diff --git a/Changelog.md b/Changelog.md index 5e31723..b5b160c 100644 --- a/Changelog.md +++ b/Changelog.md @@ -3,6 +3,7 @@ ## 2.0.5 - Based on CIS v2.0.0 - QA Fixes +- .j2 Branding Update - Added rhel9cis_uses_root variable definition for 5.4.2.5 root PATH integrity task - fixed spelling and grammar across defaults/main.yml, Changelog.md, README.md, tasks/main.yml, and vars/main.yml - Fixed incorrect product reference in vars/main.yml comment (ubtu24cis -> rhel9cis) diff --git a/meta/main.yml b/meta/main.yml index 8f8b65f..9418c84 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -1,11 +1,11 @@ --- galaxy_info: - author: "MindPoint Group" + author: "Ansible-Lockdown" description: "Apply the RHEL 9 CIS" - company: "MindPoint Group" + company: "MindPoint Group - A Tyto Athene Company" license: MIT role_name: rhel9_cis - namespace: mindpointgroup + namespace: ansible-lockdown min_ansible_version: 2.10.1 platforms: - name: EL diff --git a/templates/audit/98_auditd_exception.rules.j2 b/templates/audit/98_auditd_exception.rules.j2 index 1bec877..d3e394a 100644 --- a/templates/audit/98_auditd_exception.rules.j2 +++ b/templates/audit/98_auditd_exception.rules.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} ### YOUR CHANGES WILL BE LOST! # This file contains users whose actions are not logged by auditd diff --git a/templates/audit/99_auditd.rules.j2 b/templates/audit/99_auditd.rules.j2 index 0a0cadf..af65935 100644 --- a/templates/audit/99_auditd.rules.j2 +++ b/templates/audit/99_auditd.rules.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} ### YOUR CHANGES WILL BE LOST! # This template will set all of the auditd configurations via a handler in the role in one task instead of individually diff --git a/templates/etc/aide.conf.d/crypt_audit_procs.conf.j2 b/templates/etc/aide.conf.d/crypt_audit_procs.conf.j2 index fb12b29..b28aea1 100644 --- a/templates/etc/aide.conf.d/crypt_audit_procs.conf.j2 +++ b/templates/etc/aide.conf.d/crypt_audit_procs.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # Audit Tools /sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512 /sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512 diff --git a/templates/etc/ansible/compliance_facts.j2 b/templates/etc/ansible/compliance_facts.j2 index 896c159..0da1b18 100644 --- a/templates/etc/ansible/compliance_facts.j2 +++ b/templates/etc/ansible/compliance_facts.j2 @@ -1,6 +1,4 @@ -# CIS Hardening Carried out -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} [lockdown_details] # Benchmark release diff --git a/templates/etc/chrony.conf.j2 b/templates/etc/chrony.conf.j2 index e09bf25..671e2f0 100644 --- a/templates/etc/chrony.conf.j2 +++ b/templates/etc/chrony.conf.j2 @@ -1,4 +1,4 @@ -{{ ansible_managed | comment }} +{{ file_managed_by_ansible }} # Use public servers from the pool.ntp.org project. # Please consider joining the pool (http://www.pool.ntp.org/join.html). diff --git a/templates/etc/cron.d/aide.cron.j2 b/templates/etc/cron.d/aide.cron.j2 index 15ea95f..df0b1a5 100644 --- a/templates/etc/cron.d/aide.cron.j2 +++ b/templates/etc/cron.d/aide.cron.j2 @@ -1,7 +1,5 @@ +{{ file_managed_by_ansible }} # Run AIDE integrity check -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} ### YOUR CHANGES WILL BE LOST! # CIS 1.3.2 diff --git a/templates/etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2 index fd6eaff..7b907ab 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy dropping the SHA1 hash and signature support # Carried out as part of CIS Benchmark rule 1.6.3 diff --git a/templates/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod.j2 index 9092036..3619008 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy to disable all CBC mode ciphers # for the SSH protocol (libssh and OpenSSH) # Carried out as part of CIS Benchmark rule 1.6.5 diff --git a/templates/etc/crypto-policies/policies/modules/NO-SSHETM.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-SSHETM.pmod.j2 index cebc2ad..570048c 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-SSHETM.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-SSHETM.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy to disable Encrypt then MAC # for the SSH protocol (libssh and OpenSSH) # Carried out as part of CIS Benchmark rule 1.6.7 diff --git a/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod.j2 index 393cf88..f03cd05 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy to disable weak ciphers # for the SSH protocol (libssh and OpenSSH) # Carried out as part of CIS Benchmark rules combined 1.6.6 and 5.1.4 diff --git a/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod.j2 index f040399..25e2336 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy to disable weak macs # Carried out as part of CIS Benchmark control 5.1.6 diff --git a/templates/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod.j2 b/templates/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod.j2 index 0020e6d..984106a 100644 --- a/templates/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod.j2 +++ b/templates/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # This is a subpolicy to disable weak macs # Carried out as part of CIS Benchmark rule 1.6.4 diff --git a/templates/etc/dconf/db/00-automount_lock.j2 b/templates/etc/dconf/db/00-automount_lock.j2 index f6ac336..f3c3b74 100644 --- a/templates/etc/dconf/db/00-automount_lock.j2 +++ b/templates/etc/dconf/db/00-automount_lock.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} # Lock desktop media-handling automount setting /org/gnome/desktop/media-handling/automount diff --git a/templates/etc/dconf/db/00-autorun_lock.j2 b/templates/etc/dconf/db/00-autorun_lock.j2 index 17dcd56..a09aca5 100644 --- a/templates/etc/dconf/db/00-autorun_lock.j2 +++ b/templates/etc/dconf/db/00-autorun_lock.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} # Lock desktop media-handling settings /org/gnome/desktop/media-handling/autorun-never diff --git a/templates/etc/dconf/db/00-media-automount.j2 b/templates/etc/dconf/db/00-media-automount.j2 index 84f086d..f81aaea 100644 --- a/templates/etc/dconf/db/00-media-automount.j2 +++ b/templates/etc/dconf/db/00-media-automount.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} [org/gnome/desktop/media-handling] automount=false diff --git a/templates/etc/dconf/db/00-media-autorun.j2 b/templates/etc/dconf/db/00-media-autorun.j2 index 528f1be..6928d80 100644 --- a/templates/etc/dconf/db/00-media-autorun.j2 +++ b/templates/etc/dconf/db/00-media-autorun.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} [org/gnome/desktop/media-handling] autorun-never=true diff --git a/templates/etc/dconf/db/00-screensaver.j2 b/templates/etc/dconf/db/00-screensaver.j2 index a6c6894..1445dcc 100644 --- a/templates/etc/dconf/db/00-screensaver.j2 +++ b/templates/etc/dconf/db/00-screensaver.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} # Specify the dconf path [org/gnome/desktop/session] diff --git a/templates/etc/dconf/db/00-screensaver_lock.j2 b/templates/etc/dconf/db/00-screensaver_lock.j2 index ab8d41d..eafc95e 100644 --- a/templates/etc/dconf/db/00-screensaver_lock.j2 +++ b/templates/etc/dconf/db/00-screensaver_lock.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} # Lock desktop screensaver idle-delay setting /org/gnome/desktop/session/idle-delay diff --git a/templates/etc/dconf/db/gdm.d/01-banner-message.j2 b/templates/etc/dconf/db/gdm.d/01-banner-message.j2 index b5fac22..54562d2 100644 --- a/templates/etc/dconf/db/gdm.d/01-banner-message.j2 +++ b/templates/etc/dconf/db/gdm.d/01-banner-message.j2 @@ -1,6 +1,4 @@ -## Ansible controlled file -# Added as part of ansible-lockdown CIS baseline -# provided by {{ company_title }} +{{ file_managed_by_ansible }} [org/gnome/login-screen] banner-message-enable=true diff --git a/templates/etc/logrotate.d/rsyslog_log.j2 b/templates/etc/logrotate.d/rsyslog_log.j2 index 8acb53e..d9aa2a7 100644 --- a/templates/etc/logrotate.d/rsyslog_log.j2 +++ b/templates/etc/logrotate.d/rsyslog_log.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} /var/log/rsyslog/*.log { {{ rhel9cis_rsyslog_logrotate_rotated_when }} rotate {{ rhel9cis_rsyslog_logrotate_rotatation_keep }} diff --git a/templates/etc/modprobe.d/modprobe.conf.j2 b/templates/etc/modprobe.d/modprobe.conf.j2 index 77b8cd5..6c3d7d8 100644 --- a/templates/etc/modprobe.d/modprobe.conf.j2 +++ b/templates/etc/modprobe.d/modprobe.conf.j2 @@ -1,6 +1,4 @@ -# Disable usage of protocol {{ item }} -# Set by ansible {{ benchmark }} remediation role -# https://github.com/ansible-lockdown -## This file is managed by Ansible, YOUR CHANGES WILL BE LOST! +{{ file_managed_by_ansible }} +## YOUR CHANGES WILL BE LOST! install {{ item }} /bin/true diff --git a/templates/etc/security/pwquality.conf.d/50-pwcomplexity.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwcomplexity.conf.j2 index c223c84..d8cdb67 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwcomplexity.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwcomplexity.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.3 Ensure password complexity is configured {% if rhel9cis_passwd_complex_option == 'minclass' %} # pragma: allowlist secret diff --git a/templates/etc/security/pwquality.conf.d/50-pwdictcheck.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwdictcheck.conf.j2 index 09b6ee3..e7cd0e0 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwdictcheck.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwdictcheck.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.6 Ensure password dictionary check is enabled dictcheck = {{ rhel9cis_passwd_dictcheck_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwdifok.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwdifok.conf.j2 index 2e8ae2d..d69120a 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwdifok.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwdifok.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.1 Ensure password number of changed characters is configured difok = {{ rhel9cis_passwd_difok_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwlength.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwlength.conf.j2 index 9e874ee..0f893ac 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwlength.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwlength.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.2 Ensure minimum password length is configured minlen = {{ rhel9cis_passwd_minlen_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwmaxsequence.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwmaxsequence.conf.j2 index a561fec..d200904 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwmaxsequence.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwmaxsequence.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.5 Ensure password maximum sequential characters is configured maxsequence = {{ rhel9cis_passwd_maxsequence_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwquality_enforce.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwquality_enforce.conf.j2 index 6fea8db..c8fff7e 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwquality_enforce.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwquality_enforce.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.7 Ensure password quality checking is enforced enforcing = {{ rhel9cis_passwd_quality_enforce_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwrepeat.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwrepeat.conf.j2 index 28b8dde..0b2c592 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwrepeat.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwrepeat.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.4 Ensure password same consecutive characters is configured maxrepeat = {{ rhel9cis_passwd_maxrepeat_value }} diff --git a/templates/etc/security/pwquality.conf.d/50-pwroot.conf.j2 b/templates/etc/security/pwquality.conf.d/50-pwroot.conf.j2 index 0e51bee..243d7fb 100644 --- a/templates/etc/security/pwquality.conf.d/50-pwroot.conf.j2 +++ b/templates/etc/security/pwquality.conf.d/50-pwroot.conf.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # CIS Configurations # 5.3.3.2.7 Ensure password quality is enforced for the root user {{ rhel9cis_passwd_quality_enforce_root_value }} diff --git a/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 b/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 index b4b5318..dfca519 100644 --- a/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 +++ b/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 @@ -1,4 +1,5 @@ -## This file is managed by Ansible, YOUR CHANGES WILL BE LOST! +{{ file_managed_by_ansible }} +## YOUR CHANGES WILL BE LOST! # IPv6 disable {% if rhel9cis_rule_3_1_1 and not rhel9cis_ipv6_required %} diff --git a/templates/etc/sysctl.d/60-kernel_sysctl.conf.j2 b/templates/etc/sysctl.d/60-kernel_sysctl.conf.j2 index 11a93f2..12901dc 100644 --- a/templates/etc/sysctl.d/60-kernel_sysctl.conf.j2 +++ b/templates/etc/sysctl.d/60-kernel_sysctl.conf.j2 @@ -1,4 +1,5 @@ -## This file is managed by Ansible, YOUR CHANGES WILL BE LOST! +{{ file_managed_by_ansible }} +## YOUR CHANGES WILL BE LOST! {% if rhel9cis_rule_1_5_1 %} # Adress space randomise diff --git a/templates/etc/sysctl.d/60-netipv4_sysctl.conf.j2 b/templates/etc/sysctl.d/60-netipv4_sysctl.conf.j2 index 336071c..8d27e8f 100644 --- a/templates/etc/sysctl.d/60-netipv4_sysctl.conf.j2 +++ b/templates/etc/sysctl.d/60-netipv4_sysctl.conf.j2 @@ -1,4 +1,5 @@ -## This file is managed by Ansible, YOUR CHANGES WILL BE LOST! +{{ file_managed_by_ansible }} +## YOUR CHANGES WILL BE LOST! # IPv4 Network sysctl {% if rhel9cis_rule_3_3_1 %} diff --git a/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2 b/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2 index 07e045d..3ef53f4 100644 --- a/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2 +++ b/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2 @@ -1,4 +1,5 @@ -## This file is managed by Ansible, YOUR CHANGES WILL BE LOST! +{{ file_managed_by_ansible }} +## YOUR CHANGES WILL BE LOST! # IPv6 Network sysctl {% if rhel9cis_ipv6_required %} diff --git a/templates/etc/systemd/journald.conf.d/forwardtosyslog.conf.j2 b/templates/etc/systemd/journald.conf.d/forwardtosyslog.conf.j2 index 3b00ce1..682cdd5 100644 --- a/templates/etc/systemd/journald.conf.d/forwardtosyslog.conf.j2 +++ b/templates/etc/systemd/journald.conf.d/forwardtosyslog.conf.j2 @@ -1,4 +1,4 @@ -# File created for CIS benchmark +{{ file_managed_by_ansible }} # CIS rule 6_2_2_2 [Journal] ForwardToSyslog=no diff --git a/templates/etc/systemd/journald.conf.d/rotation.conf.j2 b/templates/etc/systemd/journald.conf.d/rotation.conf.j2 index 07eedba..4a3174b 100644 --- a/templates/etc/systemd/journald.conf.d/rotation.conf.j2 +++ b/templates/etc/systemd/journald.conf.d/rotation.conf.j2 @@ -1,4 +1,4 @@ -# File created for CIS benchmark +{{ file_managed_by_ansible }} # CIS rule 6_2_1_3 [Journal] SystemMaxUse={{ rhel9cis_journald_systemmaxuse }} diff --git a/templates/etc/systemd/journald.conf.d/storage.conf.j2 b/templates/etc/systemd/journald.conf.d/storage.conf.j2 index 214f9db..5e5726d 100644 --- a/templates/etc/systemd/journald.conf.d/storage.conf.j2 +++ b/templates/etc/systemd/journald.conf.d/storage.conf.j2 @@ -1,4 +1,4 @@ -# File created for CIS benchmark +{{ file_managed_by_ansible }} [Journal] {% if rhel9cis_rule_6_2_2_3 %} # Set compress CIS rule 6_2_2_3 diff --git a/templates/etc/systemd/system/tmp.mount.j2 b/templates/etc/systemd/system/tmp.mount.j2 index 7f64547..245102f 100644 --- a/templates/etc/systemd/system/tmp.mount.j2 +++ b/templates/etc/systemd/system/tmp.mount.j2 @@ -1,3 +1,4 @@ +{{ file_managed_by_ansible }} # SPDX-License-Identifier: LGPL-2.1+ # # This file is part of systemd. @@ -7,7 +8,7 @@ # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. -## This file is managed by Ansible, YOUR CHANGED WILL BE LOST! +## YOUR CHANGED WILL BE LOST! [Unit] Description=Temporary Directory (/tmp) diff --git a/vars/main.yml b/vars/main.yml index c548b9a..2225042 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -77,4 +77,9 @@ audit_bins: - /sbin/auditd - /sbin/augenrules -company_title: 'Mindpoint Group - A Tyto Athene Company' +company_title: 'MindPoint Group - A Tyto Athene Company' + +file_managed_by_ansible: |- + # File managed by ansible as part of {{ benchmark }} benchmark + # As part of Ansible-lockdown + # Provided by {{ company_title }}