ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #3 from ansible-lockdown/rh8_#148

Browse source 
adaptions of RH8 issues
This commit is contained in:
uk-bolly 2022-02-02 09:53:09 +00:00 • committed by GitHub
commit 4c70eb12fe
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
16 changed files with 136 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

11
defaults/main.yml
View file

@ -8,6 +8,9 @@ container_vars_file: is_container.yml
# system_is_ec2 toggle will disable tasks that fail on Amazon EC2 instances. Set true to skip and false to run tasks # system_is_ec2 toggle will disable tasks that fail on Amazon EC2 instances. Set true to skip and false to run tasks
system_is_ec2: false system_is_ec2: false
# Run the OS validation check
os_check: true
rhel9cis_notauto: false rhel9cis_notauto: false
rhel9cis_section1: true rhel9cis_section1: true
rhel9cis_section2: true rhel9cis_section2: true
@ -546,8 +549,12 @@ rhel9cis_pam_password:
minlen: "14" minlen: "14"
minclass: "4" minclass: "4"
# Starting GID for interactive users # UID settings for interactive users
rhel9cis_int_gid: 1000 # These are discovered via logins.def is set true
discover_int_uid: false
min_int_uid: 1000
max_int_uid: 65533
# RHEL-09-5.4.5 # RHEL-09-5.4.5
# Session timeout setting file (TMOUT setting can be set in multiple files) # Session timeout setting file (TMOUT setting can be set in multiple files)

33
tasks/main.yml
View file

@ -1,21 +1,22 @@
--- ---
# tasks file for RHEL9-CIS # tasks file for RHEL9-CIS
- name: Check OS version and family - name: Check OS version and family
assert: assert:
that: that: (ansible_os_family == 'RedHat' or ansible_os_family == "Rocky") and ansible_distribution_major_version is version_compare('8', '==')
- (ansible_os_family == 'RedHat' or ansible_os_family == "Rocky") fail_msg: "This role can only be run against RHEL8 family OSs. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported."
- ansible_distribution_major_version |int >= 8 success_msg: "This role is running against a supported OS {{ ansible_distribution }} {{ ansible_distribution_major_version }}"
fail_msg: "This role can only be run against RHEL 8 or 9. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported." when:
success_msg: "Supported OS release and version" - os_check
- not system_is_ec2
tags: tags:
- always - always
- name: Check ansible version - name: Check ansible version
assert: assert:
that: that: ansible_version.full is version_compare(min_ansible_version, '>=')
- "ansible_version.full is version_compare ('2.9', '>=')" fail_msg: "You must use Ansible {{ min_ansible_version }} or greater"
fail_msg: "You must use ansible 2.9 or greater" success_msg: "This role is running a supported version of ansible {{ ansible_version.full }} >= {{ min_ansible_version }}"
success_msg: "Supported ansible_version"
tags: tags:
- always - always
@ -83,15 +84,19 @@
tags: tags:
- always - always
- name: Include OS specific variables
include_vars: "{{ ansible_distribution }}.yml"
tags:
- always
- name: Include preliminary steps - name: Include preliminary steps
import_tasks: prelim.yml import_tasks: prelim.yml
become:
tags: tags:
- prelim_tasks - prelim_tasks
- always - always
- name: run pre_remediation audit - name: run pre_remediation audit
import_tasks: pre_remediation_audit.yml include_tasks: pre_remediation_audit.yml
when: when:
- run_audit - run_audit
@ -103,8 +108,12 @@
- name: capture /etc/password variables - name: capture /etc/password variables
include_tasks: parse_etc_password.yml include_tasks: parse_etc_password.yml
when: rhel9cis_section6 when:
- rhel9cis_section6
tags: tags:
- rule_5.5.2
- rule_6.2.7
- rule_6.2.20
- rhel9cis_section6 - rhel9cis_section6
- name: run Section 1 tasks - name: run Section 1 tasks

29
tasks/prelim.yml
View file

@ -190,3 +190,32 @@
tags: tags:
- rule_1.2.2 - rule_1.2.2
- skip_ansible_lint - skip_ansible_lint
- name: "PRELIM | AUDIT | Discover Interactive UID MIN and MIN from logins.def"
block:
- name: "PRELIM | AUDIT | Capture UID_MIN information from logins.def"
shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: uid_min_id
- name: "PRELIM | AUDIT | Capture UID_MAX information from logins.def"
shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: uid_max_id
- name: "PRELIM | AUDIT | Capture GID_MIN information from logins.def"
shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: gid_min_id
- name: "PRELIM | AUDIT | set_facts for interactive uid/gid"
set_fact:
min_int_uid: "{{ uid_min_id.stdout }}"
max_int_uid: "{{ uid_max_id.stdout }}"
min_int_gid: "{{ gid_min_id.stdout }}"
- debug:
msg: "{{ min_int_uid }} {{ max_int_uid }}"
when:
- not discover_int_uid

2
tasks/section_1/cis_1.2.x.yml
View file

@ -37,7 +37,7 @@
- rule_1.2.2 - rule_1.2.2
- name: "1.2.3 | L1 | AUDIT | Ensure GPG keys are configured" - name: "1.2.3 | L1 | AUDIT | Ensure GPG keys are configured"
shell: gpg --quiet --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-{{ ansible_distribution|lower }}-release shell: gpg --quiet --with-fingerprint "{{ rpm_gpg_key }}"
args: args:
warn: false warn: false
when: when:

24
tasks/section_1/main.yml
View file

@ -2,41 +2,41 @@
- name: "SECTION | 1.1 | FileSystem Configurations\n - name: "SECTION | 1.1 | FileSystem Configurations\n
SECTION | 1.1.1.x | Disable unused filesystems" SECTION | 1.1.1.x | Disable unused filesystems"
include_tasks: cis_1.1.1.x.yml import_tasks: cis_1.1.1.x.yml
- include_tasks: cis_1.1.x.yml - import_tasks: cis_1.1.x.yml
- name: "SECTION | 1.2 | Configure Software Updates" - name: "SECTION | 1.2 | Configure Software Updates"
include_tasks: cis_1.2.x.yml import_tasks: cis_1.2.x.yml
- name: "SECTION | 1.3 | Configure sudo" - name: "SECTION | 1.3 | Configure sudo"
include_tasks: cis_1.3.x.yml import_tasks: cis_1.3.x.yml
- name: "SECTION | 1.4 | Filesystem Integrity" - name: "SECTION | 1.4 | Filesystem Integrity"
import_tasks: cis_1.4.x.yml include_tasks: cis_1.4.x.yml
when: rhel9cis_config_aide when: rhel9cis_config_aide
- name: "SECTION | 1.5 | Secure Boot Settings" - name: "SECTION | 1.5 | Secure Boot Settings"
include_tasks: cis_1.5.x.yml import_tasks: cis_1.5.x.yml
- name: "SECTION | 1.6 | Additional Process Hardening" - name: "SECTION | 1.6 | Additional Process Hardening"
include_tasks: cis_1.6.x.yml import_tasks: cis_1.6.x.yml
- name: "SECTION | 1.7 | bootloader and Mandatory Access Control" - name: "SECTION | 1.7 | bootloader and Mandatory Access Control"
import_tasks: cis_1.7.1.x.yml include_tasks: cis_1.7.1.x.yml
when: not rhel9cis_selinux_disable when: not rhel9cis_selinux_disable
- name: "SECTION | 1.8 | Warning Banners" - name: "SECTION | 1.8 | Warning Banners"
include_tasks: cis_1.8.1.x.yml import_tasks: cis_1.8.1.x.yml
- name: "SECTION | 1.9 | Updated and Patches" - name: "SECTION | 1.9 | Updated and Patches"
include_tasks: cis_1.9.yml import_tasks: cis_1.9.yml
- name: "SECTION | 1.10 | Crypto policies" - name: "SECTION | 1.10 | Crypto policies"
import_tasks: cis_1.10.yml include_tasks: cis_1.10.yml
when: when:
- not system_is_ec2 - not system_is_ec2
- name: "SECTION | 1.11 | FIPS/FUTURE Crypto policies" - name: "SECTION | 1.11 | FIPS/FUTURE Crypto policies"
import_tasks: cis_1.11.yml include_tasks: cis_1.11.yml
when: when:
- not system_is_ec2 - not system_is_ec2

8
tasks/section_2/main.yml
View file

@ -1,13 +1,13 @@
--- ---
- name: "SECTION | 2.1 | xinetd" - name: "SECTION | 2.1 | xinetd"
include_tasks: cis_2.1.1.yml import_tasks: cis_2.1.1.yml
- name: "SECTION | 2.2.1 | Time Synchronization" - name: "SECTION | 2.2.1 | Time Synchronization"
include_tasks: cis_2.2.1.x.yml import_tasks: cis_2.2.1.x.yml
- name: "SECTION | 2.2 | Special Purpose Services" - name: "SECTION | 2.2 | Special Purpose Services"
include_tasks: cis_2.2.x.yml import_tasks: cis_2.2.x.yml
- name: "SECTION | 2.3 | Service Clients" - name: "SECTION | 2.3 | Service Clients"
include_tasks: cis_2.3.x.yml import_tasks: cis_2.3.x.yml

20
tasks/section_3/main.yml
View file

@ -1,41 +1,41 @@
--- ---
- name: "SECTION | 3.1.x | Packet and IP redirection" - name: "SECTION | 3.1.x | Packet and IP redirection"
include_tasks: cis_3.1.x.yml import_tasks: cis_3.1.x.yml
- name: "SECTION | 3.2.x | Network Parameters (Host Only)" - name: "SECTION | 3.2.x | Network Parameters (Host Only)"
include_tasks: cis_3.2.x.yml import_tasks: cis_3.2.x.yml
- name: "SECTION | 3.3.x | Uncommon Network Protocols" - name: "SECTION | 3.3.x | Uncommon Network Protocols"
include_tasks: cis_3.3.x.yml import_tasks: cis_3.3.x.yml
- name: "SECTION | 3.4.1.x | firewall defined" - name: "SECTION | 3.4.1.x | firewall defined"
include_tasks: cis_3.4.1.1.yml import_tasks: cis_3.4.1.1.yml
- name: "SECTION | 3.4.2.x | firewalld firewall" - name: "SECTION | 3.4.2.x | firewalld firewall"
import_tasks: cis_3.4.2.x.yml include_tasks: cis_3.4.2.x.yml
when: when:
- rhel9cis_firewall == "firewalld" - rhel9cis_firewall == "firewalld"
- name: "SECTION | 3.4.3.x | Configure nftables firewall" - name: "SECTION | 3.4.3.x | Configure nftables firewall"
import_tasks: cis_3.4.3.x.yml include_tasks: cis_3.4.3.x.yml
when: when:
- rhel9cis_firewall == "nftables" - rhel9cis_firewall == "nftables"
- name: "SECTION | 3.4.4.1.x | Configure iptables IPv4" - name: "SECTION | 3.4.4.1.x | Configure iptables IPv4"
import_tasks: cis_3.4.4.1.x.yml include_tasks: cis_3.4.4.1.x.yml
when: when:
- rhel9cis_firewall == "iptables" - rhel9cis_firewall == "iptables"
- name: "SECTION | 3.4.4.2.x | Configure iptables IPv6" - name: "SECTION | 3.4.4.2.x | Configure iptables IPv6"
import_tasks: cis_3.4.4.2.x.yml include_tasks: cis_3.4.4.2.x.yml
when: when:
- ( rhel9cis_firewall == "iptables" and rhel9cis_ipv6_required ) - ( rhel9cis_firewall == "iptables" and rhel9cis_ipv6_required )
- name: "SECTION | 3.5 | Configure wireless" - name: "SECTION | 3.5 | Configure wireless"
include_tasks: cis_3.5.yml import_tasks: cis_3.5.yml
- name: "SECTION | 3.5 | disable IPv6" - name: "SECTION | 3.5 | disable IPv6"
import_tasks: cis_3.5.yml include_tasks: cis_3.5.yml
when: when:
- not rhel9cis_ipv6_required - not rhel9cis_ipv6_required

10
tasks/section_4/main.yml
View file

@ -6,20 +6,20 @@
- not system_is_container - not system_is_container
- name: "SECTION | 4.1.2.x| Configure Data Retention" - name: "SECTION | 4.1.2.x| Configure Data Retention"
include_tasks: cis_4.1.2.x.yml import_tasks: cis_4.1.2.x.yml
- name: "SECTION | 4.1.x| Auditd rules" - name: "SECTION | 4.1.x| Auditd rules"
include_tasks: cis_4.1.x.yml import_tasks: cis_4.1.x.yml
- name: "SECTION | 4.2.x| Configure Logging" - name: "SECTION | 4.2.x| Configure Logging"
import_tasks: cis_4.2.1.x.yml import_tasks: cis_4.2.1.x.yml
when: rhel9cis_syslog == 'rsyslog' when: rhel9cis_syslog == 'rsyslog'
- name: "SECTION | 4.2.2.x| Configure journald" - name: "SECTION | 4.2.2.x| Configure journald"
include_tasks: cis_4.2.2.x.yml import_tasks: cis_4.2.2.x.yml
- name: "SECTION | 4.2.3 | Configure logile perms" - name: "SECTION | 4.2.3 | Configure logile perms"
include_tasks: cis_4.2.3.yml import_tasks: cis_4.2.3.yml
- name: "SECTION | 4.3 | Configure logrotate" - name: "SECTION | 4.3 | Configure logrotate"
include_tasks: cis_4.3.yml import_tasks: cis_4.3.yml

4
tasks/section_5/cis_5.5.x.yml
View file

@ -13,7 +13,7 @@
- item.id != "sync" - item.id != "sync"
- item.id != "shutdown" - item.id != "shutdown"
- item.id != "halt" - item.id != "halt"
- item.gid < rhel9cis_int_gid - item.uid < 1000
- item.shell != " /bin/false" - item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin" - item.shell != " /usr/sbin/nologin"
@ -28,7 +28,7 @@
- item.id != "shutdown" - item.id != "shutdown"
- item.id != "sync" - item.id != "sync"
- item.id != "root" - item.id != "root"
- item.gid < rhel9cis_int_gid - item.uid < 1000
- item.shell != " /bin/false" - item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin" - item.shell != " /usr/sbin/nologin"
when: when:

14
tasks/section_5/main.yml
View file

@ -1,7 +1,7 @@
--- ---
- name: "SECTION | 5.1 | Configure time-based job schedulers" - name: "SECTION | 5.1 | Configure time-based job schedulers"
include_tasks: cis_5.1.x.yml import_tasks: cis_5.1.x.yml
- name: "SECTION | 5.2 | Configure SSH Server" - name: "SECTION | 5.2 | Configure SSH Server"
include_tasks: cis_5.2.x.yml include_tasks: cis_5.2.x.yml
@ -9,21 +9,21 @@
- "'openssh-server' in ansible_facts.packages" - "'openssh-server' in ansible_facts.packages"
- name: "SECTION | 5.3 | Configure Profiles" - name: "SECTION | 5.3 | Configure Profiles"
import_tasks: cis_5.3.x.yml include_tasks: cis_5.3.x.yml
when: when:
- rhel9cis_use_authconfig - rhel9cis_use_authconfig
- name: "SECTION | 5.4 | Configure PAM " - name: "SECTION | 5.4 | Configure PAM "
include_tasks: cis_5.4.x.yml import_tasks: cis_5.4.x.yml
- name: "SECTION | 5.5.1.x | Passwords and Accounts" - name: "SECTION | 5.5.1.x | Passwords and Accounts"
include_tasks: cis_5.5.1.x.yml import_tasks: cis_5.5.1.x.yml
- name: "SECTION | 5.5.x | System Accounts and User Settings" - name: "SECTION | 5.5.x | System Accounts and User Settings"
include_tasks: cis_5.5.x.yml import_tasks: cis_5.5.x.yml
- name: "SECTION | 5.6 | Root Login" - name: "SECTION | 5.6 | Root Login"
include_tasks: cis_5.6.yml import_tasks: cis_5.6.yml
- name: Section | 5.7 | su Command Restriction - name: Section | 5.7 | su Command Restriction
include_tasks: cis_5.7.yml import_tasks: cis_5.7.yml

9
tasks/section_6/cis_6.2.x.yml
View file

@ -134,9 +134,12 @@
- name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive" - name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
stat: stat:
path: "{{ item }}" path: "{{ item }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}" with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int) | selectattr('uid', '<', max_int_uid | int) | selectattr('dir', '!=', '/') | map(attribute='dir') | list }}"
register: rhel_09_6_2_7_audit register: rhel_09_6_2_7_audit
- debug:
var: rhel_09_6_2_7_audit
- name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive" - name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
shell: find -H {{ item.0 | quote }} -not -type l -perm /027 shell: find -H {{ item.0 | quote }} -not -type l -perm /027
args: args:
@ -204,7 +207,7 @@
loop_control: loop_control:
label: "{{ rhel9cis_passwd_label }}" label: "{{ rhel9cis_passwd_label }}"
when: when:
- item.uid >= rhel9cis_int_gid - item.uid >= min_int_uid
- rhel9cis_rule_6_2_8 - rhel9cis_rule_6_2_8
tags: tags:
- skip_ansible_lint # settings found on 6_2_7 - skip_ansible_lint # settings found on 6_2_7
@ -500,7 +503,7 @@
stat: stat:
path: "{{ item }}" path: "{{ item }}"
register: rhel_09_6_2_20_audit register: rhel_09_6_2_20_audit
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}" with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int) | selectattr('uid', '<', max_int_uid | int) | selectattr('dir', '!=', '/') | map(attribute='dir') | list }}"
- name: "6.2.20 | L1 | AUDIT | Ensure all users' home directories exist" - name: "6.2.20 | L1 | AUDIT | Ensure all users' home directories exist"
shell: find -H {{ item.0 | quote }} -not -type l -perm /027 shell: find -H {{ item.0 | quote }} -not -type l -perm /027

4
tasks/section_6/main.yml
View file

@ -1,7 +1,7 @@
--- ---
- name: "SECTION | 6.1 | System File Permissions" - name: "SECTION | 6.1 | System File Permissions"
include_tasks: cis_6.1.x.yml import_tasks: cis_6.1.x.yml
- name: "SECTION | 6.2 | User and Group Settings" - name: "SECTION | 6.2 | User and Group Settings"
include_tasks: cis_6.2.x.yml import_tasks: cis_6.2.x.yml

30
templates/audit/99_auditd.rules.j2
View file

@ -32,18 +32,18 @@
-w /etc/sysconfig/network -p wa -k system-locale -w /etc/sysconfig/network -p wa -k system-locale
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_9 %} {% if rhel9cis_rule_4_1_9 %}
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k perm_mod -a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ min_int_uid }} -F auid!=4294967295 -k perm_mod
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_10 %} {% if rhel9cis_rule_4_1_10 %}
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=access
-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=access -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=access
-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=access -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=access
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_11 %} {% if rhel9cis_rule_4_1_11 %}
-w /etc/group -p wa -k identity -w /etc/group -p wa -k identity
@ -53,17 +53,17 @@
-w /etc/security/opasswd -p wa -k identity -w /etc/security/opasswd -p wa -k identity
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_12 %} {% if rhel9cis_rule_4_1_12 %}
-a always,exit -F arch=b32 -S mount -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k mounts -a always,exit -F arch=b32 -S mount -F auid>={{ min_int_uid }} -F auid!=4294967295 -k mounts
-a always,exit -F arch=b64 -S mount -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k mounts -a always,exit -F arch=b64 -S mount -F auid>={{ min_int_uid }} -F auid!=4294967295 -k mounts
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_13 %} {% if rhel9cis_rule_4_1_13 %}
{% for proc in priv_procs.stdout_lines -%} {% for proc in priv_procs.stdout_lines -%}
-a always,exit -F path={{ proc }} -F perm=x -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -k privileged -a always,exit -F path={{ proc }} -F perm=x -F auid>={{ min_int_uid }} -F auid!=4294967295 -k privileged
{% endfor %} {% endfor %}
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_14 %} {% if rhel9cis_rule_4_1_14 %}
-a always,exit -F arch=b32 -S rmdir,unlink,unlinkat,rename -S renameat -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=delete -a always,exit -F arch=b32 -S rmdir,unlink,unlinkat,rename -S renameat -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=delete
-a always,exit -F arch=b64 -S rmdir,unlink,unlinkat,rename -S renameat -F auid>={{ rhel9cis_int_gid }} -F auid!=4294967295 -F key=delete -a always,exit -F arch=b64 -S rmdir,unlink,unlinkat,rename -S renameat -F auid>={{ min_int_uid }} -F auid!=4294967295 -F key=delete
{% endif %} {% endif %}
{% if rhel9cis_rule_4_1_15 %} {% if rhel9cis_rule_4_1_15 %}
-w /usr/sbin/insmod -p x -k modules -w /usr/sbin/insmod -p x -k modules

4
vars/RedHat.yml Normal file
View file

@ -0,0 +1,4 @@
---
# OS Specific Settings
rpm_gpg_key: /etc/pki/rpm-gpg/RPM-GPG-KEY-{{ ansible_distribution|lower }}-official

4
vars/Rocky.yml Normal file
View file

@ -0,0 +1,4 @@
---
# OS Specific Settings
rpm_gpg_key: /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial

2
vars/main.yml
View file

@ -1,5 +1,7 @@
--- ---
# vars file for RHEL9-CIS # vars file for RHEL9-CIS
min_ansible_version: 2.9
rhel9cis_allowed_crypto_policies: rhel9cis_allowed_crypto_policies:
- 'FUTURE' - 'FUTURE'
- 'FIPS' - 'FIPS'