2022-01-07 09:06:18 +00:00
# Changes to rhel9CIS
2023-01-23 16:22:18 +00:00
## Initial CIS v1.0.0 - released Dec 2022
2023-01-23 16:08:19 +00:00
### Official CIS release
2023-01-23 16:22:18 +00:00
Jan-2023 release
2023-01-27 12:19:22 +00:00
- updated ansible minimum to 2.10
2023-01-23 16:08:19 +00:00
- Lint file updates and improvements
2023-01-26 15:03:05 +00:00
- auditd now shows diff ater initial template added
- many control rewritten
2023-01-23 16:08:19 +00:00
- Many controls moved ID references
- Audit updates aligned
- Command warn arg removed
- Ansible 2.14 now supported
- makefile added (hopefully help some)
- fqcn added to all controls
- some controls rewritten using module rather than shell
2023-01-24 11:02:40 +00:00
- typo fixes from rhel_08 inheritance
2023-01-26 15:03:05 +00:00
- workflow update for 5.6.6 to set random root password to allow for testing
2023-01-23 16:22:18 +00:00
- incorporates issues
- #23
- #24
2023-01-27 12:19:22 +00:00
- New option to add faillock for users without authselect - defaults/main 5.4.2
2023-01-23 16:08:19 +00:00
2022-10-14 12:30:47 +01:00
## 0.5
2022-10-14 12:33:32 +01:00
- audit path updated and output file name
2022-10-14 12:30:47 +01:00
### Taken from RHEL8-CIS issues and PRs
- #209 5.6.5 rewrite umask settings
- #220 tidy up and align variables
- #226 Thanks to Thulium-Drake
-Extended the auditd config required value for auditd space left percentage (not part of CIS Benchmark but required fopr auditd to run correctly in some cases)
- #227 thanks to OscarElits
- chrony files now RH expected locations
- #228 Thanks to benbulll
- audit binary copy var missing
2022-07-26 11:13:29 +01:00
## 0.4
2022-09-07 13:36:11 +01:00
- Added assertion that ansible_user has password set for rule 5.3.4
2022-08-23 12:25:28 +01:00
- RockyLinux now supported - release since initial branches
- gpg check updates
2022-09-16 11:53:52 +01:00
- audit out dir now /opt
- lint updates and improvements
2022-08-23 16:45:01 +01:00
- workflow updates and improvements moved to rocky image
2022-07-26 11:13:29 +01:00
- selinux regexp improvements
- warning summary now at end of play
- advanced auditd options to exclude users in POST section
2022-08-23 12:22:46 +01:00
- Issues fixed thanks to fgierlinger
- [#21 ](https://github.com/ansible-lockdown/RHEL9-CIS/issues/21 )
- [#22 ](https://github.com/ansible-lockdown/RHEL9-CIS/issues/22 )
2022-07-26 11:13:29 +01:00
2022-06-20 17:08:14 +01:00
## 0.3
- update to auditd template
- uses facts and template new variable
- update_audit_template (default false)
- sysctl template updates and idempotency improvements
- container discovery usage improvements
- 3.4.1.5 discovery improvement
- 5.6.1.4 discovery improvement
- logrotate process logrotate.timer
- tidy up become:
- logic improvements
2022-04-11 17:40:50 +01:00
## 0.2
- not all controls work with rhel8 releases any longer
- selinux disabled 1.6.1.4
- logrotate - 4.3.x
- updated to rhel8cis v2.0 benchamrk requirements
- removed iptables firewall controls (not valid on rhel9)
- added more to logrotate 4.3.x - sure to logrotate now a seperate package
- grub path now standard to /boot/grub2/grub.cfg
- 1.6.1.4 from rh8 removed as selinux.cfg doesnt disable selinux any longer
2022-08-05 11:48:11 +01:00
- workflow update
- removed doc update
2022-04-11 17:40:50 +01:00
2022-01-13 11:25:42 +00:00
## 0.1
- change to include statements
- prelim and package facts discovery
- commands module removed and moved to shell
2022-01-13 16:51:23 +00:00
- added
```yml
args:
warn: false
```
- update boolean values to true/false
- 3.4.2 improved checks for p[ackage presence
- changed to assert for OS/release and ansible version
2022-01-13 11:25:42 +00:00
2022-01-07 11:09:28 +00:00
## Initial
2022-01-07 09:06:18 +00:00
2022-01-07 09:23:01 +00:00
- based on RHEL8 currently as RH or CIS not GA
2022-01-07 11:09:28 +00:00
- Changes to systctl, auditd, aide cron changes to utilise templates - see issue #1
- Collection statement added to meta/main.yml using only community-general
- aide crontab moved to template due to module change
