mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
improved tests and updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
485a85db76
commit
265423eb0a
11 changed files with 171 additions and 152 deletions
|
|
@ -46,16 +46,32 @@
|
|||
- patch
|
||||
- rule_6.1.2
|
||||
- NIST800-53R5_AU-2
|
||||
ansible.builtin.cron:
|
||||
name: Run AIDE integrity check
|
||||
cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
|
||||
user: "{{ rhel9cis_aide_cron['cron_user'] }}"
|
||||
minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
|
||||
hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
|
||||
day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
|
||||
month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
|
||||
weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
|
||||
job: "{{ rhel9cis_aide_cron['aide_job'] }}"
|
||||
block:
|
||||
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked"
|
||||
when: rhel9cis_aide_scan == "cron"
|
||||
ansible.builtin.cron:
|
||||
name: Run AIDE integrity check
|
||||
cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
|
||||
user: "{{ rhel9cis_aide_cron['cron_user'] }}"
|
||||
minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
|
||||
hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
|
||||
day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
|
||||
month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
|
||||
weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
|
||||
job: "{{ rhel9cis_aide_cron['aide_job'] }}"
|
||||
|
||||
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
|
||||
when: rhel9cis_aide_scan == "timer"
|
||||
ansible.builtin.systemd:
|
||||
name: aidecheck.service
|
||||
enabled: true
|
||||
|
||||
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
|
||||
when: rhel9cis_aide_scan == "timer"
|
||||
ansible.builtin.systemd:
|
||||
name: aidecheck.timer
|
||||
state: running
|
||||
enabled: true
|
||||
|
||||
- name: "6.1.3 | PATCH | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"
|
||||
when:
|
||||
|
|
|
|||
|
|
@ -78,85 +78,3 @@
|
|||
loop:
|
||||
- systemd-journal-remote.socket
|
||||
- systemd-journal-remote.service
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.2
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-6
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/forwardtosyslog.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/forwardtosyslog.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(\s*ForwardToSyslog)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.3
|
||||
- NIST800-53R5_AU-4
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2 # Added to the same file as 6.2.1.1.4
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*compress=)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.4
|
||||
- NIST800-53R5_AU-3
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*storage=)
|
||||
replace: '#\1'
|
||||
|
|
|
|||
83
tasks/section_6/cis_6.2.2.x.yml
Normal file
83
tasks/section_6/cis_6.2.2.x.yml
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
---
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.2
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-6
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/forwardtosyslog.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/forwardtosyslog.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(\s*ForwardToSyslog)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.3
|
||||
- NIST800-53R5_AU-4
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2 # Added to the same file as 6.2.1.1.4
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*compress=)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured"
|
||||
when:
|
||||
- rhel9cis_rule_6_2_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.4
|
||||
- NIST800-53R5_AU-3
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*storage=)
|
||||
replace: '#\1'
|
||||
|
|
@ -16,47 +16,37 @@
|
|||
failed_when: false
|
||||
register: discovered_logfiles
|
||||
|
||||
- name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | set_fact"
|
||||
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
|
||||
when:
|
||||
- discovered_logfiles.stdout_lines | length > 0
|
||||
- discovered_logfiles is defined
|
||||
ansible.builtin.set_fact:
|
||||
discovered_logfiles_flattened: "{{ discovered_logfiles.stdout_lines | flatten }}"
|
||||
|
||||
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
|
||||
when:
|
||||
- discovered_logfiles_flattened is defined
|
||||
- item == "/var/log/secure"
|
||||
- item == "/var/log/auth.log"
|
||||
- item == "/var/log/syslog"
|
||||
- "'journal' in item"
|
||||
- ('audit.log' in item or 'journal' in item) or
|
||||
item == '/var/log/secure' or
|
||||
item == '/var/log/syslog' or
|
||||
item == '/var/log/messages' or
|
||||
item == '/var/log/auth.log'
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
mode: 'u-x,g-wx,o-rwx'
|
||||
loop: "{{ discovered_logfiles_flattened }}"
|
||||
loop: "{{ discovered_logfiles.stdout_lines }}"
|
||||
|
||||
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
|
||||
when:
|
||||
- discovered_logfiles_flattened is defined
|
||||
- item == "/var/log/btmp"
|
||||
- item == "/var/log/utmp"
|
||||
- item == "/var/log/wtmp"
|
||||
- item == "/var/log/lastlog"
|
||||
- discovered_logfiles.stdout_lines | length > 0
|
||||
- ('anaconda' in item or 'dnf' in item or 'secure' in item or 'messages' in item or 'hawkey' in item)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
mode: 'u-x,g-wx,o-rwx'
|
||||
owner: root
|
||||
group: root
|
||||
loop: "{{ discovered_logfiles_flattened }}"
|
||||
mode: 'u-x,g-x,o-rwx'
|
||||
loop: "{{ discovered_logfiles.stdout_lines }}"
|
||||
|
||||
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
|
||||
when:
|
||||
- discovered_logfiles_flattened is defined
|
||||
- "'sssd' in item"
|
||||
- item == "/var/log/utmp"
|
||||
- item == "/var/log/wtmp"
|
||||
- item == "/var/log/lastlog"
|
||||
- discovered_logfiles.stdout_lines | length > 0
|
||||
- ('sssd' in item or 'lastlog' in item) or
|
||||
item == "/var/log/btmp" or
|
||||
item == "/var/log/utmp" or
|
||||
item == "/var/log/wtmp" or
|
||||
item == "/var/log/lastlog"
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
mode: 'u-x,g-wx,o-rwx'
|
||||
loop: "{{ discovered_logfiles_flattened }}"
|
||||
mode: 'ug-x,o-wx'
|
||||
loop: "{{ discovered_logfiles.stdout_lines }}"
|
||||
|
|
|
|||
|
|
@ -8,11 +8,16 @@
|
|||
ansible.builtin.import_tasks:
|
||||
file: cis_6.2.1.x.yml
|
||||
|
||||
- name: "SECTION | 6.2.2 | Configure journald"
|
||||
- name: "SECTION | 6.2.2.1.x | Configure journald-remote"
|
||||
when: rhel9cis_syslog == 'journald'
|
||||
ansible.builtin.import_tasks:
|
||||
file: cis_6.2.2.1.x.yml
|
||||
|
||||
- name: "SECTION | 6.2.2.x | Configure journald"
|
||||
when: rhel9cis_syslog == 'journald'
|
||||
ansible.builtin.import_tasks:
|
||||
file: cis_6.2.2.x.yml
|
||||
|
||||
- name: "SECTION | 6.2.3 | Configure rsyslog"
|
||||
when: rhel9cis_syslog == 'rsyslog'
|
||||
ansible.builtin.import_tasks:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue