mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
Merge pull request #83 from ansible-lockdown/template_and_secrets
Template and secrets
This commit is contained in:
uk-bolly
GitHub
commit
5bedad6472
22 changed files with 29 additions and 110 deletions
|
|
@ -109,6 +109,12 @@
|
|||
},
|
||||
{
|
||||
"path": "detect_secrets.filters.heuristic.is_templated_secret"
|
||||
},
|
||||
{
|
||||
"path": "detect_secrets.filters.regex.should_exclude_file",
|
||||
"pattern": [
|
||||
".config/.gitleaks-report.json"
|
||||
]
|
||||
}
|
||||
],
|
||||
"results": {
|
||||
|
|
@ -166,5 +172,5 @@
|
|||
}
|
||||
]
|
||||
},
|
||||
"generated_at": "2023-08-07T15:38:18Z"
|
||||
"generated_at": "2023-08-09T08:11:03Z"
|
||||
}
|
||||
|
|
|
|||
34
.github/ISSUE_TEMPLATE/bug_report.md
vendored
34
.github/ISSUE_TEMPLATE/bug_report.md
vendored
|
|
@ -1,34 +0,0 @@
|
|||
---
|
||||
name: Report Issue
|
||||
about: Create a bug issue ticket to help us improve
|
||||
title: ''
|
||||
labels: bug
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Describe the Issue**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**Expected Behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Actual Behavior**
|
||||
A clear and concise description of what's happening.
|
||||
|
||||
**Control(s) Affected**
|
||||
What controls are being affected by the issue
|
||||
|
||||
**Environment (please complete the following information):**
|
||||
|
||||
- branch being used: [e.g. devel]
|
||||
- Ansible Version: [e.g. 2.10]
|
||||
- Host Python Version: [e.g. Python 3.7.6]
|
||||
- Ansible Server Python Version: [e.g. Python 3.7.6]
|
||||
- Additional Details:
|
||||
|
||||
**Additional Notes**
|
||||
Anything additional goes here
|
||||
|
||||
**Possible Solution**
|
||||
Enter a suggested fix here
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
---
|
||||
name: Feature Request or Enhancement
|
||||
about: Suggest an idea for this project
|
||||
title: ''
|
||||
labels: enhancement
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
## Feature Request or Enhancement
|
||||
|
||||
- Feature []
|
||||
- Enhancement []
|
||||
|
||||
**Summary of Request**
|
||||
A clear and concise description of what you want to happen.
|
||||
|
||||
**Describe alternatives you've considered**
|
||||
A clear and concise description of any alternative solutions or features you've considered.
|
||||
|
||||
**Suggested Code**
|
||||
Please provide any code you have in mind to fulfill the request
|
||||
18
.github/ISSUE_TEMPLATE/question.md
vendored
18
.github/ISSUE_TEMPLATE/question.md
vendored
|
|
@ -1,18 +0,0 @@
|
|||
---
|
||||
name: Question
|
||||
about: Ask away.......
|
||||
title: ''
|
||||
labels: question
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Question**
|
||||
Pose question here.
|
||||
|
||||
**Environment (please complete the following information):**
|
||||
|
||||
- Ansible Version: [e.g. 2.10]
|
||||
- Host Python Version: [e.g. Python 3.7.6]
|
||||
- Ansible Server Python Version: [e.g. Python 3.7.6]
|
||||
- Additional Details:
|
||||
12
.github/pull_request_template.md
vendored
12
.github/pull_request_template.md
vendored
|
|
@ -1,12 +0,0 @@
|
|||
**Overall Review of Changes:**
|
||||
A general description of the changes made that are being requested for merge
|
||||
|
||||
**Issue Fixes:**
|
||||
Please list (using linking) any open issues this PR addresses
|
||||
|
||||
**Enhancements:**
|
||||
Please list any enhancements/features that are not open issue tickets
|
||||
|
||||
**How has this been tested?:**
|
||||
Please give an overview of how these changes were tested. If they were not please use N/A
|
||||
|
||||
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -12,7 +12,7 @@ delete*
|
|||
ignore*
|
||||
test_inv
|
||||
# temp remove doc while this is built up
|
||||
doc/
|
||||
doc/
|
||||
# VSCode
|
||||
.vscode
|
||||
|
||||
|
|
|
|||
|
|
@ -33,15 +33,14 @@ repos:
|
|||
rev: v1.4.0
|
||||
hooks:
|
||||
- id: detect-secrets
|
||||
args: ['--baseline', '.config/.secrets.baseline']
|
||||
exclude: package.lock.json
|
||||
|
||||
args: [ '--baseline', '.config/.secrets.baseline' ]
|
||||
exclude: .config/.gitleaks-report.json
|
||||
|
||||
- repo: https://github.com/gitleaks/gitleaks
|
||||
rev: v8.17.0
|
||||
hooks:
|
||||
- id: gitleaks
|
||||
args: ['--baseline-path','.config/.gitleaks-report.json']
|
||||
args: ['--baseline-path', '.config/.gitleaks-report.json']
|
||||
|
||||
- repo: https://github.com/ansible-community/ansible-lint
|
||||
rev: v6.17.2
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@
|
|||
[](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/main_pipeline_validation.yml)
|
||||
|
||||
[](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/devel_pipeline_validation.yml)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
|
||||
- name: "1.2.1 | AUDIT | Ensure GPG keys are configured | expected keys fail"
|
||||
ansible.builtin.fail:
|
||||
msg: Installed GPG Keys do not meet expected values or keys installed that are not expected
|
||||
msg: Installed GPG Keys do not meet expected values or expected keys are not installed
|
||||
when:
|
||||
- os_installed_pub_keys.rc == 1 or
|
||||
os_gpg_key_check.rc == 1
|
||||
|
|
|
|||
|
|
@ -486,7 +486,7 @@ rhel9cis_authselect_custom_profile_create: {{ rhel9cis_authselect_custom_profile
|
|||
|
||||
# 5.5.1
|
||||
## PAM
|
||||
rhel9cis_pam_password:
|
||||
rhel9cis_pam_password:
|
||||
minlen: {{ rhel9cis_pam_password['minlen'] }}
|
||||
minclass: {{ rhel9cis_pam_password['minclass'] }}
|
||||
rhel9cis_pam_passwd_retry: "3"
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
### YOUR CHANGES WILL BE LOST!
|
||||
|
||||
# This file contains users whose actions are not logged by auditd
|
||||
{% if rhel9cis_allow_auditd_uid_user_exclusions %}
|
||||
{% if rhel9cis_allow_auditd_uid_user_exclusions %}
|
||||
{% for user in rhel9cis_auditd_uid_exclude %}
|
||||
-a never,user -F uid!={{ user }} -F auid!={{ user }}
|
||||
{% endfor %}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
### YOUR CHANGES WILL BE LOST!
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Run AIDE integrity check
|
||||
# Run AIDE integrity check
|
||||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
### YOUR CHANGES WILL BE LOST!
|
||||
# CIS 1.3.2
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
# Lock desktop media-handling automount setting
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
# Lock desktop media-handling settings
|
||||
# Lock desktop media-handling settings
|
||||
/org/gnome/desktop/media-handling/autorun-never
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
[org/gnome/desktop/media-handling]
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
[org/gnome/desktop/media-handling]
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
# Specify the dconf path
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
# Lock desktop screensaver idle-delay setting
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
## Ansible controlled file
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# Added as part of ansible-lockdown CIS baseline
|
||||
# provided by MindPointGroup LLC
|
||||
|
||||
[org/gnome/login-screen]
|
||||
|
|
|
|||
|
|
@ -2,6 +2,6 @@
|
|||
|
||||
# IPv6 disable
|
||||
{% if rhel9cis_rule_3_1_1 and rhel9cis_ipv6_required %}
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.all.disable_ipv6 = 1
|
||||
net.ipv6.conf.default.disable_ipv6 = 1
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -18,4 +18,4 @@ net.ipv6.conf.default.accept_redirects = 0
|
|||
net.ipv6.conf.all.accept_ra = 0
|
||||
net.ipv6.conf.default.accept_ra = 0
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue