ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 14:23:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Update cryto policy based controls with improved logic

Browse source 
Signed-off-by: Frederick Witty <frederickw@mindpointgroup.com>
This commit is contained in:
Frederick Witty 2025-09-05 16:39:55 -04:00
parent b0ec6c4820
commit 413ccb96b7
No known key found for this signature in database
GPG key ID: D29987C25A47D813
5 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Changelog.md
View file

@ -1,6 +1,7 @@
# Changes to rhel9CIS
## 2.0.3 - Based on CIS v2.0.0
- improvment on crypto policy managed controls with var logic
- addressed issue #384 thank you @polski-g
- update command to shell module on tasks
- addressed issue 371 thanks to @bgro and kodebach

1
defaults/main.yml
View file

@ -595,6 +595,7 @@ rhel9cis_set_boot_pass: true
# -'FIPS': A level that conforms to the FIPS140-2 requirements
rhel9cis_crypto_policy: 'DEFAULT'
## Controls 1.6.x and Controls 5.1.x
rhel9cis_crypto_policy_ansible_managed: true
# This variable contains the value of the crypto policy module(combinations of policies and
# sub-policies) to be allowed as default setting. Allowed options are defined in 'vars/main.yml' file,
# using 'rhel9cis_allowed_crypto_policies_modules' variable, which currently are:

3
tasks/prelim.yml
View file

@ -136,8 +136,7 @@
register: prelim_systemd_coredump
- name: "PRELIM | PATCH | Setup crypto-policy"
when:
- rhel9cis_rule_1_6_1
when: rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation

9
tasks/section_1/cis_1.6.x.yml
View file

@ -1,7 +1,9 @@
---
- name: "1.6.1 | AUDIT | Ensure system-wide crypto policy is not legacy"
when: rhel9cis_rule_1_6_1
when:
- rhel9cis_rule_1_6_1
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -39,6 +41,7 @@
when:
- rhel9cis_rule_1_6_3
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -69,6 +72,7 @@
when:
- rhel9cis_rule_1_6_4
- "'NO-WEAKMAC' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -99,6 +103,7 @@
when:
- rhel9cis_rule_1_6_5
- "'NO-SSHCBC' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -129,6 +134,7 @@
when:
- rhel9cis_rule_1_6_6
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -159,6 +165,7 @@
when:
- rhel9cis_rule_1_6_7
- "'NO-SSHETM' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation

3
tasks/section_5/cis_5.1.x.yml
View file

@ -80,6 +80,7 @@
when:
- rhel9cis_rule_5_1_4
- "'NO-SSHWEAKCIPHERS' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -108,6 +109,7 @@
when:
- rhel9cis_rule_5_1_5
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation
@ -136,6 +138,7 @@
when:
- rhel9cis_rule_5_1_6
- "'NO-SSHWEAKMACS' not in rhel9cis_crypto_policy_module"
- rhel9cis_crypto_policy_ansible_managed
tags:
- level1-server
- level1-workstation