mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
Update cryto policy var to standard
Signed-off-by: Frederick Witty <frederickw@mindpointgroup.com>
This commit is contained in:
Frederick Witty
parent
413ccb96b7
commit
2dfa9266a8
4 changed files with 13 additions and 13 deletions
|
|
@ -586,7 +586,9 @@ rhel9cis_bootloader_password_hash: 'grub.pbkdf2.sha512.changethispassword' # pr
|
||||||
# This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file.
|
# This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file.
|
||||||
rhel9cis_set_boot_pass: true
|
rhel9cis_set_boot_pass: true
|
||||||
|
|
||||||
## Controls 1.6.x
|
## Controls 1.6.x and Controls 5.1.x
|
||||||
|
# This variable governs if current Ansible role should manage system-wide crypto policy.
|
||||||
|
rhel9cis_crypto_policy_ansiblemanaged: true
|
||||||
# This variable contains the value to be set as the system-wide crypto policy. Current rule enforces NOT USING
|
# This variable contains the value to be set as the system-wide crypto policy. Current rule enforces NOT USING
|
||||||
# 'LEGACY' value(as it is less secure, it just ensures compatibility with legacy systems), therefore
|
# 'LEGACY' value(as it is less secure, it just ensures compatibility with legacy systems), therefore
|
||||||
# possible values for this variable are, as explained by RedHat docs:
|
# possible values for this variable are, as explained by RedHat docs:
|
||||||
|
|
@ -594,8 +596,6 @@ rhel9cis_set_boot_pass: true
|
||||||
# -'FUTURE': conservative security level that is believed to withstand any near-term future attacks
|
# -'FUTURE': conservative security level that is believed to withstand any near-term future attacks
|
||||||
# -'FIPS': A level that conforms to the FIPS140-2 requirements
|
# -'FIPS': A level that conforms to the FIPS140-2 requirements
|
||||||
rhel9cis_crypto_policy: 'DEFAULT'
|
rhel9cis_crypto_policy: 'DEFAULT'
|
||||||
## Controls 1.6.x and Controls 5.1.x
|
|
||||||
rhel9cis_crypto_policy_ansible_managed: true
|
|
||||||
# This variable contains the value of the crypto policy module(combinations of policies and
|
# This variable contains the value of the crypto policy module(combinations of policies and
|
||||||
# sub-policies) to be allowed as default setting. Allowed options are defined in 'vars/main.yml' file,
|
# sub-policies) to be allowed as default setting. Allowed options are defined in 'vars/main.yml' file,
|
||||||
# using 'rhel9cis_allowed_crypto_policies_modules' variable, which currently are:
|
# using 'rhel9cis_allowed_crypto_policies_modules' variable, which currently are:
|
||||||
|
|
|
||||||
|
|
@ -136,7 +136,7 @@
|
||||||
register: prelim_systemd_coredump
|
register: prelim_systemd_coredump
|
||||||
|
|
||||||
- name: "PRELIM | PATCH | Setup crypto-policy"
|
- name: "PRELIM | PATCH | Setup crypto-policy"
|
||||||
when: rhel9cis_crypto_policy_ansible_managed
|
when: rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
- name: "1.6.1 | AUDIT | Ensure system-wide crypto policy is not legacy"
|
- name: "1.6.1 | AUDIT | Ensure system-wide crypto policy is not legacy"
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_1
|
- rhel9cis_rule_1_6_1
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -41,7 +41,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_3
|
- rhel9cis_rule_1_6_3
|
||||||
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
|
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -72,7 +72,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_4
|
- rhel9cis_rule_1_6_4
|
||||||
- "'NO-WEAKMAC' not in rhel9cis_crypto_policy_module"
|
- "'NO-WEAKMAC' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -103,7 +103,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_5
|
- rhel9cis_rule_1_6_5
|
||||||
- "'NO-SSHCBC' not in rhel9cis_crypto_policy_module"
|
- "'NO-SSHCBC' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -134,7 +134,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_6
|
- rhel9cis_rule_1_6_6
|
||||||
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
|
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -165,7 +165,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_1_6_7
|
- rhel9cis_rule_1_6_7
|
||||||
- "'NO-SSHETM' not in rhel9cis_crypto_policy_module"
|
- "'NO-SSHETM' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
|
||||||
|
|
@ -80,7 +80,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_1_4
|
- rhel9cis_rule_5_1_4
|
||||||
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
|
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -109,7 +109,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_1_5
|
- rhel9cis_rule_5_1_5
|
||||||
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
|
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
@ -138,7 +138,7 @@
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_1_6
|
- rhel9cis_rule_5_1_6
|
||||||
- "'NO-SSHWEAKMACS' not in rhel9cis_crypto_policy_module"
|
- "'NO-SSHWEAKMACS' not in rhel9cis_crypto_policy_module"
|
||||||
- rhel9cis_crypto_policy_ansible_managed
|
- rhel9cis_crypto_policy_ansiblemanaged
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue