mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
289 lines
6.6 KiB
YAML
289 lines
6.6 KiB
YAML
|
---
|
||
|
|
|
||
|
|
- name: "2.2.2 | L1 | PATCH | Ensure X Window System is not installed"
|
||
|
|
block:
|
||
|
|
- name: "2.2.2 | L1 | AUDIT | Ensure X Window System is not installed | capture xorg-x11 packages"
|
||
|
|
shell: rpm -qa | grep xorg-x11
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
failed_when: xorg_x11_installed.rc >=2
|
||
|
|
check_mode: no
|
||
|
|
changed_when: false
|
||
|
|
register: xorg_x11_installed
|
||
|
|
|
||
|
|
- name: "2.2.2 | L1 | PATCH | Ensure X Window System is not installed | remove packages if found"
|
||
|
|
shell: "dnf remove {{ item }}"
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
with_items:
|
||
|
|
- xorg_x11_installed.stdout_lines
|
||
|
|
when: xorg_x11_installed.stdout | length > 0
|
||
|
|
when:
|
||
|
|
- not rhel9cis_xwindows_required
|
||
|
|
- rhel9cis_rule_2_2_2
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- scored
|
||
|
|
- xwindows
|
||
|
|
- patch
|
||
|
|
- rule_2.2.2
|
||
|
|
|
||
|
|
- name: "2.2.3 | L1 | PATCH | Ensure rsync service is not enabled "
|
||
|
|
service:
|
||
|
|
name: rsyncd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_rsyncd_server
|
||
|
|
- "'rsyncd' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_3
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.3
|
||
|
|
|
||
|
|
- name: "2.2.4 | L1 | PATCH | Ensure Avahi Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: avahi-daemon
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_avahi_server
|
||
|
|
- "'avahi' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_4
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- scored
|
||
|
|
- avahi
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.4
|
||
|
|
|
||
|
|
- name: "2.2.5 | L1 | PATCH | Ensure SNMP Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: snmpd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_snmp_server
|
||
|
|
- "'net-snmp' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_5
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.5
|
||
|
|
|
||
|
|
- name: "2.2.6 | L1 | PATCH | Ensure HTTP Proxy Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: squid
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_squid_server
|
||
|
|
- "'squid' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_6
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.6
|
||
|
|
|
||
|
|
- name: "2.2.7 | L1 | PATCH | Ensure Samba is not enabled"
|
||
|
|
service:
|
||
|
|
name: smb
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_smb_server
|
||
|
|
- "'samba' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_7
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.7
|
||
|
|
|
||
|
|
- name: "2.2.8 | L1 | PATCH | Ensure IMAP and POP3 server is not enabled"
|
||
|
|
service:
|
||
|
|
name: dovecot
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_dovecot_server
|
||
|
|
- "'dovecot' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_8
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.8
|
||
|
|
|
||
|
|
- name: "2.2.9 | L1 | PATCH | Ensure HTTP server is not enabled"
|
||
|
|
service:
|
||
|
|
name: httpd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_httpd_server
|
||
|
|
- "'httpd' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_9
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.9
|
||
|
|
|
||
|
|
- name: "2.2.10 | L1 | PATCH | Ensure FTP Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: vsftpd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_vsftpd_server
|
||
|
|
- "'vsftpd' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_10
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.10
|
||
|
|
|
||
|
|
- name: "2.2.11 | L1 | PATCH | Ensure DNS Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: named
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_named_server
|
||
|
|
- "'bind' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_11
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.11
|
||
|
|
|
||
|
|
- name: "2.2.12 | L1 | PATCH | Ensure NFS is not enabled"
|
||
|
|
service:
|
||
|
|
name: nfs-server
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_nfs_rpc_server
|
||
|
|
- "'nfs-utils' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_12
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- scored
|
||
|
|
- nfs
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.12
|
||
|
|
|
||
|
|
- name: "2.2.13 | L1 | PATCH | Ensure RPC is not enabled"
|
||
|
|
service:
|
||
|
|
name: rpcbind
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_nfs_rpc_server
|
||
|
|
- "'rpcbind' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_13
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- scored
|
||
|
|
- rpc
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.7
|
||
|
|
|
||
|
|
- name: "2.2.14 | L1 | PATCH | Ensure LDAP server is not enabled"
|
||
|
|
service:
|
||
|
|
name: slapd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_ldap_server
|
||
|
|
- "'openldap-servers' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_14
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- scored
|
||
|
|
- ldap
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.6
|
||
|
|
|
||
|
|
- name: "2.2.15 | L1 | PATCH | Ensure DHCP Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: dhcpd
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_dhcp_server
|
||
|
|
- "'dhcp' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_15
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- scored
|
||
|
|
- dhcp
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.15
|
||
|
|
|
||
|
|
- name: "2.2.16 | L1 | PATCH | Ensure CUPS is not enabled"
|
||
|
|
service:
|
||
|
|
name: cups
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_cups_server
|
||
|
|
- "'cups' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_16
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level2-workstation
|
||
|
|
- scored
|
||
|
|
- cups
|
||
|
|
- services
|
||
|
|
- patch
|
||
|
|
- rule_2.2.16
|
||
|
|
|
||
|
|
- name: "2.2.17 | L1 | PATCH | Ensure NIS Server is not enabled"
|
||
|
|
service:
|
||
|
|
name: ypserv
|
||
|
|
state: stopped
|
||
|
|
enabled: no
|
||
|
|
when:
|
||
|
|
- not rhel9cis_nis_server
|
||
|
|
- "'ypserv' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_17
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.17
|
||
|
|
|
||
|
|
- name: "2.2.18 | L1 | PATCH | Ensure mail transfer agent is configured for local-only mode"
|
||
|
|
lineinfile:
|
||
|
|
dest: /etc/postfix/main.cf
|
||
|
|
regexp: "^(#)?inet_interfaces"
|
||
|
|
line: "inet_interfaces = loopback-only"
|
||
|
|
notify: restart postfix
|
||
|
|
when:
|
||
|
|
- not rhel9cis_is_mail_server
|
||
|
|
- "'postfix' in ansible_facts.packages"
|
||
|
|
- rhel9cis_rule_2_2_18
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- rule_2.2.1
|