ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-03-30 16:34:33 +01:00
parent c6caa90059
commit 19a218390d
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
6 changed files with 22 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

5
templates/etc/cron.d/aide.cron.j2 Normal file
View file

@ -0,0 +1,5 @@
# Run AIDE integrity check
# added via ansible-lockdown remediation
# CIS 1.3.2
{{ rhel9cis_aide_cron['aide_minute'] }} {{ rhel9cis_aide_cron['aide_hour'] }} {{ rhel9cis_aide_cron['aide_month'] }} {{ rhel9cis_aide_cron['aide_weekday'] }} {{ rhel9cis_aide_cron['aide_job'] }}

3
templates/etc/60-disable_ipv6.conf.j2 → templates/etc/sysctl.d/60-disable_ipv6.conf.j2
View file

@ -1,3 +1,6 @@
# Setting added via ansible CIS remediation playbook
# IPv6 disable
{% if rhel9cis_rule_3_1_1 and rhel9cis_ipv6_required %}
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

8
templates/etc/sysctl.d/60-kernel_sysctl.conf.j2 Normal file
View file

@ -0,0 +1,8 @@
# Setting added via ansible CIS remediation playbook
{% if rhel9cis_rule_1_5_3 %}
# Kernel sysctl
# CIS 1.5.3
kernel.randomize_va_space = 2
{% endif %}

11
templates/etc/99-sysctl.conf.j2 → templates/etc/sysctl.d/99-sysctl.conf.j2
View file

@ -1,16 +1,5 @@
# Setting added via ansible CIS remediation playbook
{% if rhel9cis_rule_1_6_1 %}
# Filesystem sysctl
# CIS 1.6.1
fs.suid_dumpable = 0
{% endif %}
{% if rhel9cis_rule_1_6_2 %}
# Kernel sysctl
# CIS 1.6.2
kernel.randomize_va_space = 2
{% endif %}
# Network sysctl
{% if rhel9cis_rule_3_2_1 %}
# CIS 3.2.1