From 71206432be548ed4993dd54308b406d0a9b311b0 Mon Sep 17 00:00:00 2001 From: Frederick Witty Date: Wed, 11 Feb 2026 14:54:30 -0500 Subject: [PATCH] QA fixes and rollback of audit_only logic Signed-off-by: Frederick Witty --- defaults/main.yml | 4 ---- tasks/audit_only.yml | 24 ------------------------ tasks/prelim.yml | 6 +++--- tasks/section_3/cis_3.1.x.yml | 2 +- tasks/section_6/cis_6.2.3.x.yml | 6 +++--- templates/ansible_vars_goss.yml.j2 | 4 ++-- 6 files changed, 9 insertions(+), 37 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 8d5f907..7f83a59 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -86,9 +86,6 @@ audit_max_concurrent: 50 ## Only run Audit do not remediate audit_only: false -### As part of audit_only ### -# Path to copy the files to will create dir structure in audit_only mode -audit_capture_files_dir: /some/location to copy to on control node ############################# # How to retrieve audit binary @@ -385,7 +382,6 @@ rhel9cis_rule_5_3_3_2_4: true rhel9cis_rule_5_3_3_2_5: true rhel9cis_rule_5_3_3_2_6: true rhel9cis_rule_5_3_3_2_7: true -rhel9cis_rule_5_3_3_2_8: true # 5.3.3.3 Configure pam_pwhistory module # These are added as part of 5.3.2.4 using jinja2 template rhel9cis_rule_5_3_3_3_1: true diff --git a/tasks/audit_only.yml b/tasks/audit_only.yml index 38b017f..a33cb94 100644 --- a/tasks/audit_only.yml +++ b/tasks/audit_only.yml @@ -7,30 +7,6 @@ ansible.builtin.import_tasks: file: fetch_audit_output.yml -- name: Audit_only | Capture audit files to control node - when: - - audit_only - - audit_capture_files_dir is defined - - audit_capture_files_dir | length > 0 - block: - - name: Audit_only | Ensure capture directory exists - ansible.builtin.file: - path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}" - state: directory - mode: 'u=rwx,go=rx' - become: false - delegate_to: localhost - - - name: Audit_only | Copy audit files to capture directory - ansible.builtin.fetch: - src: "{{ item }}" - dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/" - flat: true - failed_when: false - loop: - - "{{ pre_audit_outfile }}" - - "{{ post_audit_outfile }}" - - name: Audit_only | Show Audit Summary when: audit_only ansible.builtin.debug: diff --git a/tasks/prelim.yml b/tasks/prelim.yml index 0b56125..09e3620 100644 --- a/tasks/prelim.yml +++ b/tasks/prelim.yml @@ -214,15 +214,15 @@ block: - name: "PRELIM | AUDIT | Discover is wireless adapter on system" ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless - register: discover_wireless_adapters + register: prelim_wireless_adapters changed_when: false check_mode: false - failed_when: discover_wireless_adapters.rc not in [ 0, 1 ] + failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ] - name: "PRELIM | PATCH | Install Network-Manager | if wireless adapter present" when: - rhel9cis_install_network_manager - - discover_wireless_adapters.rc == 0 + - prelim_wireless_adapters.rc == 0 - "'NetworkManager' not in ansible_facts.packages" ansible.builtin.package: name: NetworkManager diff --git a/tasks/section_3/cis_3.1.x.yml b/tasks/section_3/cis_3.1.x.yml index 7099e55..b6bff9d 100644 --- a/tasks/section_3/cis_3.1.x.yml +++ b/tasks/section_3/cis_3.1.x.yml @@ -44,7 +44,7 @@ - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled" when: - rhel9cis_rule_3_1_2 - - discover_wireless_adapters.rc == 0 + - prelim_wireless_adapters.rc == 0 tags: - level1-server - patch diff --git a/tasks/section_6/cis_6.2.3.x.yml b/tasks/section_6/cis_6.2.3.x.yml index eaa3bd1..42c7725 100644 --- a/tasks/section_6/cis_6.2.3.x.yml +++ b/tasks/section_6/cis_6.2.3.x.yml @@ -195,7 +195,7 @@ register: discovered_rsyslog_remote_host notify: Restart rsyslog -- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client" +- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client" when: rhel9cis_rule_6_2_3_7 tags: - level1-server @@ -208,7 +208,7 @@ - NIST800-53R5_AU-12 - NIST800-53R5_CM-6 block: - - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host" + - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client. | When not log host" when: not rhel9cis_system_is_log_server ansible.builtin.replace: path: /etc/rsyslog.conf @@ -221,7 +221,7 @@ - '^(module\(load="imtcp"\))' - '^(input\(type="imtcp")' - - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host" + - name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote clients. | When log host" when: rhel9cis_system_is_log_server ansible.builtin.replace: path: /etc/rsyslog.conf diff --git a/templates/ansible_vars_goss.yml.j2 b/templates/ansible_vars_goss.yml.j2 index abc374c..a0343ee 100644 --- a/templates/ansible_vars_goss.yml.j2 +++ b/templates/ansible_vars_goss.yml.j2 @@ -206,7 +206,6 @@ rhel9cis_rule_2_4_2_1: {{ rhel9cis_rule_2_4_2_1 }} rhel9cis_rule_3_1_1: {{ rhel9cis_rule_3_1_1 }} rhel9cis_rule_3_1_2: {{ rhel9cis_rule_3_1_2 }} rhel9cis_rule_3_1_3: {{ rhel9cis_rule_3_1_3 }} -rhel9cis_ipv6_disable_method: {{ rhel9cis_ipv6_disable_method }} ## Network Kernel Modules rhel9cis_rule_3_2_1: {{ rhel9cis_rule_3_2_1 }} @@ -293,7 +292,6 @@ rhel9cis_rule_5_3_3_2_4: {{ rhel9cis_rule_5_3_3_2_4 }} rhel9cis_rule_5_3_3_2_5: {{ rhel9cis_rule_5_3_3_2_5 }} rhel9cis_rule_5_3_3_2_6: {{ rhel9cis_rule_5_3_3_2_6 }} rhel9cis_rule_5_3_3_2_7: {{ rhel9cis_rule_5_3_3_2_7 }} -rhel9cis_rule_5_3_3_2_8: {{ rhel9cis_rule_5_3_3_2_8 }} # 5.3.3.3 Configure pam_pwhistory module # This are added as part of 5.3.2.4 using jinja2 template rhel9cis_rule_5_3_3_3_1: {{ rhel9cis_rule_5_3_3_3_1 }} @@ -532,6 +530,8 @@ rhel9cis_bluetooth_mask: {{ rhel9cis_bluetooth_mask }} ## 3.1 IPv6 requirement toggle # This variable governs whether ipv6 is enabled or disabled. rhel9cis_ipv6_required: {{ rhel9cis_ipv6_required }} +# rhel9cis_ipv6_disable defines the method of disabling IPv6, sysctl vs kernel +rhel9cis_ipv6_disable_method: {{ rhel9cis_ipv6_disable_method }} # 3.3 System network parameters (host only OR host and router) # This variable governs whether specific CIS rules