ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 23:43:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix 3_3_7 and 5_2_20

Browse source
This commit is contained in:
root@DERVISHx 2023-10-10 09:52:26 +01:00
parent 3525cb6aab
commit 3f835628c0
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
defaults/main.yml
View file

@ -565,7 +565,7 @@ rhel9cis_logrotate: "daily"
rhel9_cis_sshd_config_file: /etc/ssh/sshd_config rhel9_cis_sshd_config_file: /etc/ssh/sshd_config
rhel9cis_sshd: rhel9cis_sshd:
clientalivecountmax: 0 clientalivecountmax: 3
clientaliveinterval: 900 clientaliveinterval: 900
logingracetime: 60 logingracetime: 60
# WARNING: make sure you understand the precedence when working with these values!! # WARNING: make sure you understand the precedence when working with these values!!

18
tasks/post.yml
View file

@ -26,6 +26,24 @@
- not system_is_container - not system_is_container
- "'procps-ng' in ansible_facts.packages" - "'procps-ng' in ansible_facts.packages"
- name: POST | Update usr sysctl
block:
- name: POST | Set default.rp_filter
ansible.builtin.lineinfile:
path: /usr/lib/sysctl.d/50-default.conf
regexp: '^net.ipv4.conf.default.rp_filter'
line: net.ipv4.conf.default.rp_filter = 1
- name: POST | Set ALL rp_filter
ansible.builtin.lineinfile:
path: /usr/lib/sysctl.d/50-default.conf
regexp: '^net.ipv4.conf.*.rp_filter'
line: net.ipv4.conf.*.rp_filter = 1
when:
- rhel9cis_sysctl_update
- not system_is_container
- "'procps-ng' in ansible_facts.packages"
- name: Flush handlers - name: Flush handlers
ansible.builtin.meta: flush_handlers ansible.builtin.meta: flush_handlers