanned CVMs too but didn't capture the report from them, the change to this line stores the scan result from cvms in artifacts.
it doesn't disable cvm but enables them.

ah sorry misread, sounds good

cameronmeissner · 2025-09-29T21:01:33Z

    apt_get_update || exit $ERR_APT_UPDATE_TIMEOUT

-    pkg_list=(bind9-dnsutils ca-certificates ceph-common cgroup-lite cifs-utils conntrack cracklib-runtime ebtables ethtool glusterfs-client htop init-system-helpers inotify-tools iotop iproute2 ipset iptables nftables jq libpam-pwquality libpwquality-tools mount nfs-common pigz socat sysfsutils sysstat util-linux xz-utils netcat-openbsd zip rng-tools kmod gcc make dkms initramfs-tools linux-headers-$(uname -r) linux-modules-extra-$(uname -r))
+    pkg_list=(apparmor-utils bind9-dnsutils ca-certificates ceph-common cgroup-lite cifs-utils conntrack cracklib-runtime ebtables ethtool glusterfs-client htop init-system-helpers inotify-tools iotop iproute2 ipset iptables nftables jq libpam-pwquality libpwquality-tools mount nfs-common pigz socat sysfsutils sysstat util-linux xz-utils netcat-openbsd zip rng-tools kmod gcc make dkms initramfs-tools linux-headers-$(uname -r) linux-modules-extra-$(uname -r))


have you tested that this doesn't cause any unexpected regression?

i'll paste evidence tomorrow - but apparmor was already enabled before and no new profiles are added/enabled by this change. CIS expects this package to be installed.

AB E2E pass, do you have an idea for further testing for regressions?

here's output from master:

$ cat /sys/kernel/security/lsm lockdown,capability,bpf,landlock,yama,apparmor

$ cat /sys/module/apparmor/parameters/enabled Y

$ sudo aa-status apparmor module is loaded. 118 profiles are loaded. 23 profiles are in enforce mode. /usr/bin/man /usr/sbin/chronyd lsb_release man_filter man_groff nvidia_modprobe nvidia_modprobe//kmod plasmashell plasmashell//QtWebEngineProcess rsyslogd tcpdump ubuntu_pro_apt_news ubuntu_pro_esm_cache ubuntu_pro_esm_cache//apt_methods ubuntu_pro_esm_cache//apt_methods_gpgv ubuntu_pro_esm_cache//cloud_id ubuntu_pro_esm_cache//dpkg ubuntu_pro_esm_cache//ps ubuntu_pro_esm_cache//ubuntu_distro_info ubuntu_pro_esm_cache_systemctl ubuntu_pro_esm_cache_systemd_detect_virt unix-chkpwd unprivileged_userns 4 profiles are in complain mode. transmission-cli transmission-daemon transmission-gtk transmission-qt 0 profiles are in prompt mode. 0 profiles are in kill mode. 91 profiles are in unconfined mode. 1password Discord MongoDB Compass QtWebEngineProcess balena-etcher brave buildah busybox cam ch-checkns ch-run chrome crun devhelp element-desktop epiphany evolution firefox flatpak foliate geary github-desktop goldendict ipa_verify kchmviewer keybase lc-compliance libcamerify linux-sandbox loupe lxc-attach lxc-create lxc-destroy lxc-execute lxc-stop lxc-unshare lxc-usernsexec mmdebstrap msedge nautilus notepadqq obsidian opam opera pageedit podman polypane privacybrowser qcam qmapshack qutebrowser rootlesskit rpm rssguard runc sbuild sbuild-abort sbuild-adduser sbuild-apt sbuild-checkpackages sbuild-clean sbuild-createchroot sbuild-destroychroot sbuild-distupgrade sbuild-hold sbuild-shell sbuild-unhold sbuild-update sbuild-upgrade scide signal-desktop slack slirp4netns steam stress-ng surfshark systemd-coredump thunderbird toybox trinity tup tuxedo-control-center userbindmount uwsgi-core vdens virtiofsd vivaldi-bin vpnns vscode wike wpcom 3 processes have profiles defined. 3 processes are in enforce mode. /usr/sbin/chronyd (915) /usr/sbin/chronyd (926) /usr/sbin/rsyslogd (980) rsyslogd 0 processes are in complain mode. 0 processes are in prompt mode. 0 processes are in kill mode. 0 processes are unconfined but have a profile defined. 0 processes are in mixed mode.

The output after is the same. The rule only cares for the availability of the utils. I didn't try to enable additional profiles (eg. for runc), which is suggested by a different rule.

if ABE2Es pass we're probably fine, though you could also throw this through our daily VHD build to get full E2E coverage

cameronmeissner · 2025-09-29T21:03:50Z

  apt_get_purge 20 30 120 apache2-utils || exit 1
+  # CIS: Ensure telnet (/ftp) client is not installed
+  # CIS: Ufw is not used but interferes with log_martians rule
+  apt_get_purge 20 30 120 telnet ftp ufw tnftp inetutils-telnet || exit 1


we should also make sure this isn't causing any regressions

how would you suggest we test this for regressions?

ufw was unconfigured in AKS and this removes telnet/ftp clients from the host which are not used by Kubernetes in any way. Azure Linux also never shipped these utilities on the host.

if E2Es are passing we're probably okay

We remove snap so /snap/bin shouldn't be in PATH.

This addresses "Ensure password failed attempts lockout includes root account".

WALAgent does it in a way that is incompatible with the CIS scanner: it forces the password to '*LOCK*' resetting all other fields. The Agent does this on provisioning and deprovisioning. We clear the password ourselves so disable the agents behavior.

This is needed for CIS compliance.

…scan

These are only present during scanning but they show up as false positives in the CIS scan results.

This log file is owned by an unprivileged user but will not be used. Clean it up for CIS compliance.

jepio · 2025-10-13T16:44:52Z

Flatcar E2E to be fixed by this: #7184
OSGuard build to be fixed by: #7185

cameronmeissner · 2025-10-13T17:11:37Z

Flatcar E2E to be fixed by this: #7184 OSGuard build to be fixed by: #7185

approved both

awesomenix · 2026-01-27T02:31:33Z

@copilot can you review this PR

Copilot

Pull request overview

This PR implements CIS Level 1 compliance for Ubuntu 22.04 and 24.04 images, achieving approximately 89% compliance. It introduces a baseline comparison mechanism to detect CIS compliance regressions and applies numerous security hardening measures across various system components.

Changes:

Added CIS baseline comparison testing to detect regressions against established baselines
Implemented comprehensive security hardening including PAM configuration, SSH hardening, GRUB password protection, and kernel security parameters
Updated package dependencies to include apparmor-utils and removed insecure packages (telnet, ftp, ufw)

Reviewed changes

Copilot reviewed 106 out of 106 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vhdbuilder/packer/vhd-scanning.sh	Added regression testing function to compare CIS scan results against baseline
vhdbuilder/packer/cis/baselines/ubuntu/*.txt	New baseline files defining expected CIS compliance for Ubuntu 22.04 and 24.04
parts/linux/cloud-init/artifacts/cis.sh	Added functions for GRUB password, SSH hardening, sudo logging, and waagent configuration
parts/linux/cloud-init/artifacts/pam-d-*	Updated PAM configuration files for password policy and account lockout
parts/linux/cloud-init/artifacts/faillock-CIS.conf	New faillock configuration for account lockout policy
parts/linux/cloud-init/artifacts/sshd_config	Updated SSH configuration with stricter MACs, removed DSA key, added MaxStartups
parts/linux/cloud-init/artifacts/sysctl-d-60-CIS.conf	Added ASLR and core dump restrictions
parts/linux/cloud-init/artifacts/modprobe-CIS.conf	Added blacklist directives and usb-storage blocking
parts/linux/cloud-init/artifacts/pwquality-CIS.conf	Enhanced password quality requirements
parts/linux/cloud-init/artifacts/profile-d-cis.sh	Added TMOUT for shell timeout
parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh	Added apparmor-utils to package list
vhdbuilder/packer/install-dependencies.sh	Removed telnet, ftp, ufw packages; added tar extraction with --no-same-owner
vhdbuilder/packer/trivy-scan.sh	Added --no-same-owner flag to tar extraction
vhdbuilder/packer/cleanup-vhd.sh	Removed stunnel4 log artifacts
vhdbuilder/packer/packer_source.sh	Added faillock and pam-d-common-account file copying
pkg/agent/testdata/*/CustomData	Updated binary blobs for all test scenarios
.pipelines/templates/.builder-release-template.yaml	Extended CIS report copying to include CVM feature flag

Copilot · 2026-01-27T02:36:32Z

+    chmod 0600 -R /etc/ssh/sshd_config.d/
+    chmod 0755    /etc/ssh/sshd_config.d


The chmod 0600 -R command on line 268 applies permissions recursively, but immediately after on line 269, the directory itself is set to 0755. This creates a race condition where between the recursive command and the directory permission fix, the directory has 0600 permissions, making it inaccessible to non-root users. Consider setting the directory permissions first, then applying recursive permissions to files only, or use find to set file permissions separately.

Suggested change

chmod 0600 -R /etc/ssh/sshd_config.d/

chmod 0755 /etc/ssh/sshd_config.d

chmod 0755 /etc/ssh/sshd_config.d

find /etc/ssh/sshd_config.d -type f -exec chmod 0600 {} \;

Copilot · 2026-01-27T02:36:32Z

+}
+
+configureRootPath() {
+    sed -i -e 's|:/snap/bin||' /etc/sudoers /etc/environment


The sed command here modifies /etc/sudoers which is risky. If the pattern doesn't match exactly or if there are multiple occurrences, it could fail silently or produce unexpected results. Additionally, directly editing /etc/sudoers with sed bypasses sudoers validation. Consider using visudo or a more robust approach that validates the syntax before applying changes.

Suggested change

sed -i -e 's|:/snap/bin||' /etc/sudoers /etc/environment

# Safely update /etc/sudoers by using a temporary file and validating with visudo

local tmp_sudoers

tmp_sudoers=$(mktemp /tmp/sudoers.XXXXXX)

cp /etc/sudoers "$tmp_sudoers"

sed -i -e 's|:/snap/bin||' "$tmp_sudoers"

if visudo -c -f "$tmp_sudoers"; then

cp "$tmp_sudoers" /etc/sudoers

else

echo "visudo validation failed; /etc/sudoers not updated" >&2

fi

rm -f "$tmp_sudoers"

# Update /etc/environment separately

sed -i -e 's|:/snap/bin||' /etc/environment

jepio requested review from AbelHu, Devinwong, UtheMan, anujmaheshwari1, bravebeaver, cameronmeissner, djsly, ganeshkumarashok, juan-lee, junjiezhang1997, lilypan26, phealy, r2k1, timmy-wright and zachary-bailey as code owners September 19, 2025 15:26

jepio temporarily deployed to test September 19, 2025 15:26 — with GitHub Actions Inactive

jepio force-pushed the jepio/aks-cis.v4 branch from 3268d87 to e9693dd Compare September 19, 2025 15:31

jepio temporarily deployed to test September 19, 2025 15:31 — with GitHub Actions Inactive

jepio force-pushed the jepio/aks-cis.v4 branch from e9693dd to be6a8c9 Compare September 22, 2025 13:45

jepio temporarily deployed to test September 22, 2025 13:46 — with GitHub Actions Inactive

jepio force-pushed the jepio/aks-cis.v4 branch from be6a8c9 to d941e45 Compare September 22, 2025 13:49

jepio temporarily deployed to test September 22, 2025 13:49 — with GitHub Actions Inactive

Devinwong approved these changes Sep 25, 2025

View reviewed changes

jepio force-pushed the jepio/aks-cis.v4 branch from d941e45 to 90aad75 Compare September 29, 2025 17:03

jepio temporarily deployed to test September 29, 2025 17:03 — with GitHub Actions Inactive

cameronmeissner reviewed Sep 29, 2025

View reviewed changes

Comment thread vhdbuilder/packer/cis/baselines/ubuntu/22.04.txt

cameronmeissner reviewed Sep 29, 2025

View reviewed changes

jepio force-pushed the jepio/aks-cis.v4 branch from 90aad75 to 17c8429 Compare October 10, 2025 11:04

jepio added 17 commits October 13, 2025 14:04

feat(cis): Add PAM faillock configuration

b18c742

feat(cis): Set TMOUT in profile.d

1c368dd

fix(cis): Remove /snap/bin from root path

1c3128f

We remove snap so /snap/bin shouldn't be in PATH.

feat(cis): Add even_deny_root in faillock

2c83809

This addresses "Ensure password failed attempts lockout includes root account".

feat(cis): Restrict access to grub.cfg

67f288c

feat(cis): Restrict coredumps

5121994

feat(cis): Set root password parameters

58f4019

fix(cis): Apply sysctl before scanning

23162ce

fix(vhdbuilder): Install PAM common-auth on Ubuntu 24

314d2eb

This is needed for CIS compliance.

fix(test): Disable GuestConfig daemon and fix log permissions before …

e6d6372

…scan

test: Check for CIS regression on Ubuntu

881c9b5

test: Capture cis report from Ubuntu CVMs

96b066f

chore: Regenerate testdata

afaee56

fix: Ensure azure-cni files are owned by root

004e9e7

fix: Ensure trivy files are owned by root

e355924

These are only present during scanning but they show up as false positives in the CIS scan results.

fix: Cleanup stunnel4 log files

bcaf689

This log file is owned by an unprivileged user but will not be used. Clean it up for CIS compliance.

jepio force-pushed the jepio/aks-cis.v4 branch from 17c8429 to bcaf689 Compare October 13, 2025 12:10

jepio temporarily deployed to test October 13, 2025 12:11 — with GitHub Actions Inactive

cameronmeissner approved these changes Oct 13, 2025

View reviewed changes

jepio merged commit 0025705 into master Oct 13, 2025
60 of 63 checks passed

jepio deleted the jepio/aks-cis.v4 branch October 13, 2025 17:13

jepio mentioned this pull request Nov 14, 2025

fix: Reorder faillock in common-auth to prevent failures #7377

Merged

5 tasks

awesomenix requested review from Copilot and removed request for anujmaheshwari1 January 27, 2026 02:32

Copilot started reviewing on behalf of awesomenix January 27, 2026 02:32 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

		chmod 0600 -R /etc/ssh/sshd_config.d/
		chmod 0755 /etc/ssh/sshd_config.d

-    sed -i -e 's|:/snap/bin||' /etc/sudoers /etc/environment
+    # Safely update /etc/sudoers by using a temporary file and validating with visudo
+    local tmp_sudoers
+    tmp_sudoers=$(mktemp /tmp/sudoers.XXXXXX)
+    cp /etc/sudoers "$tmp_sudoers"
+    sed -i -e 's|:/snap/bin||' "$tmp_sudoers"
+    if visudo -c -f "$tmp_sudoers"; then
+        cp "$tmp_sudoers" /etc/sudoers
+    else
+        echo "visudo validation failed; /etc/sudoers not updated" >&2
+    fi
+    rm -f "$tmp_sudoers"
+    # Update /etc/environment separately
+    sed -i -e 's|:/snap/bin||' /etc/environment

Conversation

jepio commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jepio Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jepio commented Oct 13, 2025

Uh oh!

cameronmeissner commented Oct 13, 2025

Uh oh!

Uh oh!

awesomenix commented Jan 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jepio commented Sep 19, 2025 •

edited

Loading

jepio Oct 13, 2025 •

edited

Loading