Automated hardening audit of an Artica appliance against CIS Debian Linux guidance.
78 checks were executed directly on the host; every figure below is the observed value, so the whole report is reproducible against the machine.
| Host | deb13tests.articatech.int |
| Operating system | Debian GNU/Linux 13 (trixie) |
| Kernel | 6.12.90+deb13.1-amd64 |
| Build audited | Service Pack 7 — hotfix 20260717-03 |
| Audit date | 2026-07-19 16:40 UTC |
| Result | Count |
|---|---|
| Passed | 50 |
| Failed | 12 |
| Warnings | 10 |
| Informational | 6 |
| Compliance | 69.4% (50 of 72 scored checks) |
The appliance is in reasonable shape: kernel module blacklisting, most network parameters, cron restrictions, account hygiene, file-integrity monitoring, host firewall and time synchronisation all pass.
The failures cluster in three areas — SSH remote access, disk partitioning and a small residue of kernel parameters.
One finding is materially more serious than all the others.
The appliance accepts direct root login over SSH with a password (PermitRootLogin yes, PasswordAuthentication yes), with MaxAuthTries 6.
This combination turns any exposed SSH port into an online password-guessing target against the most privileged account, and it defeats the value of most other controls in this report.
Remediation. View how to secure SSH on an artica appliance
Four gaps reported on 15 July have been closed:
| Finding (15 July) | Status today |
|---|---|
| No file-integrity monitoring ("no AIDE") | Fixed — AIDE 0.19.3 installed, baseline built (1.18 MB), scheduled scan |
/dev/shm lacks noexec |
Fixed — now nosuid,nodev,noexec |
| No restrictive policy on nftables/iptables | Fixed — nftables ruleset loaded |
| World-writable directories without the sticky bit | Fixed — no offending directory found |
| Root SSH login open over password | Still open — unchanged, see above |
Total failures moved from 13 to 12, but the composition improved markedly: the remaining set is now dominated by partitioning decisions taken at install time.
| Area | Check | Observed |
|---|---|---|
| SSH | PermitRootLogin should be no |
yes |
| SSH | PasswordAuthentication should be no |
yes |
| Kernel | kernel.kptr_restrict should be 1 |
0 — kernel pointers exposed to unprivileged users |
| Kernel | kernel.sysrq should be 0 |
438 — magic SysRq largely enabled |
| Network | net.ipv4.conf.all.secure_redirects should be 0 |
1 |
| Network | net.ipv6.conf.all.accept_ra should be 0 |
1 |
| Network | net.ipv6.conf.all.accept_redirects should be 0 |
1 |
| Filesystem | /tmp mounted with noexec |
nosuid,nodev present, noexec missing |
| Filesystem | /var on its own partition |
not a separate mount point |
| Filesystem | /var/log on its own partition |
not a separate mount point |
| Filesystem | /var/log/audit on its own partition |
not a separate mount point |
| Filesystem | /home on its own partition |
not a separate mount point |
Artica-specific caveat on the network parameters.
Several of these values are emitted by the Artica daemon itself and depend on transparent-proxy mode and web-console settings — a routing/proxy appliance legitimately needs behaviour a generic
CIS profile forbids.
Do not hard-code them in a standalone/etc/sysctl.dfile: the daemon will overwrite them, and forcing the wrong value can break transparent interception.secure_redirectsand the IPv6 parameters must be changed through the appliance configuration, then re-audited.
Separate partitions for /var, /var/log, /var/log/audit and /home are install-time layout decisions and cannot be remediated in place on a running system.
They are grouped here so they do not distort the risk picture: their practical benefit is containing a disk-fill denial of service and allowing per-mount options, not preventing compromise.
Address them when the appliance is next re-provisioned; on a virtual appliance with monitored disk usage they are commonly accepted risks.
/tmp, by contrast, can be fixed live — add noexec to the existing options with mount -o remount,noexec,nosuid,nodev /tmp, then persist it in /etc/fstab.
Check first that no installer or updater executes scripts from /tmp.
| Area | Check | Observed |
|---|---|---|
| SSH | MaxAuthTries should be 4 or lower | 6 |
| Accounts | PASS_MAX_DAYS too high | 99999 — passwords never expire |
| Accounts | PASS_MIN_DAYS should be 1 or more | 0 |
| Accounts | Password quality not enforced | no pwquality minimum length |
| Services | slapd enabled |
LDAP exposed if the feature is unused |
| Services | dovecot enabled |
IMAP/POP exposed if the feature is unused |
| Services | snmpd enabled |
SNMP exposed if the feature is unused |
| Services | Legacy telnet client installed |
/usr/bin/telnet |
| Logging | auditd not running |
inactive — no syscall audit trail |
| Misc | Default umask is not 027 |
not set in /etc/profile |
The three enabled services are flagged mechanically.
slapd,dovecotandsnmpdare legitimate Artica features — treat them as findings only if the corresponding feature is not in use on the appliance.
The CIS principle is to reduce the listening surface to what the role actually requires.
| Area | Passed | Highlights |
|---|---|---|
| Kernel modules | 11 | cramfs, freevxfs, jffs2, hfs, hfsplus, udf, usb-storage, dccp, sctp, rds, tipc — autoload blocked |
| Network parameters | 12 | ICMP redirects (send and accept), source routing, martian logging, broadcast ICMP, bogus ICMP responses, SYN cookies, reverse-path filter |
| SSH | 5 | PermitEmptyPasswords no, X11Forwarding no, ClientAlive set, LoginGraceTime 60 or less, sshd_config mode 0600 |
| Kernel parameters | 4 | ASLR (randomize_va_space=2), dmesg_restrict, suid_dumpable=0, adequate fs.file-max |
| Accounts | 4 | no empty passwords, root is the only UID 0, /etc/shadow and /etc/passwd permissions correct |
| File integrity | 3 | AIDE 0.19.3, baseline initialised, scheduled scan |
| Cron | 3 | /etc/crontab and /etc/cron.d restricted, cron.allow present |
| Filesystem | 3 | /dev/shm nosuid,nodev,noexec; sticky bit on world-writable directories; no unowned files |
| Logging | 2 | rsyslog active, logrotate configured |
| Firewall, time, banner | 3 | nftables ruleset loaded, chrony synchronising, login banner set |
MaxAuthTries) — highest value, fixable in minutes.kernel.kptr_restrict=1 and kernel.sysrq=0 — safe, no service impact, persist under /etc/sysctl.d.PASS_MAX_DAYS, PASS_MIN_DAYS, pwquality minimum length, and default umask 027./tmp with noexec — verify updaters first, then remount and persist.slapd, dovecot and snmpd if unused; remove the telnet client.secure_redirects, IPv6 RA and redirects) — through the appliance configuration only, per the caveat above.auditd — enable if a syscall audit trail is required by policy; note the added disk I/O.78 checks were executed directly on the host with a self-contained shell audit, covering: partition layout and mount options, world-writable and unowned files, kernel module autoload blocking, network and kernel parameters, the effective SSH configuration (read through sshd -T, i.e. the running configuration rather than the file), account and password policy, listening services and legacy clients, logging, file-integrity monitoring, host firewall, time synchronisation, cron restrictions, umask and login banner.
Each check reports PASS, FAIL, WARN or INFO together with the observed value. Informational rows (system identity) are excluded from the compliance ratio.