Ensure only authorized network ports are listening
authorized-listening-ports · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
A host must listen only on the ports the site declared essential. The essential set is a statement about what this system is for, so it cannot be derived from the host: an operator declares it in the authorized_listening_ports variable. Until it is declared the check reports that it cannot assess the host and names what to set.
Rationale
Every listening port is a way in. Rules that remove one known service at a time reduce the count but never establish that what remains is what the site intended, because they can only name what somebody already thought to forbid. A port nobody authorized is the one an assessor looks for, and it is usually something nobody remembered installing. Comparing what is listening against what was declared is the only form of this check that can answer the question as written.
Check → Remediate
- observed_command:
- ss -H -lntu 2>/dev/null | awk '{print $5}' | sed 's/.*://' | sort -un
- authorized:
- {{ authorized_listening_ports }}
- note:
- For each port reported as not authorized, find the service holding it (ss -lntup, or lsof -i) and decide which side is wrong. If the service is not needed, disable and mask it. If it is needed, add the port to authorized_listening_ports so the declared set matches what this system is actually for. Kensa does not close ports automatically here: the same finding can mean an unwanted service or an out-of-date list, and only the operator knows which.
Framework references
NIST 800-53
NIST 800-171
CMMC Level 2