ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2026-05-09 23:33:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

QA, lint, standards, var naming, title aming aligned

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2026-04-08 12:56:24 +01:00
parent 69bef1f371
commit 201edf02e4
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
39 changed files with 478 additions and 608 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tasks/section_1/cis_1.1.2.3.x.yml
View file

@ -1,12 +1,12 @@
---
- name: "1.1.2.3.1 | PATCH | Ensure /home is a separate partition"
- name: "1.1.2.3.1 | PATCH | Ensure separate partition exists for /home"
when:
- rhel9cis_rule_1_1_2_3_1
- required_mount not in prelim_mount_names
tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- audit
- mounts
- rule_1.1.2.3.1

6
tasks/section_1/cis_1.1.2.4.x.yml
View file

@ -1,12 +1,12 @@
---
- name: "1.1.2.4.1 | PATCH | Ensure /var is a separate partition"
- name: "1.1.2.4.1 | PATCH | Ensure separate partition exists for /var"
when:
- rhel9cis_rule_1_1_2_4_1
- required_mount not in prelim_mount_names
tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- audit
- mounts
- rule_1.1.2.4.1

6
tasks/section_1/cis_1.1.2.5.x.yml
View file

@ -1,12 +1,12 @@
---
- name: "1.1.2.5.1 | PATCH | Ensure /var/tmp is a separate partition"
- name: "1.1.2.5.1 | PATCH | Ensure separate partition exists for /var/tmp"
when:
- rhel9cis_rule_1_1_2_5_1
- required_mount not in prelim_mount_names
tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- audit
- mounts
- rule_1.1.2.5.1

6
tasks/section_1/cis_1.1.2.6.x.yml
View file

@ -1,12 +1,12 @@
---
- name: "1.1.2.6.1 | PATCH | Ensure /var/log is a separate partition"
- name: "1.1.2.6.1 | PATCH | Ensure separate partition exists for /var/log"
when:
- rhel9cis_rule_1_1_2_6_1
- required_mount not in prelim_mount_names
tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- audit
- mounts
- rule_1.1.2.6.1

6
tasks/section_1/cis_1.1.2.7.x.yml
View file

@ -1,12 +1,12 @@
---
- name: "1.1.2.7.1 | PATCH | Ensure /var/log/audit is a separate partition"
- name: "1.1.2.7.1 | PATCH | Ensure separate partition exists for /var/log/audit"
when:
- rhel9cis_rule_1_1_2_7_1
- required_mount not in prelim_mount_names
tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- audit
- mounts
- rule_1.1.2.7.1

4
tasks/section_1/cis_1.3.1.x.yml
View file

@ -55,7 +55,7 @@
policy: "{{ rhel9cis_selinux_pol }}"
state: "{{ rhel9cis_selinux_enforce }}"
- name: "1.3.1.4 | PATCH | Ensure the SELinux state is not disabled"
- name: "1.3.1.4 | PATCH | Ensure the SELinux mode is not disabled"
when:
- rhel9cis_rule_1_3_1_4
- not rhel9cis_selinux_disable
@ -72,7 +72,7 @@
policy: "{{ rhel9cis_selinux_pol }}"
state: "{{ rhel9cis_selinux_enforce }}"
- name: "1.3.1.5 | PATCH | Ensure the SELinux state is enforcing"
- name: "1.3.1.5 | PATCH | Ensure the SELinux mode is enforcing"
when:
- rhel9cis_selinux_enforce == 'enforcing'
- rhel9cis_rule_1_3_1_5

6
tasks/section_1/cis_1.5.x.yml
View file

@ -1,6 +1,6 @@
---
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
- name: "1.5.1 | PATCH | Ensure address space layout randomization is enabled"
when: rhel9cis_rule_1_5_1
tags:
- level1-server
@ -11,11 +11,11 @@
- NIST800-53R5_CM-6
- NIST800-53R5_CM-6.1
block:
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
- name: "1.5.1 | PATCH | Ensure address space layout randomization is enabled"
ansible.builtin.set_fact:
rhel9cis_sysctl_update: true
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
- name: "1.5.1 | PATCH | Ensure address space layout randomization is enabled"
ansible.builtin.debug:
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"

6
tasks/section_1/cis_1.6.x.yml
View file

@ -130,7 +130,7 @@
- Update Crypto Policy
- Set Crypto Policy
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh"
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20- poly1305 for ssh"
when:
- rhel9cis_rule_1_6_6
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
@ -144,7 +144,7 @@
- rule_1.6.6
- NIST800-53R5_SC-6
block:
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | Add submodule exclusion"
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20- poly1305 for ssh | Add submodule exclusion"
ansible.builtin.template:
src: etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod.j2
dest: /etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod
@ -153,7 +153,7 @@
mode: 'g-wx,o-rwx'
register: discovered_no_sshweakciphers_template
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | submodule to crypto policy modules"
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20- poly1305 for ssh | submodule to crypto policy modules"
ansible.builtin.set_fact:
rhel9cis_crypto_policy_module: "{{ rhel9cis_crypto_policy_module + ':' + 'NO-SSHWEAKCIPHERS' }}"
changed_when: discovered_no_sshweakciphers_template is changed # noqa: no-handler

6
tasks/section_1/cis_1.7.x.yml
View file

@ -53,7 +53,7 @@
group: root
mode: 'go-wx'
- name: "1.7.4 | PATCH | Ensure permissions on /etc/motd are configured"
- name: "1.7.4 | PATCH | Ensure access to /etc/motd is configured"
when: rhel9cis_rule_1_7_4
tags:
- level1-server
@ -69,7 +69,7 @@
group: root
mode: 'go-wx'
- name: "1.7.5 | PATCH | Ensure permissions on /etc/issue are configured"
- name: "1.7.5 | PATCH | Ensure access to /etc/issue is configured"
when: rhel9cis_rule_1_7_5
tags:
- level1-server
@ -85,7 +85,7 @@
group: root
mode: 'go-wx'
- name: "1.7.6 | PATCH | Ensure permissions on /etc/issue.net are configured"
- name: "1.7.6 | PATCH | Ensure access to /etc/issue.net is configured"
when: rhel9cis_rule_1_7_6
tags:
- level1-server

4
tasks/section_1/cis_1.8.x.yml
View file

@ -198,7 +198,7 @@
- rhel9cis_gui
tags:
- level1-server
- level2-workstation
- level1-workstation
- patch
- gui
- rule_1.8.8
@ -226,7 +226,7 @@
- rhel9cis_gui
tags:
- level1-server
- level2-workstation
- level1-workstation
- patch
- gui
- rule_1.8.9