Feature: cis
Description
The cis feature is a meta-feature that groups all CIS benchmark benchmark sub-features into a single composable unit.
What it does
This feature represents a meta-feature that includes multiple sub-features, each covering a specific area of the CIS benchmark for Debian Linux. It applies the following CIS controls:
aide— host-based intrusion detectioncisAudit— auditd logging of security eventscisModprobe— kernel module denylistingcisOS— OS-level security settings (PAM, file permissions, login options)cisPackages— required and unwanted package managementcisPartition— CIS-compliant partition layoutcisSshd— SSH hardening and firewall rulescisSysctl— sysctl settings (disables IPv6, IPv4 forwarding and redirects)firewall— nftables-based firewall
An exec.config script applies CIS-specific configuration that spans multiple sub-areas.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Applies CIS framework configuration that spans multiple sub-feature areas. |
info.yaml (ref) | Declares type: element and included/excluded features. |
Related features
Includes:
aide— host-based intrusion detection required by CIS.cisAudit—auditdlogging of security events per CIS benchmark.cisModprobe— kernel module denylisting per CIS benchmark.cisOS— OS-level security settings per CIS benchmark.cisPackages— required and unwanted package management per CIS benchmark.cisPartition— CIS-compliant partition layout.cisSshd— SSH hardening and firewall rules per CIS benchmark.cisSysctl— sysctl settings per CIS benchmark.firewall— nftables firewall required for CIS network controls.
Excludes (incompatible with):
fedramp—cisandfedrampboth implement overlapping compliance requirements and cannot be composed together.