updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

handlers/main.yml

@@ -22,12 +22,16 @@
 
 - name: update sysctl
   template:
-      src: etc/99-sysctl.conf.j2
+      src: "etc/sysctl.d/{{ item }}.j2"
-      dest: /etc/sysctl.d/99-sysctl.conf
+      dest: "/etc/sysctl.d/{{ item }}"
       owner: root
       group: root
       mode: 0600
   notify: reload sysctl
+  with_items:
+      - 60-kernel_sysctl.conf
+      - 60-disable_ipv6.conf
+      - 99-sysctl.conf
   when: 
       - ansible_virtualization_type != "docker"
       - "'procps-ng' in ansible_facts.packages"

tasks/section_1/cis_1.5.x.yml

@@ -32,13 +32,10 @@
       - rule_1.5.2
 
 - name: "1.5.3 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
-  sysctl:
+  debug:
-      name: kernel.randomize_va_space
+      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
-      value: '2'
+  notify: 
-      state: present
+      - update sysctl
-      reload: yes
-      sysctl_set: yes
-      ignoreerrors: yes
   when:
       - rhel9cis_rule_1_5_3
   tags:

templates/etc/cron.d/aide.cron.j2

@@ -1,5 +1,5 @@
 # Run AIDE integrity check 
 # added via ansible-lockdown remediation 
-# CIS 1.4.2
+# CIS 1.3.2
 
 {{ rhel9cis_aide_cron['aide_minute'] }} {{ rhel9cis_aide_cron['aide_hour'] }} {{ rhel9cis_aide_cron['aide_month'] }} {{ rhel9cis_aide_cron['aide_weekday'] }} {{ rhel9cis_aide_cron['aide_job'] }}

templates/etc/sysctl.d/60-disable_ipv6.conf.j2

@@ -1,3 +1,6 @@
+# Setting added via ansible CIS remediation playbook
+
+# IPv6 disable
 {% if rhel9cis_rule_3_1_1 and rhel9cis_ipv6_required %}
 net.ipv6.conf.all.disable_ipv6 = 1 
 net.ipv6.conf.default.disable_ipv6 = 1

templates/etc/sysctl.d/60-kernel_sysctl.conf.j2

@@ -0,0 +1,8 @@
+# Setting added via ansible CIS remediation playbook
+
+
+{% if rhel9cis_rule_1_5_3 %}
+# Kernel sysctl
+# CIS 1.5.3
+kernel.randomize_va_space = 2
+{% endif %}

templates/etc/sysctl.d/99-sysctl.conf.j2

@@ -1,16 +1,5 @@
 # Setting added via ansible CIS remediation playbook
 
-{% if rhel9cis_rule_1_6_1 %}
-# Filesystem sysctl
-# CIS 1.6.1
-fs.suid_dumpable = 0
-{% endif %}
-{% if rhel9cis_rule_1_6_2 %}
-# Kernel sysctl
-# CIS 1.6.2
-kernel.randomize_va_space = 2
-{% endif %}
-
 # Network sysctl
 {% if rhel9cis_rule_3_2_1 %}
 # CIS 3.2.1