ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Added Nist values

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-07-22 12:42:39 +01:00
parent 8b58d71e4b
commit 2bf67cde0d
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
16 changed files with 100 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tasks/prelim.yml
View file

@ -270,6 +270,7 @@
- users - users
- name: "PRELIM | Discover Interactive UID MIN and MIN from logins.def" - name: "PRELIM | Discover Interactive UID MIN and MIN from logins.def"
when: rhel9cis_discover_int_uid
block: block:
- name: "PRELIM | Capture UID_MIN information from logins.def" - name: "PRELIM | Capture UID_MIN information from logins.def"
ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}' ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
@ -292,13 +293,6 @@
max_int_uid: "{{ uid_max_id.stdout }}" max_int_uid: "{{ uid_max_id.stdout }}"
min_int_gid: "{{ gid_min_id.stdout }}" min_int_gid: "{{ gid_min_id.stdout }}"
- name: "PRELIM | Output of uid findings"
ansible.builtin.debug:
msg: "{{ min_int_uid }} {{ max_int_uid }}"
when:
- not discover_int_uid
- name: "PRELIM | Gather the package facts after prelim" - name: "PRELIM | Gather the package facts after prelim"
ansible.builtin.package_facts: ansible.builtin.package_facts:
manager: auto manager: auto

9
tasks/section_1/cis_1.1.1.x.yml
View file

@ -9,6 +9,7 @@
- patch - patch
- rule_1.1.1.1 - rule_1.1.1.1
- cramfs - cramfs
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Edit modprobe config" - name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -42,6 +43,7 @@
- patch - patch
- rule_1.1.1.2 - rule_1.1.1.2
- freevxfs - freevxfs
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Edit modprobe config" - name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -75,6 +77,7 @@
- patch - patch
- rule_1.1.1.3 - rule_1.1.1.3
- hfs - hfs
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Edit modprobe config" - name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -108,6 +111,7 @@
- patch - patch
- rule_1.1.1.4 - rule_1.1.1.4
- hfsplus - hfsplus
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Edit modprobe config" - name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -141,6 +145,7 @@
- patch - patch
- rule_1.1.1.5 - rule_1.1.1.5
- jffs2 - jffs2
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Edit modprobe config" - name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -174,6 +179,7 @@
- patch - patch
- rule_1.1.1.6 - rule_1.1.1.6
- squashfs - squashfs
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Edit modprobe config" - name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -207,6 +213,7 @@
- patch - patch
- rule_1.1.1.7 - rule_1.1.1.7
- udf - udf
- NIST800-53R5_CM-7
block: block:
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Edit modprobe config" - name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -240,6 +247,7 @@
- patch - patch
- rule_1.1.1.8 - rule_1.1.1.8
- usb - usb
- NIST800-53R5_SI-3
block: block:
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Edit modprobe config" - name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Edit modprobe config"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -272,7 +280,6 @@
- level1-workstation - level1-workstation
- patch - patch
- rule_1.1.1.9 - rule_1.1.1.9
- usb
vars: vars:
warn_control_id: '1.1.1.9' warn_control_id: '1.1.1.9'
block: block:

6
tasks/section_1/cis_1.1.2.1.x.yml
View file

@ -10,6 +10,7 @@
- audit - audit
- mounts - mounts
- rule_1.1.2.1.1 - rule_1.1.2.1.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.1.1' warn_control_id: '1.1.2.1.1'
required_mount: '/tmp' required_mount: '/tmp'
@ -51,6 +52,9 @@
- rule_1.1.2.1.2 - rule_1.1.2.1.2
- rule_1.1.2.1.3 - rule_1.1.2.1.3
- rule_1.1.2.1.4 - rule_1.1.2.1.4
- NIST800-53R5_CM-7
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
# via systemd # via systemd
- name: | - name: |
@ -73,6 +77,8 @@
- rule_1.1.2.1.2 - rule_1.1.2.1.2
- rule_1.1.2.1.3 - rule_1.1.2.1.3
- rule_1.1.2.1.4 - rule_1.1.2.1.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.template: ansible.builtin.template:
src: etc/systemd/system/tmp.mount.j2 src: etc/systemd/system/tmp.mount.j2
dest: /etc/systemd/system/tmp.mount dest: /etc/systemd/system/tmp.mount

3
tasks/section_1/cis_1.1.2.2.x.yml
View file

@ -10,6 +10,7 @@
- audit - audit
- mounts - mounts
- rule_1.1.2.2.1 - rule_1.1.2.2.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.2.1' warn_control_id: '1.1.2.2.1'
block: block:
@ -45,6 +46,8 @@
- rule_1.1.2.2.2 - rule_1.1.2.2.2
- rule_1.1.2.2.3 - rule_1.1.2.2.3
- rule_1.1.2.2.4 - rule_1.1.2.2.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.posix.mount: ansible.posix.mount:
name: /dev/shm name: /dev/shm
src: tmpfs src: tmpfs

5
tasks/section_1/cis_1.1.2.3.x.yml
View file

@ -10,7 +10,7 @@
- audit - audit
- mounts - mounts
- rule_1_1_2.3.1 - rule_1_1_2.3.1
- skip_ansible_lint - NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.3.1' warn_control_id: '1.1.2.3.1'
required_mount: '/home' required_mount: '/home'
@ -37,6 +37,9 @@
- mounts - mounts
- rule_1_1_2.3.2 - rule_1_1_2.3.2
- rule_1_1_2.3.3 - rule_1_1_2.3.3
- NIST800-53R5_CM-7
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.mount: ansible.builtin.mount:
name: /home name: /home
src: "{{ item.device }}" src: "{{ item.device }}"

3
tasks/section_1/cis_1.1.2.4.x.yml
View file

@ -10,6 +10,7 @@
- patch - patch
- mounts - mounts
- rule_1_1_2.4.1 - rule_1_1_2.4.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.4.1' warn_control_id: '1.1.2.4.1'
required_mount: '/var' required_mount: '/var'
@ -37,6 +38,8 @@
- mounts - mounts
- rule_1_1_2.4.2 - rule_1_1_2.4.2
- rule_1_1_2.4.3 - rule_1_1_2.4.3
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.mount: ansible.builtin.mount:
name: /var name: /var
src: "{{ item.device }}" src: "{{ item.device }}"

3
tasks/section_1/cis_1.1.2.5.x.yml
View file

@ -11,6 +11,7 @@
- audit - audit
- mounts - mounts
- rule_1_1_2.5.1 - rule_1_1_2.5.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.5.1' warn_control_id: '1.1.2.5.1'
required_mount: '/var/tmp' required_mount: '/var/tmp'
@ -41,6 +42,8 @@
- rule_1_1_2.5.2 - rule_1_1_2.5.2
- rule_1_1_2.5.3 - rule_1_1_2.5.3
- rule_1_1_2.5.4 - rule_1_1_2.5.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.mount: ansible.builtin.mount:
name: /var/tmp name: /var/tmp
src: "{{ item.device }}" src: "{{ item.device }}"

3
tasks/section_1/cis_1.1.2.6.x.yml
View file

@ -10,6 +10,7 @@
- audit - audit
- mounts - mounts
- rule_1_1_2.6.1 - rule_1_1_2.6.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.6.1' warn_control_id: '1.1.2.6.1'
required_mount: '/var/log' required_mount: '/var/log'
@ -39,6 +40,8 @@
- rule_1_1_2.6.2 - rule_1_1_2.6.2
- rule_1_1_2.6.3 - rule_1_1_2.6.3
- rule_1_1_2.6.4 - rule_1_1_2.6.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.mount: ansible.builtin.mount:
name: /var/log name: /var/log
src: "{{ item.device }}" src: "{{ item.device }}"

3
tasks/section_1/cis_1.1.2.7.x.yml
View file

@ -10,6 +10,7 @@
- audit - audit
- mounts - mounts
- rule_1_1_2.7.1 - rule_1_1_2.7.1
- NIST800-53R5_CM-7
vars: vars:
warn_control_id: '1.1.2.7.1' warn_control_id: '1.1.2.7.1'
required_mount: '/var/log/audit' required_mount: '/var/log/audit'
@ -49,3 +50,5 @@
- rule_1_1_2.7.2 - rule_1_1_2.7.2
- rule_1_1_2.7.3 - rule_1_1_2.7.3
- rule_1_1_2.7.4 - rule_1_1_2.7.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

5
tasks/section_1/cis_1.2.1.x.yml
View file

@ -12,6 +12,7 @@
- manual - manual
- patch - patch
- rule_1.2.1.1 - rule_1.2.1.1
- NIST800-53R5_SI-2
block: block:
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys" - name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys"
ansible.builtin.shell: "rpm -qa | grep {{ os_gpg_key_pubkey_name }}" ansible.builtin.shell: "rpm -qa | grep {{ os_gpg_key_pubkey_name }}"
@ -41,6 +42,7 @@
- level1-workstation - level1-workstation
- patch - patch
- rule_1.2.1.2 - rule_1.2.1.2
- NIST800-53R5_SI-2
block: block:
- name: "1.2.1.2 | AUDIT | Ensure gpgcheck is globally activated | Find repos" - name: "1.2.1.2 | AUDIT | Ensure gpgcheck is globally activated | Find repos"
ansible.builtin.find: ansible.builtin.find:
@ -68,6 +70,7 @@
- manual - manual
- audit - audit
- rule_1.2.1.3 - rule_1.2.1.3
- NIST800-53R5_SI-2
block: block:
- name: "1.2.1.3 | PATCH | Ensure repo_gpgcheck is globally activated | dnf.conf" - name: "1.2.1.3 | PATCH | Ensure repo_gpgcheck is globally activated | dnf.conf"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -99,7 +102,7 @@
- manual - manual
- audit - audit
- rule_1.2.1.4 - rule_1.2.1.4
- skip_ansible_lint - NIST800-53R5_SI-2
vars: vars:
warn_control_id: '1.2.1.4' warn_control_id: '1.2.1.4'
block: block:

22
tasks/section_1/cis_1.2.2.x.yml
View file

@ -1,16 +1,16 @@
--- ---
- name: "1.2.2.1 | PATCH | Ensure updates, patches, and additional security software are installed" - name: "1.2.2.1 | PATCH | Ensure updates, patches, and additional security software are installed"
ansible.builtin.package:
name: "*"
state: latest
notify: Change_requires_reboot
when: when:
- rhel9cis_rule_1_2_2_1 - rhel9cis_rule_1_2_2_1
- not system_is_ec2 - not system_is_ec2
tags: tags:
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- rule_1.2.2.1 - rule_1.2.2.1
- skip_ansible_lint - NIST800-53R5_SI-2
ansible.builtin.package:
name: "*"
state: latest
notify: Change_requires_reboot

16
tasks/section_1/cis_1.3.1.x.yml
View file

@ -9,6 +9,8 @@
- level1-workstation - level1-workstation
- patch - patch
- rule_1.3.1.1 - rule_1.3.1.1
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.package: ansible.builtin.package:
name: libselinux name: libselinux
state: present state: present
@ -23,6 +25,8 @@
- scored - scored
- patch - patch
- rule_1.3.1.2 - rule_1.3.1.2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.replace: ansible.builtin.replace:
path: /etc/default/grub path: /etc/default/grub
regexp: '{{ item }}' regexp: '{{ item }}'
@ -45,6 +49,8 @@
- selinux - selinux
- patch - patch
- rule_1.3.1.3 - rule_1.3.1.3
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.posix.selinux: ansible.posix.selinux:
conf: /etc/selinux/config conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}" policy: "{{ rhel9cis_selinux_pol }}"
@ -60,6 +66,8 @@
- selinux - selinux
- patch - patch
- rule_1.3.1.4 - rule_1.3.1.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.posix.selinux: ansible.posix.selinux:
conf: /etc/selinux/config conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}" policy: "{{ rhel9cis_selinux_pol }}"
@ -76,6 +84,8 @@
- selinux - selinux
- patch - patch
- rule_1.3.1.5 - rule_1.3.1.5
- NIST800-53R4_AC-3
- NIST800-53R4_SI-6
ansible.posix.selinux: ansible.posix.selinux:
conf: /etc/selinux/config conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}" policy: "{{ rhel9cis_selinux_pol }}"
@ -91,6 +101,8 @@
- audit - audit
- services - services
- rule_1.3.1.6 - rule_1.3.1.6
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
vars: vars:
warn_control_id: '1.3.1.6' warn_control_id: '1.3.1.6'
block: block:
@ -118,6 +130,8 @@
- level1-workstation - level1-workstation
- patch - patch
- rule_1.3.1.7 - rule_1.3.1.7
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.package: ansible.builtin.package:
name: mcstrans name: mcstrans
state: absent state: absent
@ -134,3 +148,5 @@
- selinux - selinux
- patch - patch
- rule_1.3.1.8 - rule_1.3.1.8
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

2
tasks/section_1/cis_1.4.x.yml
View file

@ -10,6 +10,7 @@
- grub - grub
- patch - patch
- rule_1.4.1 - rule_1.4.1
- NIST800-53R5_AC-3
ansible.builtin.copy: ansible.builtin.copy:
dest: /boot/grub2/user.cfg dest: /boot/grub2/user.cfg
content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}" # noqa template-instead-of-copy content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}" # noqa template-instead-of-copy
@ -27,6 +28,7 @@
- grub - grub
- patch - patch
- rule_1.4.2 - rule_1.4.2
- NIST800-53R5_AC-3
block: block:
- name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured" - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured"
ansible.builtin.file: ansible.builtin.file:

3
tasks/section_1/cis_1.5.x.yml
View file

@ -9,6 +9,8 @@
- patch - patch
- sysctl - sysctl
- rule_1.5.1 - rule_1.5.1
- NIST800-53R5_CM-6
- NIST800-53R5_CM-6.1
block: block:
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled" - name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
ansible.builtin.set_fact: ansible.builtin.set_fact:
@ -45,6 +47,7 @@
- patch - patch
- sysctl - sysctl
- rule_1.5.3 - rule_1.5.3
- NIST800-53R5_CM-6b
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/systemd/coredump.conf path: /etc/systemd/coredump.conf
regexp: '^ProcessSizeMax\s*=\s*.*[1-9]$' regexp: '^ProcessSizeMax\s*=\s*.*[1-9]$'

15
tasks/section_1/cis_1.6.x.yml
View file

@ -8,7 +8,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.1 - rule_1.6.1
- NIST800-53R5_SC-6
ansible.builtin.debug: ansible.builtin.debug:
msg: "Captured in prelim to ensure not LEGACY. Runs handler to update" msg: "Captured in prelim to ensure not LEGACY. Runs handler to update"
changed_when: true changed_when: true
@ -25,6 +27,9 @@
- automated - automated
- patch - patch
- rule_1.6.2 - rule_1.6.2
- NIST800-53R5_SC-8
- NIST800-53R5_IA-5
- NIST800-53R5_AC-17- NIST800-53R5_SC-6
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/sysconfig/sshd path: /etc/sysconfig/sshd
regexp: ^CRYPTO_POLICY\s*= regexp: ^CRYPTO_POLICY\s*=
@ -40,7 +45,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.3 - rule_1.6.3
- NIST800-53R5_SC-6
block: block:
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support | Add submodule exclusion" - name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support | Add submodule exclusion"
ansible.builtin.template: ansible.builtin.template:
@ -66,7 +73,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.4 - rule_1.6.4
- NIST800-53R5_SC-6
block: block:
- name: "1.6.4 | PATCH | Ensure system wide crypto policy disables macs less than 128 bits | Add submodule exclusion" - name: "1.6.4 | PATCH | Ensure system wide crypto policy disables macs less than 128 bits | Add submodule exclusion"
ansible.builtin.template: ansible.builtin.template:
@ -93,7 +102,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.5 - rule_1.6.5
- NIST800-53R5_SC-6
block: block:
- name: "1.6.5 | PATCH | Ensure system wide crypto policy disables cbc for ssh | Add submodule exclusion" - name: "1.6.5 | PATCH | Ensure system wide crypto policy disables cbc for ssh | Add submodule exclusion"
ansible.builtin.template: ansible.builtin.template:
@ -119,7 +130,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.6 - rule_1.6.6
- NIST800-53R5_SC-6
block: block:
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | Add submodule exclusion" - name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | Add submodule exclusion"
ansible.builtin.template: ansible.builtin.template:
@ -145,7 +158,9 @@
- level1-workstation - level1-workstation
- automated - automated
- patch - patch
- crypto
- rule_1.6.7 - rule_1.6.7
- NIST800-53R5_SC-6
block: block:
- name: "1.6.7 | PATCH | Ensure system wide crypto policy disables EtM for ssh | Add submodule exclusion" - name: "1.6.7 | PATCH | Ensure system wide crypto policy disables EtM for ssh | Add submodule exclusion"
ansible.builtin.template: ansible.builtin.template:

15
tasks/section_1/cis_1.7.x.yml
View file

@ -9,6 +9,9 @@
- banner - banner
- patch - patch
- rule_1.7.1 - rule_1.7.1
- NIST800-53R5_CM-1
- NIST800-53R5_CM-3
- NIST800-53R5_CM-6
ansible.builtin.template: ansible.builtin.template:
src: etc/motd.j2 src: etc/motd.j2
dest: /etc/motd dest: /etc/motd
@ -24,6 +27,9 @@
- level1-workstation - level1-workstation
- patch - patch
- rule_1.7.2 - rule_1.7.2
- NIST800-53R5_CM-1
- NIST800-53R5_CM-3
- NIST800-53R5_CM-6
ansible.builtin.template: ansible.builtin.template:
src: etc/issue.j2 src: etc/issue.j2
dest: /etc/issue dest: /etc/issue
@ -40,6 +46,9 @@
- banner - banner
- patch - patch
- rule_1.7.3 - rule_1.7.3
- NIST800-53R5_CM-1
- NIST800-53R5_CM-3
- NIST800-53R5_CM-6
ansible.builtin.template: ansible.builtin.template:
src: etc/issue.net.j2 src: etc/issue.net.j2
dest: /etc/issue.net dest: /etc/issue.net
@ -56,6 +65,8 @@
- perms - perms
- patch - patch
- rule_1.7.4 - rule_1.7.4
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.file: ansible.builtin.file:
path: /etc/motd path: /etc/motd
owner: root owner: root
@ -71,6 +82,8 @@
- perms - perms
- patch - patch
- rule_1.7.5 - rule_1.7.5
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.file: ansible.builtin.file:
path: /etc/issue path: /etc/issue
owner: root owner: root
@ -86,6 +99,8 @@
- perms - perms
- patch - patch
- rule_1.7.6 - rule_1.7.6
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.file: ansible.builtin.file:
path: /etc/issue.net path: /etc/issue.net
owner: root owner: root