From 0c0dde24db3c49988a669b0063df8022fdec4173 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Mon, 19 Feb 2024 14:19:49 +0000 Subject: [PATCH] thanks to @ipruteani-sie #134 Signed-off-by: Mark Bolwell --- defaults/main.yml | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 9e9cb4c..6cd15ce 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -424,21 +424,6 @@ rhel9cis_rule_6_2_16: true # These /tmp settings will include nosuid,nodev,noexec to conform to CIS standards. rhel9cis_tmp_svc: false -## Control 1.1.9 -rhel9cis_allow_autofs: false - -## Control 1.2.1 -# This is the login information for your RedHat Subscription -# DO NOT USE PLAIN TEXT PASSWORDS!!!!! -# The intent here is to use a password utility like Ansible Vault here -rhel9cis_rh_sub_user: user -rhel9cis_rh_sub_password: password # pragma: allowlist secret - -## Control 1.2.2 -# Do you require rhnsd -# RedHat Satellite Subscription items -rhel9cis_rhnsd_required: false - ## Control 1.2.4 # When installing RHEL from authorized Red Hat source, RHEL will come with default YUM repository. NOT having a default YUM # repo ('rhel9cis_rhel_default_repo' set as 'false'), in conjunction with 'rhel9cis_rule_enable_repogpg' set as 'True', will enable the tasks @@ -455,7 +440,7 @@ rhel9cis_rule_enable_repogpg: true # must be changed to a value that may be generated with this command 'grub2-mkpasswd-pbkdf2' and must comply with # this format: 'grub.pbkdf2.sha512...' rhel9cis_bootloader_password_hash: 'grub.pbkdf2.sha512.10000.9306A36764A7BEA3BF492D1784396B27F52A71812E9955A58709F94EE70697F9BD5366F36E07DEC41B52279A056E2862A93E42069D7BBB08F5DFC2679CD43812.6C32ADA5449303AD5E67A4C150558592A05381331DE6B33463469A236871FA8E70738C6F9066091D877EF88A213C86825E093117F30E9E1BF158D0DB75E7581B' # pragma: allowlist secret -rhel9cis_bootloader_password: random # pragma: allowlist secret + ## Control 1.4.1 # This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file. rhel9cis_set_boot_pass: true @@ -781,11 +766,6 @@ rhel9cis_firewall: firewalld # to another zone): if there is no zone assigned to a connection, interface or source, only the default zone is used. rhel9cis_default_zone: public -# These settings are added to demonstrate how this update can be done (eventually will require a new control) -rhel9cis_firewalld_ports: - - number: 80 - protocol: tcp - ## Control 3.4.2.2 - Ensure at least one nftables table exists # This variable governs if a table will be automatically created in nftables. Without a table (no default one), nftables # will not filter network traffic, so if this variable is set to 'false' and no tables exist, an alarm will be triggered! @@ -1230,8 +1210,6 @@ rhel9cis_rpm_audit_file: /var/tmp/rpm_file_check # Allow ansible to adjust world-writable files. False will just display world-writable files, True will remove world-writable. rhel9cis_no_world_write_adjust: true -rhel9cis_passwd_label: "{{ (this_item | default(item)).id }}: {{ (this_item | default(item)).dir }}" - ## Control 6.2.16 - Ensure local interactive user dot files are not group or world writable # This boolean variable governs if current role should follow filesystem links for changes to # user home directory.