Security baseline controls
Every scan runs the Gardience baseline on each node. The baseline is a set of security controls aligned with DISA STIG and CIS guidance. It is a curated subset, not a full DISA SCAP benchmark.
Each control returns one of three results:
- pass: the node meets the control.
- fail: the node does not meet the control.
- na: the control does not apply or could not be read on this node. It is left out of the score.
The baseline score is the share of pass results among the controls that returned pass or fail. To see a node's failing controls, open Overview > Dashboard and expand controls in the node's Baseline column.
Windows controls
| Control | Title | Reference | What it checks |
|---|---|---|---|
| WIN-01 | SMBv1 server protocol disabled | STIG / CIS | EnableSMB1Protocol in the SMB server configuration is False. |
| WIN-02 | Windows Firewall enabled on all profiles | STIG / CIS | No firewall profile is disabled. |
| WIN-03 | Guest account disabled | STIG / CIS | The local Guest account is disabled. |
| WIN-04 | Minimum password length 14 or more | STIG / CIS | The minimum password length in net accounts is 14 or more. |
| WIN-05 | Account lockout after 3 or fewer bad logons | STIG | The lockout threshold in net accounts is between 1 and 3. |
| WIN-06 | Remote Desktop requires Network Level Authentication | STIG / CIS | UserAuthentication is 1 under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. |
| WIN-07 | AutoPlay disabled for all drives | STIG / CIS | NoDriveTypeAutoRun is 255 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer. |
| WIN-08 | Defender real-time protection on | STIG / CIS | Microsoft Defender reports real-time protection as enabled. |
| WIN-09 | Windows Update service not disabled | CIS | The wuauserv service start type is not Disabled. |
Linux controls
| Control | Title | Reference | What it checks |
|---|---|---|---|
| LNX-01 | SSH root login disabled | STIG / CIS | The effective SSH server setting (sshd -T) has permitrootlogin no. Marked na when the SSH server is not installed. |
| LNX-02 | SSH password authentication disabled | CIS | The effective SSH server setting has passwordauthentication no. Marked na when the SSH server is not installed. |
| LNX-03 | Password maximum age 60 days or less | STIG | PASS_MAX_DAYS in /etc/login.defs is 60 or less. It fails when the setting is missing. |
| LNX-04 | No accounts with empty passwords | STIG / CIS | No account in /etc/shadow has an empty password field. |
| LNX-05 | Host firewall active | STIG / CIS | One of firewalld, ufw or nftables is active. Marked na on systems without systemd, such as containers. |
| LNX-06 | auditd running | STIG / CIS | The auditd service is active. Marked na on systems without systemd. |
| LNX-07 | Default umask 077 or stricter | STIG | UMASK in /etc/login.defs is 077 or 0077. |
How a fix works
The baseline fix applies every automatic fix for the node's failing controls in one job. You cannot pick a single control; the fix covers all failing controls on that node. After the fix, the node runs the baseline again, and the job result includes the score before and after.
| Control | Automatic fix |
|---|---|
| WIN-01 | Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force |
| WIN-02 | Enables the firewall on the Domain, Public and Private profiles. |
| WIN-03 | Disable-LocalUser -Name Guest |
| WIN-04 | net accounts /minpwlen:14 |
| WIN-05 | net accounts /lockoutthreshold:3 /lockoutduration:15 /lockoutwindow:15 |
| WIN-06 | Sets UserAuthentication to 1 for RDP-Tcp. |
| WIN-07 | Sets NoDriveTypeAutoRun to 255 (DWORD), creating the key if needed. |
| WIN-08 | Set-MpPreference -DisableRealtimeMonitoring $false |
| WIN-09 | Sets the wuauserv start type to Manual. |
| LNX-01 | Adds PermitRootLogin no to /etc/ssh/sshd_config.d/00-gardience.conf, then reloads sshd. Only when /etc/ssh/sshd_config.d exists. |
| LNX-02 | Adds PasswordAuthentication no to the same file, then reloads sshd. Only when /etc/ssh/sshd_config.d exists. |
| LNX-03 | Sets PASS_MAX_DAYS to 60 in /etc/login.defs. |
| LNX-04 | No automatic fix. Set a password on, or lock, each account listed in the result. |
| LNX-05 | Allows every TCP and UDP port the machine listens on now (beyond loopback), then turns on the firewall: ufw on Debian and Ubuntu, firewalld elsewhere. A service that is stopped at that moment is not seen: start it first, or open its port afterwards. |
| LNX-06 | Installs the audit package (auditd on Debian and Ubuntu, audit elsewhere), then enables and starts auditd. |
| LNX-07 | Sets UMASK to 077 in /etc/login.defs. |
Before you apply the baseline to Linux nodes, make sure people and tools can sign in over SSH with keys. The LNX-02 fix turns off SSH password sign-in.
On Linux nodes where /etc/ssh/sshd_config.d does not exist, LNX-01 and LNX-02 are not fixed automatically. Set them in your SSH server configuration by hand.
Fix a failing control
To fix one node:
- Open Overview > Dashboard.
- Choose Apply baseline on the node's row.
- Wait for the rescan. The node's score updates when the job ends.
To fix a node group, run the Apply security baseline runbook and pick the group. See Runbooks.
To fix every node that fails, choose Fix all N non-compliant on the dashboard.
Applying the baseline to more than one node at a time needs a second person to approve it, unless you are an admin (an admin setting extends the rule to admins). See Patching Linux and Windows.
To fix a control by hand, change the setting listed under "What it checks", then choose Rescan on the dashboard.
Controls that drift checks keep in place
Some of these settings are also part of the Gardience desired state, which drift checks compare each node against: AutoPlay and RDP Network Level Authentication on Windows, and PASS_MAX_DAYS, UMASK and the SSH settings on Linux. See Drift checks and event rules.