ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge pull request #12 from ansible-lockdown/lint_dec24

Browse source 
Lint dec24
This commit is contained in:
uk-bolly 2024-12-11 13:40:01 +00:00 • committed by GitHub
commit 7a49778b1d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
73 changed files with 570 additions and 797 deletions
Download patch file Download diff file Expand all files Collapse all files

17
.ansible-lint
View file

@ -3,20 +3,7 @@
parseable: true
quiet: true
skip_list:
- 'schema'
- 'no-changed-when'
- 'var-spacing'
- 'experimental'
- 'name[play]'
- 'name[casing]'
- 'name[template]'
- 'key-order[task]'
- '204'
- '305'
- '303'
- '403'
- '306'
- '602'
- '208'
- 'package-latest'
- 'risky-shell-pipe'
use_default_rules: true
verbosity: 0

22
.yamllint
View file

@ -1,32 +1,38 @@
---
extends: default
locale: en_US.UTF-8
ignore: |
tests/
molecule/
.github/
.gitlab-ci.yml
*molecule.yml
rules:
indentation:
# Requiring 4 space indentation
spaces: 2
# Requiring consistent indentation within a file, either indented or not
indent-sequences: consistent
braces:
max-spaces-inside: 1
level: error
brackets:
max-spaces-inside: 1
level: error
comments:
ignore-shebangs: true
min-spaces-from-content: 1 # prettier compatibility
comments-indentation: enable
empty-lines:
max: 1
line-length: disable
indentation:
# Requiring 2 space indentation
spaces: 2
# Requiring consistent indentation within a file, either indented or not
indent-sequences: consistent
key-duplicates: enable
line-length: disable
new-line-at-end-of-file: enable
new-lines:
type: unix
octal-values:
forbid-implicit-octal: true # yamllint defaults to false
forbid-explicit-octal: true
trailing-spaces: enable
truthy:
allowed-values: ['true', 'false']

2
LICENSE
View file

@ -1,6 +1,6 @@
MIT License
Copyright (c) 2023 Mindpoint Group / Lockdown Enterprise / Lockdown Enterprise Releases
Copyright (c) 2025 Mindpoint Group - A Tyto Athene Company / Ansible Lockdown
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal

131
README.md
View file

@ -2,7 +2,7 @@
## Configure a RHEL 9 machine to be [CIS](https://www.cisecurity.org/cis-benchmarks/) compliant
### Based on [ CIS RedHat Enterprise Linux 9 Benchmark v2.0.0 ](https://www.cisecurity.org/cis-benchmarks/)
### Based on [CIS RedHat Enterprise Linux 9 Benchmark v2.0.0](https://www.cisecurity.org/cis-benchmarks/)
---
@ -32,65 +32,82 @@
---
## Looking for support?
[Lockdown Enterprise](https://www.lockdownenterprise.com#GH_AL_RH9_cis)
[Ansible support](https://www.mindpointgroup.com/cybersecurity-products/ansible-counselor#GH_AL_RH9_cis)
### Community
Join us on our [Discord Server](https://www.lockdownenterprise.com/discord) to ask questions, discuss features, or just chat with other Ansible-Lockdown users.
### Contributing
Issues and Pull requests are welcome please ensure that all commits are signed-off-by and gpg-signed.
Refer to [Contributing Guide](./CONTRIBUTING.rst)
---
## Caution(s)
This role **will make changes to the system** which may have unintended consequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.
Check Mode is not supported! The role will complete in check mode without errors, but it is not supported and should be used with caution. The RHEL9-CIS-Audit role or a compliance scanner should be used for compliance checking over check mode.
- Testing is the most important thing you can do.
This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review this role for any site specific changes that are needed.
- Check Mode is not supported! The role will complete in check mode without errors, but it is not supported and should be used with caution. The RHEL9-CIS-Audit role or a compliance scanner should be used for compliance checking over check mode.
To use the release version, please point to the `main` branch and relevant release for the cis benchmark you wish to work with.
- This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review this role for any site specific changes that are needed.
- To use release version please point to main branch and relevant release/tag for the cis benchmark you wish to work with.
- If moving across major releases e.g. v2.0.0 - v3.0.0 there are significant changes to the benchmarks and controls it is suggested to start as a new standard not to upgrade.
- Containers references vars/is_container.yml this is an example and to be updated for your requirements
- Did we mention testing??
---
## Matching a security Level for CIS
It is possible to only run level 1 or level 2 controls for CIS.
It is possible to to only run level 1 or level 2 controls for CIS.
This is managed using tags:
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- level1_server
- level1_workstation
- level2_server
- level2_workstation
The control found in the `defaults` main also needs to reflect this, as this control is the testing that takes place if you are using the audit component.
The control found in defaults main also need to reflect this as this control the testing thet takes place if you are using the audit component.
## Coming from a previous release
CIS release always contains changes, it is highly recommended to review the new references and available variables. This has changed significantly since the ansible-lockdown initial release.
This is now compatible with python3 if it is found to be the default interpreter. This does come with prerequisites which configure the system accordingly.
CIS release always contains changes, it is highly recommended to review the new references and available variables. This have changed significantly since ansible-lockdown initial release.
This is now compatible with python3 if it is found to be the default interpreter. This does come with pre-requisites which it configures the system accordingly.
Further details can be seen in the [Changelog](./ChangeLog.md)
## Auditing (new)
This can be turned on or off within the `defaults/main.yml` file with the variables `setup_audit` and `run_audit`. The value is `false` by default. Please refer to the wiki for more details. The defaults file also populates the goss checks to check only the controls that have been enabled in the ansible role.
This can be turned on or off within the defaults/main.yml file with the variable run_audit. The value is false by default, please refer to the wiki for more details. The defaults file also populates the goss checks to check only the controls that have been enabled in the ansible role.
This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.
A new form of auditing has been developed by using a small (12MB) go binary called [goss](https://github.com/goss-org/goss) along with the relevant configurations to check without the need for infrastructure or other tooling.
This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also try to remove [false positives](https://www.mindpointgroup.com/blog/is-compliance-scanning-still-relevant/) in the process.
A new form of auditing has been developed, by using a small (12MB) go binary called [goss](https://github.com/goss-org/goss) along with the relevant configurations to check. Without the need for infrastructure or other tooling.
This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove [false positives](https://www.mindpointgroup.com/blog/is-compliance-scanning-still-relevant/) in the process.
Refer to [RHEL9-CIS-Audit](https://github.com/ansible-lockdown/RHEL9-CIS-Audit).
## Example Audit Summary
This is based on a vagrant image with selections enabled. e.g. No Gui or firewall.
Note: More tests are run during audit as we check config and running state.
```txt
ok: [default] => {
"msg": [
"The pre remediation results are: ['Total Duration: 5.454s', 'Count: 338, Failed: 47, Skipped: 5'].",
"The post remediation results are: ['Total Duration: 5.007s', 'Count: 338, Failed: 46, Skipped: 5'].",
"Full breakdown can be found in /var/tmp",
""
]
}
PLAY RECAP *******************************************************************************************************************************************
default : ok=270 changed=23 unreachable=0 failed=0 skipped=140 rescued=0 ignored=0
```
## Documentation
- [Read The Docs](https://ansible-lockdown.readthedocs.io/en/latest/)
@ -101,19 +118,6 @@ Refer to [RHEL9-CIS-Audit](https://github.com/ansible-lockdown/RHEL9-CIS-Audit).
## Requirements
RHEL 9
Almalinux 9
Rocky 9
OracleLinux 9
- Access to download or add the goss binary and content to the system if using auditing (other options are available on how to get the content to the system.)
CentOS stream - while this will generally work it is not supported and requires the following variable setting
```sh
os_check: false
```
**General:**
- Basic knowledge of Ansible, below are some links to the Ansible documentation to help get started if you are unfamiliar with Ansible
@ -123,23 +127,22 @@ os_check: false
- [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html)
- [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html)
- Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.
- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file.
- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consequences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file.
**Technical Dependencies:**
- Python3
- Ansible 2.12+
- python-def (should be included in RHEL 9)
- libselinux-python
- pip packages
- jmespath
- collections found in collections/requirements.yml
RHEL/AlmaLinux/Rocky/Oracle 9 - Other versions are not supported.
pre-commit is available if installed on your host for pull request testing.
- Access to download or add the goss binary and content to the system if using auditing
(other options are available on how to get the content to the system.)
- Python3.8
- Ansible 2.12+
- python-def
- libselinux-python
## Role Variables
This role is designed that the end user should not have to edit the tasks themselves. All customizing should be done by overriding the required varaibles as found in defaults/main.yml file. e.g. using inventory, group_vars, extra_vars
This role is designed that the end user should not have to edit the tasks themselves. All customizing should be done via the defaults/main.yml file or with extra vars within the project, job, workflow, etc.
## Tags
@ -169,10 +172,7 @@ We encourage you (the community) to contribute to this role. Please read the rul
## Known Issues
CIS 1.2.4 - repo_gpgcheck is not carried out for RedHat hosts as the default repos do not have this function. This also affect EPEL(not covered by var).
- Rocky and Alma not affected.
Variable used to unset.
rhel9cis_rhel_default_repo: true # to be set to false if using repo that does have this ability
Almalinux BaseOS, EPEL and many cloud providers repositories, do not allow gpgcheck(rule_1.2.1.2) or repo_gpgcheck (rule_1.2.1.3) this will cause issues during the playbook unless or a workaround is found.
## Pipeline Testing
@ -180,21 +180,32 @@ uses:
- ansible-core 2.12
- ansible collections - pulls in the latest version based on requirements file
- Runs the audit using the devel branch
- Runs the pre-commit setup on the PR to ensure everything is in place as expected.
- runs the audit using the devel branch
- This is an automated test that occurs on pull requests into devel
## Local Testing
- Ansible
Molecule can be used to work on this role and test in distinct _scenarios_.
- ansible-base 2.10.17 - python 3.8
- ansible-core 2.13.4 - python 3.10
- ansible-core 2.15.1 - python 3.11
### examples
```bash
molecule test -s default
molecule converge -s wsl -- --check
molecule verify -s localhost
```
local testing uses:
- ansible 2.13.3
- molecule 4.0.1
- molecule-docker 2.0.0
- molecule-podman 2.0.2
- molecule-vagrant 1.0.0
- molecule-azure 0.5.0
## Added Extras
- makefile - this is there purely for testing and initial setup purposes.
- [pre-commit](https://pre-commit.com) can be tested and can be run from within the directory
```sh

26
handlers/main.yml
View file

@ -2,7 +2,8 @@
# handlers file for RHEL9-CIS
- name: Reload sysctl
ansible.builtin.shell: sysctl --system
ansible.builtin.command: sysctl --system
changed_when: true
- name: Sysctl flush ipv4 route table
when:
@ -43,8 +44,8 @@
- name: Set Crypto Policy
when: prelim_system_wide_crypto_policy.stdout != rhel9cis_full_crypto_policy
ansible.builtin.shell: |
update-crypto-policies --set "{{ rhel9cis_full_crypto_policy }}"
ansible.builtin.command: update-crypto-policies --set "{{ rhel9cis_full_crypto_policy }}"
changed_when: true
notify:
- Change_requires_reboot
- Restart sshd
@ -65,11 +66,13 @@
state: restarted
- name: Reload dconf
ansible.builtin.shell: dconf update
ansible.builtin.command: dconf update
changed_when: true
- name: Grub2cfg
ansible.builtin.shell: "grub2-mkconfig -o /boot/grub2/grub.cfg"
ansible.builtin.command: "grub2-mkconfig -o /boot/grub2/grub.cfg"
ignore_errors: true # noqa ignore-errors
changed_when: true
- name: Restart rsyslog
ansible.builtin.systemd:
@ -91,24 +94,25 @@
daemon-reload: true
- name: Authselect update
ansible.builtin.shell: authselect apply-changes
ansible.builtin.command: authselect apply-changes
changed_when: true
## Auditd tasks note order for handlers to run
- name: Auditd immutable check
ansible.builtin.shell: grep -c "^-e 2" /etc/audit/rules.d/99_auditd.rules
ansible.builtin.command: grep -c "^-e 2" /etc/audit/rules.d/99_auditd.rules
changed_when: false
register: discovered_auditd_immutable_check
- name: Audit immutable fact
when:
- discovered_auditd_immutable_check.stdout == '1'
when: discovered_auditd_immutable_check.stdout == '1'
ansible.builtin.debug:
msg: "Reboot required for auditd to apply new rules as immutable set"
notify: Change_requires_reboot
- name: Restart auditd
ansible.builtin.shell: service auditd restart
- name: Restart auditd # noqa command-instead-of-module
ansible.builtin.command: service auditd restart
changed_when: true
- name: Change_requires_reboot
ansible.builtin.set_fact:

5
tasks/LE_audit_setup.yml
View file

@ -1,5 +1,4 @@
---
- name: Pre Audit Setup | Set audit package name
block:
- name: Pre Audit Setup | Set audit package name | 64bit
@ -20,13 +19,13 @@
owner: root
group: root
checksum: "{{ audit_bin_version[audit_pkg_arch_name + '_checksum'] }}"
mode: '0555'
mode: "0555"
- name: Pre Audit Setup | Copy audit binary
when: get_audit_binary_method == 'copy'
ansible.builtin.copy:
src: "{{ audit_bin_copy_location }}"
dest: "{{ audit_bin }}"
mode: '0555'
mode: "0555"
owner: root
group: root

11
tasks/audit_only.yml
View file

@ -1,9 +1,8 @@
---
- name: Audit_Only | Create local Directories for hosts
when: fetch_audit_files
ansible.builtin.file:
mode: '0755'
mode: "0755"
path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
recurse: true
state: directory
@ -15,16 +14,14 @@
ansible.builtin.fetch:
dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
flat: true
mode: '0644'
mode: "0644"
src: "{{ pre_audit_outfile }}"
- name: Audit_only | Show Audit Summary
when:
- audit_only
when: audit_only
ansible.builtin.debug:
msg: "{{ audit_results.split('\n') }}"
- name: Audit_only | Stop Playbook Audit Only selected
when:
- audit_only
when: audit_only
ansible.builtin.meta: end_play

3
tasks/check_prereqs.yml
View file

@ -1,8 +1,7 @@
---
- name: "PREREQ | If required install libselinux package to manage file changes."
when:
- '"libselinux-python3" not in ansible_facts.packages'
when: '"libselinux-python3" not in ansible_facts.packages'
ansible.builtin.package:
name: libselinux-python3
state: present

50
tasks/main.yml
View file

@ -2,22 +2,19 @@
# tasks file for RHEL9-CIS
- name: "Check OS version and family"
when: os_check
tags: always
ansible.builtin.assert:
that: (ansible_facts.distribution != 'CentOS' and ansible_facts.os_family == 'RedHat' or ansible_facts.os_family == "Rocky") and ansible_facts.distribution_major_version is version_compare('9', '==')
fail_msg: "This role can only be run against Supported OSs. {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }} is not supported."
success_msg: "This role is running against a supported OS {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }}"
when:
- os_check
tags:
- always
- name: "Check ansible version"
tags: always
ansible.builtin.assert:
that: ansible_version.full is version_compare(min_ansible_version, '>=')
fail_msg: "You must use Ansible {{ min_ansible_version }} or greater"
success_msg: "This role is running a supported version of ansible {{ ansible_version.full }} >= {{ min_ansible_version }}"
tags:
- always
- name: "Setup rules if container"
when:
@ -36,8 +33,7 @@
file: "{{ container_vars_file }}"
- name: "Output if discovered is a container"
when:
- system_is_container
when: system_is_container
ansible.builtin.debug:
msg: system has been discovered as a container
@ -51,8 +47,7 @@
when:
- rhel9cis_set_boot_pass
- rhel9cis_rule_1_4_1
tags:
- always
tags: always
ansible.builtin.assert:
that: rhel9cis_bootloader_password_hash.find('grub.pbkdf2.sha512') != -1 and rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword' # pragma: allowlist secret
msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password_hash variable has not been set correctly"
@ -81,23 +76,22 @@
vars:
sudo_password_rule: rhel9cis_rule_5_2_4 # pragma: allowlist secret
block:
- name: "Check password set for {{ ansible_env.SUDO_USER }} | password state"
- name: "Check password set for {{ ansible_env.SUDO_USER }} | password state" # noqa name[template]
ansible.builtin.shell: "(grep {{ ansible_env.SUDO_USER }} /etc/shadow || echo 'not found:not found') | awk -F: '{print $2}'"
changed_when: false
failed_when: false
check_mode: false
register: prelim_ansible_user_password_set
- name: "Check for local account {{ ansible_env.SUDO_USER }} | Check for local account"
- name: "Check for local account {{ ansible_env.SUDO_USER }} | Check for local account" # noqa name[template]
when: prelim_ansible_user_password_set.stdout == "not found"
ansible.builtin.debug:
msg: "No local account found for {{ ansible_env.SUDO_USER }} user. Skipping local account checks."
- name: "Check local account"
when:
- prelim_ansible_user_password_set.stdout != "not found"
when: prelim_ansible_user_password_set.stdout != "not found"
block:
- name: "Check password set for {{ ansible_env.SUDO_USER }} | Assert local password set"
- name: "Check password set for {{ ansible_env.SUDO_USER }} | Assert local password set" # noqa name[template]
ansible.builtin.assert:
that:
- prelim_ansible_user_password_set.stdout | length != 0
@ -105,7 +99,7 @@
fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_env.SUDO_USER }} has no password set - It can break access"
success_msg: "You have a password set for the {{ ansible_env.SUDO_USER }} user"
- name: "Check account is not locked for {{ ansible_env.SUDO_USER }} | Assert local account not locked"
- name: "Check account is not locked for {{ ansible_env.SUDO_USER }} | Assert local account not locked" # noqa name[template]
ansible.builtin.assert:
that:
- not prelim_ansible_user_password_set.stdout.startswith("!")
@ -113,10 +107,8 @@
success_msg: "The local account is not locked for {{ ansible_env.SUDO_USER }} user"
- name: "PRELIM | AUDIT | Check authselect profile is selected"
when:
- rhel9cis_allow_authselect_updates
tags:
- always
when: rhel9cis_allow_authselect_updates
tags: always
block:
- name: "PRELIM | AUDIT | Check authselect profile name has been updated"
ansible.builtin.assert:
@ -136,8 +128,7 @@
fail_msg: Authselect updates have been selected there are issues with profile selection"
- name: "Ensure root password is set"
when:
- rhel9cis_rule_5_4_2_4
when: rhel9cis_rule_5_4_2_4
tags:
- level1-server
- level1-workstation
@ -158,14 +149,12 @@
success_msg: "You have a root password set"
- name: "Gather the package facts"
tags:
- always
tags: always
ansible.builtin.package_facts:
manager: auto
- name: "Include OS specific variables"
tags:
- always
tags: always
ansible.builtin.include_vars:
file: "{{ ansible_facts.distribution }}.yml"
@ -213,8 +202,7 @@
- name: "Run auditd logic"
when: update_audit_template
tags:
- always
tags: always
ansible.builtin.import_tasks:
file: auditd.yml
@ -226,8 +214,7 @@
file: post.yml
- name: "Run post_remediation audit"
when:
- run_audit
when: run_audit
ansible.builtin.import_tasks:
file: post_remediation_audit.yml
@ -238,7 +225,6 @@
- name: "If Warnings found Output count and control IDs affected"
when: warn_count != 0
tags:
- always
tags: always
ansible.builtin.debug:
msg: "You have {{ warn_count }} Warning(s) that require investigating that are related to the following benchmark ID(s) {{ warn_control_list }}"

10
tasks/parse_etc_password.yml
View file

@ -1,19 +1,17 @@
---
- name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Parse /etc/passwd"
tags:
- always
tags: always
block:
- name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Parse /etc/passwd"
ansible.builtin.shell: cat /etc/passwd
ansible.builtin.command: cat /etc/passwd
changed_when: false
check_mode: false
register: rhel9cis_passwd_file_audit
register: prelim_passwd_file_audit
- name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Split passwd entries"
ansible.builtin.set_fact:
rhel9cis_passwd: "{{ rhel9cis_passwd_file_audit.stdout_lines | map('regex_replace', ld_passwd_regex, ld_passwd_yaml) | map('from_yaml') | list }}"
loop: "{{ rhel9cis_passwd_file_audit.stdout_lines }}"
rhel9cis_passwd: "{{ prelim_passwd_file_audit.stdout_lines | map('regex_replace', ld_passwd_regex, ld_passwd_yaml) | map('from_yaml') | list }}"
vars:
ld_passwd_regex: >-
^(?P<id>[^:]*):(?P<password>[^:]*):(?P<uid>[^:]*):(?P<gid>[^:]*):(?P<gecos>[^:]*):(?P<dir>[^:]*):(?P<shell>[^:]*)

26
tasks/post.yml
View file

@ -1,9 +1,7 @@
---
# Post tasks
- name: POST | Gather the package facts after remediation
tags:
- always
tags: always
ansible.builtin.package_facts:
manager: auto
@ -17,7 +15,7 @@
dest: "/etc/sysctl.d/{{ item }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
notify: Reload sysctl
loop:
- 60-kernel_sysctl.conf
@ -29,28 +27,22 @@
ansible.builtin.meta: flush_handlers
- name: POST | reboot system if changes require it and not skipped
tags:
- always
when: change_requires_reboot
tags: always
vars:
warn_control_id: Reboot_required
block:
- name: POST | Reboot system if changes require it and not skipped
when: not skip_reboot
ansible.builtin.reboot:
when:
- change_requires_reboot
- not skip_reboot
- name: POST | Warning a reboot required but skip option set
when: skip_reboot
ansible.builtin.debug:
msg: "Warning!! changes have been made that require a reboot to be implemented but skip reboot was set - Can affect compliance check results"
changed_when: true
when:
- change_requires_reboot
- skip_reboot
- name: "POST | Warning a reboot required but skip option set | warning count"
when: skip_reboot
ansible.builtin.import_tasks:
file: warning_facts.yml
when:
- change_requires_reboot
- skip_reboot
vars:
warn_control_id: Reboot_required

10
tasks/post_remediation_audit.yml
View file

@ -1,7 +1,7 @@
---
- name: Post Audit | Run post_remediation {{ benchmark }} audit
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g \"{{ group_names }}\""
- name: Post Audit | Run post_remediation {{ benchmark }} audit # noqa name[template]
ansible.builtin.command: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g \"{{ group_names }}\""
changed_when: true
environment:
AUDIT_BIN: "{{ audit_bin }}"
@ -18,8 +18,7 @@
- "{{ pre_audit_outfile }}"
- name: Post Audit | Capture audit data if json format
when:
- audit_format == "json"
when: audit_format == "json"
block:
- name: Post Audit | Capture audit data if json format
ansible.builtin.shell: grep -E '"summary-line.*Count:.*Failed' "{{ post_audit_outfile }}" | cut -d'"' -f4
@ -31,8 +30,7 @@
post_audit_results: "{{ post_audit_summary.stdout }}"
- name: Post Audit | Capture audit data if documentation format
when:
- audit_format == "documentation"
when: audit_format == "documentation"
block:
- name: Post Audit | Capture audit data if documentation format
ansible.builtin.shell: tail -2 "{{ post_audit_outfile }}" | tac | tr '\n' ' '

55
tasks/pre_remediation_audit.yml
View file

@ -1,22 +1,18 @@
---
- name: Pre Audit Setup | Setup the LE audit
when:
- setup_audit
tags:
- setup_audit
when: setup_audit
tags: setup_audit
ansible.builtin.include_tasks:
file: LE_audit_setup.yml
- name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists
- name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists # noqa name[template]
ansible.builtin.file:
path: "{{ audit_conf_dir }}"
state: directory
mode: '0755'
mode: "0755"
- name: Pre Audit Setup | If using git for content set up
when:
- audit_content == 'git'
when: audit_content == 'git'
block:
- name: Pre Audit Setup | Install git
ansible.builtin.package:
@ -30,32 +26,28 @@
version: "{{ audit_git_version }}"
- name: Pre Audit Setup | Copy to audit content files to server
when:
- audit_content == 'copy'
when: audit_content == 'copy'
ansible.builtin.copy:
src: "{{ audit_conf_source }}"
dest: "{{ audit_conf_dest }}"
mode: preserve
- name: Pre Audit Setup | Unarchive audit content files on server
when:
- audit_content == 'archive'
when: audit_content == 'archive'
ansible.builtin.unarchive:
src: "{{ audit_conf_source }}"
dest: "{{ audit_conf_dest }}"
- name: Pre Audit Setup | Get audit content from url
when:
- audit_content == 'get_url'
when: audit_content == 'get_url'
ansible.builtin.unarchive:
src: "{{ audit_conf_source }}"
dest: "{{ audit_conf_dest }}/{{ benchmark }}-Audit"
remote_src: "{{ ( audit_conf_source is contains ('http'))| ternary(true, false ) }}"
extra_opts: "{{ (audit_conf_source is contains ('github')) | ternary('--strip-components=1', [] ) }}"
remote_src: "{{ (audit_conf_source is contains('http')) | ternary(true, false) }}"
extra_opts: "{{ (audit_conf_source is contains('github')) | ternary('--strip-components=1', []) }}"
- name: Pre Audit Setup | Check Goss is available
when:
- run_audit
when: run_audit
block:
- name: Pre Audit Setup | Check for goss file
ansible.builtin.stat:
@ -63,24 +55,22 @@
register: discovered_goss_available
- name: Pre Audit Setup | If audit ensure goss is available
when:
- not discovered_goss_available.stat.exists
when: not discovered_goss_available.stat.exists
ansible.builtin.assert:
msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
- name: Pre Audit Setup | Copy ansible default vars values to test audit
when:
- run_audit
when: run_audit
tags:
- goss_template
- run_audit
ansible.builtin.template:
src: ansible_vars_goss.yml.j2
dest: "{{ audit_vars_path }}"
mode: '0600'
mode: "0600"
- name: Pre Audit | Run pre_remediation {{ benchmark }} audit
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
- name: Pre Audit | Run pre_remediation {{ benchmark }} audit # noqa name[template]
ansible.builtin.command: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
changed_when: true
environment:
AUDIT_BIN: "{{ audit_bin }}"
@ -88,33 +78,30 @@
AUDIT_FILE: goss.yml
- name: Pre Audit | Capture audit data if json format
when:
- audit_format == "json"
when: audit_format == "json"
block:
- name: Pre Audit | Capture audit data if json format
ansible.builtin.shell: grep -E '\"summary-line.*Count:.*Failed' "{{ pre_audit_outfile }}" | cut -d'"' -f4
register: pre_audit_summary
changed_when: false
register: pre_audit_summary
- name: Pre Audit | Set Fact for audit summary
ansible.builtin.set_fact:
pre_audit_results: "{{ pre_audit_summary.stdout }}"
- name: Pre Audit | Capture audit data if documentation format
when:
- audit_format == "documentation"
when: audit_format == "documentation"
block:
- name: Pre Audit | Capture audit data if documentation format
ansible.builtin.shell: tail -2 "{{ pre_audit_outfile }}" | tac | tr '\n' ' '
register: pre_audit_summary
changed_when: false
register: pre_audit_summary
- name: Pre Audit | Set Fact for audit summary
ansible.builtin.set_fact:
pre_audit_results: "{{ pre_audit_summary.stdout }}"
- name: Audit_Only | Run Audit Only
when:
- audit_only
when: audit_only
ansible.builtin.import_tasks:
file: audit_only.yml

40
tasks/prelim.yml
View file

@ -17,50 +17,43 @@
when:
- run_audit or audit_only
- setup_audit
tags:
- run_audit
tags: run_audit
ansible.builtin.import_tasks: pre_remediation_audit.yml
- name: "PRELIM | AUDIT | Interactive Users"
tags:
- always
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $1 }'
changed_when: false
register: prelim_interactive_usernames
- name: "PRELIM | AUDIT | Interactive User accounts home directories"
tags:
- always
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $6 }'
changed_when: false
register: prelim_interactive_users_home
- name: "PRELIM | AUDIT | Interactive UIDs"
tags:
- always
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $3 }'
changed_when: false
register: prelim_interactive_uids
- name: "PRELIM | AUDIT | Capture /etc/password variables"
tags: always
ansible.builtin.include_tasks:
file: parse_etc_password.yml
tags:
- always
- name: "PRELIM | PATCH | Ensure python3-libselinux is installed"
when:
- '"python3-libselinux" not in ansible_facts.packages'
when: '"python3-libselinux" not in ansible_facts.packages'
ansible.builtin.package:
name: python3-libselinux
state: present
- name: "PRELIM | AUDIT | Section 1.1 | Create list of mount points"
tags:
- Always
tags: always
ansible.builtin.set_fact:
mount_names: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
@ -80,27 +73,27 @@
- ansible_facts.distribution == 'RedHat'
block:
- name: "PRELIM | AUDIT | Import gpg keys | get data"
ansible.builtin.shell: rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
ansible.builtin.command: rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n' # noqa command-instead-of-module
changed_when: false
failed_when: false
register: prelim_check_gpg_imported
- name: "PRELIM | AUDIT | Import gpg keys | Check Package"
- name: "PRELIM | AUDIT | Import gpg keys | Check Package" # noqa command-instead-of-module
when: "'not installed' in prelim_check_gpg_imported.stdout"
ansible.builtin.shell: rpm -qi redhat-release | grep Signature
changed_when: false
failed_when: false
register: prelim_os_gpg_package_valid
- name: "PRELIM | PATCH | Force keys to be imported"
- name: "PRELIM | PATCH | Force keys to be imported" # noqa command-instead-of-module
when:
- "'not installed' in prelim_check_gpg_imported.stdout"
- "'Key ID 199e2f91fd431d51' in prelim_os_gpg_package_valid.stdout"
ansible.builtin.shell: rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
ansible.builtin.command: rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
changed_when: false
- name: "PRELIM | AUDIT | Check systemd coredump"
when:
- rhel9cis_rule_1_5_4
when: rhel9cis_rule_1_5_4
tags:
- level1-server
- level1-workstation
@ -127,7 +120,7 @@
state: present
- name: "PRELIM | AUDIT | Gather system-wide crypto-policy"
ansible.builtin.shell: 'update-crypto-policies --show'
ansible.builtin.command: 'update-crypto-policies --show'
changed_when: false
check_mode: false
register: prelim_system_wide_crypto_policy
@ -183,7 +176,7 @@
- always
block:
- name: "PRELIM | AUDIT | Discover is wirelss adapter on system"
ansible.builtin.shell: find /sys/class/net/*/ -type d -name wireless
ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless
register: discover_wireless_adapters
changed_when: false
failed_when: discover_wireless_adapters.rc not in [ 0, 1 ]
@ -222,7 +215,7 @@
path: "{{ rhel9cis_sshd_config_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
state: touch
- name: "PRELIM | AUDIT | Gather UID 0 accounts other than root"
@ -246,6 +239,7 @@
ansible.builtin.file:
path: /etc/systemd/journald.conf.d
state: directory
mode: 'go-w'
- name: "PRELIM | PATCH | Configure System Accounting (auditd)"
when:

86
tasks/section_1/cis_1.1.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_1
when: rhel9cis_rule_1_1_1_1
tags:
- level1-server
- level1-workstation
@ -17,7 +16,7 @@
regexp: "^(#)?install cramfs(\\s|$)"
line: "install cramfs /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -25,7 +24,7 @@
regexp: "^(#)?blacklist cramfs(\\s|$)"
line: "blacklist cramfs"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Disable cramfs"
when:
@ -35,8 +34,7 @@
state: absent
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_2
when: rhel9cis_rule_1_1_1_2
tags:
- level1-server
- level1-workstation
@ -51,7 +49,7 @@
regexp: "^(#)?install freevxfs(\\s|$)"
line: "install freevxfs /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -59,18 +57,16 @@
regexp: "^(#)?blacklist freevxfs(\\s|$)"
line: "blacklist freevxfs"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: freevxfs
state: absent
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_3
when: rhel9cis_rule_1_1_1_3
tags:
- level1-server
- level1-workstation
@ -85,7 +81,7 @@
regexp: "^(#)?install hfs(\\s|$)"
line: "install hfs /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -93,18 +89,16 @@
regexp: "^(#)?blacklist hfs(\\s|$)"
line: "blacklist hfs"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: hfs
state: absent
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available"
when:
- rhel9cis_rule_1_1_1_4
when: rhel9cis_rule_1_1_1_4
tags:
- level1-server
- level1-workstation
@ -119,7 +113,7 @@
regexp: "^(#)?install hfsplus(\\s|$)"
line: "install hfsplus /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -127,18 +121,16 @@
regexp: "^(#)?blacklist hfsplus(\\s|$)"
line: "blacklist hfsplus"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: hfsplus
state: absent
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available"
when:
- rhel9cis_rule_1_1_1_5
when: rhel9cis_rule_1_1_1_5
tags:
- level1-server
- level1-workstation
@ -153,7 +145,7 @@
regexp: "^(#)?install jffs2(\\s|$)"
line: "install jffs2 /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -161,18 +153,16 @@
regexp: "^(#)?blacklist jffs2(\\s|$)"
line: "blacklist jffs2"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: jffs2
state: absent
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_6
when: rhel9cis_rule_1_1_1_6
tags:
- level2-server
- level2-workstation
@ -187,7 +177,7 @@
regexp: "^(#)?install squashfs(\\s|$)"
line: "install squashfs /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -195,18 +185,16 @@
regexp: "^(#)?blacklist squashfs(\\s|$)"
line: "blacklist squashfs"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: squashfs
state: absent
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available"
when:
- rhel9cis_rule_1_1_1_7
when: rhel9cis_rule_1_1_1_7
tags:
- level2-server
- level2-workstation
@ -221,7 +209,7 @@
regexp: "^(#)?install udf(\\s|$)"
line: "install udf /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -229,18 +217,16 @@
regexp: "^(#)?blacklist udf(\\s|$)"
line: "blacklist udf"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Disable udf"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: udf
state: absent
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available"
when:
- rhel9cis_rule_1_1_1_8
when: rhel9cis_rule_1_1_1_8
tags:
- level1-server
- level2-workstation
@ -255,7 +241,7 @@
regexp: "^(#)?install usb-storage(\\s|$)"
line: "install usb-storage /bin/true"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | blacklist"
ansible.builtin.lineinfile:
@ -263,18 +249,16 @@
regexp: "^(#)?blacklist usb-storage(\\s|$)"
line: "blacklist usb-storage"
create: true
mode: '0600'
mode: 'go-rwx'
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: usb-storage
state: absent
- name: "1.1.1.9 | PATCH | Ensure unused filesystems kernel modules are not available"
when:
- rhel9cis_rule_1_1_1_9
when: rhel9cis_rule_1_1_1_9
tags:
- level1-server
- level1-workstation
@ -289,10 +273,10 @@
dest: /var/fs_with_cves.sh
owner: root
group: root
mode: '0744'
mode: 'u+x,go-wx'
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Run discovery script"
ansible.builtin.shell: /var/fs_with_cves.sh
ansible.builtin.command: /var/fs_with_cves.sh
changed_when: false
failed_when: discovered_fs_modules_loaded.rc not in [ 0, 99 ]
register: discovered_fs_modules_loaded
@ -302,7 +286,7 @@
ansible.builtin.debug:
msg: |
"Warning!! Discovered loaded Filesystem modules that need attention. This is a manual task
{{ discovered_fs_modules_loaded.stdout_lines}}"
{{ discovered_fs_modules_loaded.stdout_lines }}"
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Capture Warning"
when: discovered_fs_modules_loaded.stdout | length > 0

4
tasks/section_1/cis_1.1.2.1.x.yml
View file

@ -17,7 +17,7 @@
block:
- name: "1.1.2.1.1 | PATCH | Ensure /tmp is a separate partition | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.1.1 | PATCH | Ensure /tmp is a separate partition | Present"
ansible.builtin.import_tasks:
@ -84,5 +84,5 @@
dest: /etc/systemd/system/tmp.mount
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Systemd restart tmp.mount

7
tasks/section_1/cis_1.1.2.2.x.yml
View file

@ -2,8 +2,7 @@
# Skips if mount is absent
- name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition"
when:
- rhel9cis_rule_1_1_2_2_1
when: rhel9cis_rule_1_1_2_2_1
tags:
- level1-server
- level1-workstation
@ -14,7 +13,7 @@
vars:
warn_control_id: '1.1.2.2.1'
block:
- name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition | check exists"
- name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition | check exists" # noqa command-instead-of-module
ansible.builtin.shell: mount -l | grep -w /dev/shm
changed_when: false
register: discovered_dev_shm_mount_check
@ -24,7 +23,7 @@
block:
- name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.2.1 | AUDIT | Ensure separate partition exists for /home | Present"
ansible.builtin.import_tasks:

2
tasks/section_1/cis_1.1.2.3.x.yml
View file

@ -17,7 +17,7 @@
block:
- name: "1.1.2.3.1 | AUDIT | Ensure separate partition exists for /home | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.3.1 | AUDIT | Ensure separate partition exists for /home | Present"
ansible.builtin.import_tasks:

2
tasks/section_1/cis_1.1.2.4.x.yml
View file

@ -17,7 +17,7 @@
block:
- name: "1.1.2.4.1 | AUDIT | Ensure separate partition exists for /var | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.4.1 | AUDIT | Ensure separate partition exists for /var | Present"
ansible.builtin.import_tasks:

2
tasks/section_1/cis_1.1.2.5.x.yml
View file

@ -18,7 +18,7 @@
block:
- name: "1.1.2.5.1 | AUDIT | Ensure separate partition exists for /var/tmp | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.5.1 | AUDIT | Ensure separate partition exists for /var/tmp | Present"
ansible.builtin.import_tasks:

2
tasks/section_1/cis_1.1.2.6.x.yml
View file

@ -17,7 +17,7 @@
block:
- name: "1.1.2.6.1 | AUDIT | Ensure separate partition exists for /var/log | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.6.1 | AUDIT | Ensure separate partition exists for /var/log | Present"
ansible.builtin.import_tasks:

2
tasks/section_1/cis_1.1.2.7.x.yml
View file

@ -17,7 +17,7 @@
block:
- name: "1.1.2.7.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Absent"
ansible.builtin.debug:
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
msg: "Warning!! {{ required_mount }} doesn't exist. Please investigate this manual task"
- name: "1.1.2.7.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Present"
ansible.builtin.import_tasks:

16
tasks/section_1/cis_1.2.1.x.yml
View file

@ -14,18 +14,18 @@
- rule_1.2.1.1
- NIST800-53R5_SI-2
block:
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys"
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys" # noqa command-instead-of-module
ansible.builtin.shell: "rpm -qa | grep {{ os_gpg_key_pubkey_name }}"
changed_when: false
failed_when: false
register: discovered_os_installed_pub_keys
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | Query found keys"
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | Query found keys" # noqa command-instead-of-module
when: discovered_os_installed_pub_keys.rc == 0
ansible.builtin.shell: 'rpm -q --queryformat "%{PACKAGER} %{VERSION}\\n" {{ os_gpg_key_pubkey_name }} | grep "{{ os_gpg_key_pubkey_content }}"'
changed_when: false
failed_when: false
register: discovered_os_gpg_key_check
when: discovered_os_installed_pub_keys.rc == 0
- name: "1.2.1.1 | AUDIT | Ensure GPG keys are configured | expected keys fail"
when:
@ -35,8 +35,7 @@
msg: Installed GPG Keys do not meet expected values or expected keys are not installed
- name: "1.2.1.2 | PATCH | Ensure gpgcheck is globally activated"
when:
- rhel9cis_rule_1_2_1_2
when: rhel9cis_rule_1_2_1_2
tags:
- level1-server
- level1-workstation
@ -94,8 +93,7 @@
label: "{{ item.path }}"
- name: "1.2.1.4 | AUDIT | Ensure package manager repositories are configured"
when:
- rhel9cis_rule_1_2_1_4
when: rhel9cis_rule_1_2_1_4
tags:
- level1-server
- level1-workstation
@ -107,11 +105,11 @@
warn_control_id: '1.2.1.4'
block:
- name: "1.2.1.4 | AUDIT | Ensure package manager repositories are configured | Get repo list"
ansible.builtin.shell: dnf repolist
ansible.builtin.command: dnf repolist
changed_when: false
failed_when: false
register: discovered_dnf_configured
check_mode: false
register: discovered_dnf_configured
- name: "1.2.1.4 | AUDIT | Ensure package manager repositories are configured | Display repo list"
ansible.builtin.debug:

9
tasks/section_1/cis_1.3.1.x.yml
View file

@ -122,8 +122,7 @@
file: warning_facts.yml
- name: "1.3.1.7 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
when:
- rhel9cis_rule_1_3_1_7
when: rhel9cis_rule_1_3_1_7
tags:
- level1-server
- level1-workstation
@ -136,9 +135,6 @@
state: absent
- name: "1.3.1.8 | PATCH | Ensure SETroubleshoot is not installed"
ansible.builtin.package:
name: setroubleshoot
state: absent
when:
- rhel9cis_rule_1_3_1_8
- "'setroubleshoot' in ansible_facts.packages"
@ -149,3 +145,6 @@
- rule_1.3.1.8
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
ansible.builtin.package:
name: setroubleshoot
state: absent

9
tasks/section_1/cis_1.4.x.yml
View file

@ -16,12 +16,11 @@
content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}" # noqa template-instead-of-copy
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
notify: Grub2cfg
- name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured"
when:
- rhel9cis_rule_1_4_2
when: rhel9cis_rule_1_4_2
tags:
- level1-server
- level1-workstation
@ -41,5 +40,5 @@
access_time: preserve
loop:
- { path: 'grub.cfg', mode: '0700' }
- { path: 'grubenv', mode: '0600' }
- { path: 'user.cfg', mode: '0600' }
- { path: 'grubenv', mode: 'go-rwx' }
- { path: 'user.cfg', mode: 'go-rwx' }

11
tasks/section_1/cis_1.5.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
when:
- rhel9cis_rule_1_5_1
when: rhel9cis_rule_1_5_1
tags:
- level1-server
- level1-workstation
@ -21,8 +20,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
- name: "1.5.2 | PATCH | Ensure ptrace_scope is restricted"
when:
- rhel9cis_rule_1_5_2
when: rhel9cis_rule_1_5_2
tags:
- level1-server
- level1-workstation
@ -39,8 +37,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
- name: "1.5.3 | PATCH | Ensure core dump backtraces are disabled"
when:
- rhel9cis_rule_1_5_3
when: rhel9cis_rule_1_5_3
tags:
- level1-server
- level1-workstation
@ -50,7 +47,7 @@
- NIST800-53R5_CM-6b
ansible.builtin.lineinfile:
path: /etc/systemd/coredump.conf
regexp: '^ProcessSizeMax\s*=\s*.*[1-9]$'
regexp: '(?#)^ProcessSizeMax\s*=\s*.*[1-9].*$'
line: 'ProcessSizeMax=0'
- name: "1.5.4 | PATCH | Ensure core dump storage is disabled"

16
tasks/section_1/cis_1.6.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "1.6.1 | AUDIT | Ensure system-wide crypto policy is not legacy"
when:
- rhel9cis_rule_1_6_1
when: rhel9cis_rule_1_6_1
tags:
- level1-server
- level1-workstation
@ -18,8 +17,7 @@
- Set Crypto Policy
- name: "1.6.2 | PATCH | Ensure system wide crypto policy is not set in sshd configuration"
when:
- rhel9cis_rule_1_6_2
when: rhel9cis_rule_1_6_2
tags:
- level1-server
- level1-workstation
@ -54,7 +52,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SHA1.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
register: discovered_no_sha1_template
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support | submodule to crypto policy modules"
@ -85,7 +83,7 @@
dest: /etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
register: discovered_no_weakmac_template
- name: "1.6.4 | PATCH | Ensure system wide crypto policy disables macs less than 128 bits | submodule to crypto policy modules"
@ -115,7 +113,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SSHCBC.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
register: discovered_no_sshcbc_template
- name: "1.6.5 | PATCH | Ensure system wide crypto policy disables cbc for ssh | submodule to crypto policy modules"
@ -145,7 +143,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
register: discovered_no_sshweakciphers_template
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | submodule to crypto policy modules"
@ -175,7 +173,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SSHETM.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
register: discovered_no_sshetm_template
- name: "1.6.7 | PATCH | Ensure system wide crypto policy disables EtM for ssh | submodule to crypto policy modules"

30
tasks/section_1/cis_1.7.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "1.7.1 | PATCH | Ensure message of the day is configured properly"
when:
- rhel9cis_rule_1_7_1
when: rhel9cis_rule_1_7_1
tags:
- level1-server
- level1-workstation
@ -17,11 +16,10 @@
dest: /etc/motd
owner: root
group: root
mode: u-x,go-wx
mode: 'u-x,go-wx'
- name: "1.7.2 | PATCH | Ensure local login warning banner is configured properly"
when:
- rhel9cis_rule_1_7_2
when: rhel9cis_rule_1_7_2
tags:
- level1-server
- level1-workstation
@ -35,11 +33,10 @@
dest: /etc/issue
owner: root
group: root
mode: '0644'
mode: 'go-wx'
- name: "1.7.3 | PATCH | Ensure remote login warning banner is configured properly"
when:
- rhel9cis_rule_1_7_3
when: rhel9cis_rule_1_7_3
tags:
- level1-server
- level1-workstation
@ -54,11 +51,10 @@
dest: /etc/issue.net
owner: root
group: root
mode: '0644'
mode: 'go-wx'
- name: "1.7.4 | PATCH | Ensure permissions on /etc/motd are configured"
when:
- rhel9cis_rule_1_7_4
when: rhel9cis_rule_1_7_4
tags:
- level1-server
- level1-workstation
@ -71,11 +67,10 @@
path: /etc/motd
owner: root
group: root
mode: '0644'
mode: 'go-wx'
- name: "1.7.5 | PATCH | Ensure permissions on /etc/issue are configured"
when:
- rhel9cis_rule_1_7_5
when: rhel9cis_rule_1_7_5
tags:
- level1-server
- level1-workstation
@ -88,11 +83,10 @@
path: /etc/issue
owner: root
group: root
mode: '0644'
mode: 'go-wx'
- name: "1.7.6 | PATCH | Ensure permissions on /etc/issue.net are configured"
when:
- rhel9cis_rule_1_7_6
when: rhel9cis_rule_1_7_6
tags:
- level1-server
- level1-workstation
@ -105,4 +99,4 @@
path: /etc/issue.net
owner: root
group: root
mode: '0644'
mode: 'go-wx'

30
tasks/section_1/cis_1.8.x.yml
View file

@ -35,7 +35,7 @@
create: true
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
loop:
- { regexp: 'user-db', line: 'user-db:user' }
@ -48,7 +48,7 @@
dest: /etc/dconf/db/gdm.d/01-banner-message
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.3 | PATCH | Ensure GDM disable-user-list option is enabled"
@ -68,7 +68,7 @@
create: true
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
loop:
- { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
@ -96,7 +96,7 @@
create: true
owner: root
group: root
mode: '0644'
mode: 'go-wx'
loop:
- { regexp: '^user-db', line: 'user-db:user' }
- { regexp: '^system-db', line: 'system-db:local' }
@ -106,7 +106,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d"
owner: root
group: root
mode: '0755'
mode: 'go-w'
state: directory
- name: "1.8.4 | PATCH | Ensure GDM screen locks when the user is idle | Make conf file"
@ -115,7 +115,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/00-screensaver"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.5 | PATCH | Ensure GDM screen locks cannot be overridden"
@ -134,7 +134,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: '0755'
mode: 'go-w'
state: directory
- name: "1.8.5 | PATCH | Ensure GDM screen locks cannot be overridden | Make lock file"
@ -143,7 +143,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-screensaver_lock"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.6 | PATCH | Ensure GDM automatic mounting of removable media is disabled"
@ -161,7 +161,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/00-media-automount"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.7 | PATCH | Ensure GDM disabling automatic mounting of removable media is not overridden"
@ -180,7 +180,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: '0755'
mode: 'go-w'
state: directory
- name: "1.8.7 | PATCH | Ensure GDM disabling automatic mounting of removable media is not overridden | Make lock file"
@ -189,7 +189,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-automount_lock"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.8 | PATCH | Ensure GDM autorun-never is enabled"
@ -208,7 +208,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d"
owner: root
group: root
mode: '0755'
mode: 'go-w'
state: directory
- name: "1.8.8 | PATCH | Ensure GDM autorun-never is enabled | Make conf file"
@ -217,7 +217,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/00-media-autorun"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.9 | PATCH | Ensure GDM autorun-never is not overridden"
@ -236,7 +236,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: '0755'
mode: 'go-w'
state: directory
- name: "1.8.9 | PATCH | Ensure GDM autorun-never is not overridden | Make lockfile"
@ -245,7 +245,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-autorun_lock"
owner: root
group: root
mode: '0644'
mode: 'go-wx'
notify: Reload dconf
- name: "1.8.10 | PATCH | Ensure XDMCP is not enabled"

83
tasks/section_2/cis_2.1.x.yml
View file

@ -33,9 +33,7 @@
masked: true
- name: "2.1.2 | PATCH | Ensure avahi daemon services are not in use"
when:
- rhel9cis_rule_2_1_2
- "'avahi' in ansible_facts.packages or 'avahi-autopd' in ansible_facts.packages"
when: rhel9cis_rule_2_1_2
tags:
- level1-server
- level2-workstation
@ -70,9 +68,7 @@
- avahi-daemon.service
- name: "2.1.3 | PATCH | Ensure dhcp server services are not in use"
when:
- "'dhcp-server' in ansible_facts.packages"
- rhel9cis_rule_2_1_3
when: rhel9cis_rule_2_1_3
tags:
- level1-server
- level1-workstation
@ -105,9 +101,7 @@
- dhcpd6.service
- name: "2.1.4 | PATCH | Ensure dns server services are not in use"
when:
- "'bind' in ansible_facts.packages"
- rhel9cis_rule_2_1_4
when: rhel9cis_rule_2_1_4
tags:
- level1-server
- level1-workstation
@ -137,9 +131,7 @@
masked: true
- name: "2.1.5 | PATCH | Ensure dnsmasq server services are not in use"
when:
- "'dnsmasq' in ansible_facts.packages"
- rhel9cis_rule_2_1_5
when: rhel9cis_rule_2_1_5
tags:
- level1-server
- level1-workstation
@ -169,9 +161,7 @@
masked: true
- name: "2.1.6 | PATCH | Ensure samba file server services are not in use"
when:
- "'samba' in ansible_facts.packages"
- rhel9cis_rule_2_1_6
when: rhel9cis_rule_2_1_6
tags:
- level1-server
- level1-workstation
@ -202,9 +192,7 @@
masked: true
- name: "2.1.7 | PATCH | Ensure ftp server services are not in use"
when:
- "'ftp' in ansible_facts.packages"
- rhel9cis_rule_2_1_7
when: rhel9cis_rule_2_1_7
tags:
- level1-server
- level1-workstation
@ -235,9 +223,7 @@
masked: true
- name: "2.1.8 | PATCH | Ensure message access server services are not in use"
when:
- "'dovecot' in ansible_facts.packages or 'cyrus-imapd' in ansible_facts.packages"
- rhel9cis_rule_2_1_8
when: rhel9cis_rule_2_1_8
tags:
- level1-server
- level1-workstation
@ -275,9 +261,7 @@
- "cyrus-imapd.service"
- name: "2.1.9 | PATCH | Ensure network file system services are not in use"
when:
- "'nfs-utils' in ansible_facts.packages"
- rhel9cis_rule_2_1_9
when: rhel9cis_rule_2_1_9
tags:
- level1-server
- level1-workstation
@ -309,9 +293,7 @@
masked: true
- name: "2.1.10 | PATCH | Ensure nis server services are not in use"
when:
- "'ypserv' in ansible_facts.packages"
- rhel9cis_rule_2_1_10
when: rhel9cis_rule_2_1_10
tags:
- level1-server
- level1-workstation
@ -341,9 +323,7 @@
masked: true
- name: "2.1.11 | PATCH | Ensure print server services are not in use"
when:
- "'cups' in ansible_facts.packages"
- rhel9cis_rule_2_1_11
when: rhel9cis_rule_2_1_11
tags:
- level1-server
- automated
@ -375,9 +355,7 @@
- "cups.service"
- name: "2.1.12 | PATCH | Ensure rpcbind services are not in use"
when:
- "'rpcbind' in ansible_facts.packages"
- rhel9cis_rule_2_1_12
when: rhel9cis_rule_2_1_12
tags:
- level1-server
- level1-workstation
@ -411,9 +389,7 @@
- rpcbind.socket
- name: "2.1.13 | PATCH | Ensure rsync services are not in use"
when:
- "'rsync-daemon' in ansible_facts.packages"
- rhel9cis_rule_2_1_13
when: rhel9cis_rule_2_1_13
tags:
- level1-server
- level1-workstation
@ -447,9 +423,7 @@
- 'rsyncd.service'
- name: "2.1.14 | PATCH | Ensure snmp services are not in use"
when:
- "'net-snmp' in ansible_facts.packages"
- rhel9cis_rule_2_1_14
when: rhel9cis_rule_2_1_14
tags:
- level1-server
- level1-workstation
@ -479,9 +453,7 @@
masked: true
- name: "2.1.15 | PATCH | Ensure telnet server services are not in use"
when:
- "'telnet-server' in ansible_facts.packages"
- rhel9cis_rule_2_1_15
when: rhel9cis_rule_2_1_15
tags:
- level1-server
- level1-workstation
@ -512,9 +484,7 @@
masked: true
- name: "2.1.16 | PATCH | Ensure tftp server services are not in use"
when:
- "'tftp-server' in ansible_facts.packages"
- rhel9cis_rule_2_1_16
when: rhel9cis_rule_2_1_16
tags:
- level1-server
- level1-workstation
@ -547,9 +517,7 @@
- 'tftp.service'
- name: "2.1.17 | PATCH | Ensure web proxy server services are not in use"
when:
- "'squid' in ansible_facts.packages"
- rhel9cis_rule_2_117
when: rhel9cis_rule_2_1_17
tags:
- level1-server
- level1-workstation
@ -580,8 +548,7 @@
masked: true
- name: "2.1.18 | PATCH | Ensure web server services are not in use"
when:
- rhel9cis_rule_2_1_18
when: rhel9cis_rule_2_1_18
tags:
- level1-server
- level1-workstation
@ -597,7 +564,6 @@
when:
- not rhel9cis_httpd_server
- not rhel9cis_httpd_mask
- "'httpd' in ansible_facts.packages"
ansible.builtin.package:
name: httpd
state: absent
@ -606,7 +572,6 @@
when:
- not rhel9cis_nginx_server
- not rhel9cis_nginx_mask
- "'nginx' in ansible_facts.packages"
ansible.builtin.package:
name: nginx
state: absent
@ -615,7 +580,6 @@
when:
- not rhel9cis_httpd_server
- rhel9cis_httpd_mask
- "'httpd' in ansible_facts.packages"
notify: Systemd_daemon_reload
ansible.builtin.systemd:
name: httpd.service
@ -627,7 +591,6 @@
when:
- not rhel9cis_nginx_server
- rhel9cis_nginx_mask
- "'nginx' in ansible_facts.packages"
notify: Systemd_daemon_reload
ansible.builtin.systemd:
name: ngnix.service
@ -636,9 +599,7 @@
masked: true
- name: "2.1.19 | PATCH | Ensure xinetd services are not in use"
when:
- "'xinetd' in ansible_facts.packages"
- rhel9cis_rule_2_1_19
when: rhel9cis_rule_2_1_19
tags:
- level1-server
- level1-workstation
@ -670,7 +631,6 @@
- name: "2.1.20 | PATCH | Ensure X window server services are not in use"
when:
- not rhel9cis_xwindow_server
- "'xorg-x11-server-common' in ansible_facts.packages"
- rhel9cis_rule_2_1_20
tags:
- level1-server
@ -704,8 +664,7 @@
line: "inet_interfaces = loopback-only"
- name: "2.1.22 | AUDIT | Ensure only approved services are listening on a network interface"
when:
- rhel9cis_rule_2_1_22
when: rhel9cis_rule_2_1_22
tags:
- level1-server
- level1-workstation
@ -717,8 +676,8 @@
vars:
warn_control_id: '2.1.22'
block:
- name: "2.1.22 | AUDIT | Ensure only approved services are listening on a network interface | Get list of services"
ansible.builtin.shell: systemctl list-units --type=service
- name: "2.1.22 | AUDIT | Ensure only approved services are listening on a network interface | Get list of services" # noqa command-instead-of-module
ansible.builtin.command: systemctl list-units --type=service
changed_when: false
failed_when: discovered_running_services.rc not in [ 0, 1 ]
check_mode: false

5
tasks/section_2/cis_2.2.x.yml
View file

@ -3,7 +3,6 @@
- name: "2.2.1 | PATCH | Ensure ftp client is not installed"
when:
- not rhel9cis_ftp_client
- "'ftp' in ansible_facts.packages"
- rhel9cis_rule_2_2_1
tags:
- level1-server
@ -20,7 +19,6 @@
- name: "2.2.2 | PATCH | Ensure ldap client is not installed"
when:
- not rhel9cis_openldap_clients_required
- "'openldap-clients' in ansible_facts.packages"
- rhel9cis_rule_2_2_2
tags:
- level2-server
@ -37,7 +35,6 @@
- name: "2.2.3 | PATCH | Ensure nis client is not installed"
when:
- not rhel9cis_ypbind_required
- "'ypbind' in ansible_facts.packages"
- rhel9cis_rule_2_2_3
tags:
- level1-server
@ -54,7 +51,6 @@
- name: "2.2.4 | PATCH | Ensure telnet client is not installed"
when:
- not rhel9cis_telnet_required
- "'telnet' in ansible_facts.packages"
- rhel9cis_rule_2_2_4
tags:
- level1-server
@ -71,7 +67,6 @@
- name: "2.2.5 | PATCH | Ensure TFTP client is not installed"
when:
- not rhel9cis_tftp_client
- "'tftp' in ansible_facts.packages"
- rhel9cis_rule_2_2_5
tags:
- level1-server

4
tasks/section_2/cis_2.3.x.yml
View file

@ -31,7 +31,7 @@
dest: /etc/chrony.conf
owner: root
group: root
mode: '0644'
mode: 'go-wx'
- name: "2.3.3 | PATCH | Ensure chrony is not run as the root user"
when:
@ -48,4 +48,4 @@
line: OPTIONS="\1 -u chrony"
create: true
backrefs: true
mode: '0644'
mode: 'go-wx'

43
tasks/section_2/cis_2.4.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "2.4.1.1 | PATCH | Ensure cron daemon is enabled"
when:
- rhel9cis_rule_2_4_1_1
when: rhel9cis_rule_2_4_1_1
tags:
- level1-server
- level1-workstation
@ -19,8 +18,7 @@
enabled: true
- name: "2.4.1.2 | PATCH | Ensure permissions on /etc/crontab are configured"
when:
- rhel9cis_rule_2_4_1_2
when: rhel9cis_rule_2_4_1_2
tags:
- level1-server
- level1-workstation
@ -33,11 +31,10 @@
path: /etc/crontab
owner: root
group: root
mode: og-rwx
mode: 'og-rwx'
- name: "2.4.1.3 | PATCH | Ensure permissions on /etc/cron.hourly are configured"
when:
- rhel9cis_rule_2_4_1_3
when: rhel9cis_rule_2_4_1_3
tags:
- level1-server
- level1-workstation
@ -51,11 +48,10 @@
state: directory
owner: root
group: root
mode: og-rwx
mode: 'og-rwx'
- name: "2.4.1.4 | PATCH | Ensure permissions on /etc/cron.daily are configured"
when:
- rhel9cis_rule_2_4_1_4
when: rhel9cis_rule_2_4_1_4
tags:
- level1-server
- level1-workstation
@ -67,11 +63,10 @@
state: directory
owner: root
group: root
mode: og-rwx
mode: 'og-rwx'
- name: "2.4.1.5 | PATCH | Ensure permissions on /etc/cron.weekly are configured"
when:
- rhel9cis_rule_2_4_1_5
when: rhel9cis_rule_2_4_1_5
tags:
- level1-server
- level1-workstation
@ -84,11 +79,10 @@
state: directory
owner: root
group: root
mode: og-rwx
mode: 'og-rwx'
- name: "2.4.1.6 | PATCH | Ensure permissions on /etc/cron.monthly are configured"
when:
- rhel9cis_rule_2_4_1_6
when: rhel9cis_rule_2_4_1_6
tags:
- level1-server
- level1-workstation
@ -101,11 +95,10 @@
state: directory
owner: root
group: root
mode: og-rwx
mode: 'og-rwx'
- name: "2.4.1.7 | PATCH | Ensure permissions on /etc/cron.d are configured"
when:
- rhel9cis_rule_2_4_1_7
when: rhel9cis_rule_2_4_1_7
tags:
- level1-server
- level1-workstation
@ -119,11 +112,10 @@
state: directory
owner: root
group: root
mode: '0700'
mode: 'og-rwx'
- name: "2.4.1.8 | PATCH | Ensure crontab is restricted to authorized users"
when:
- rhel9cis_rule_2_4_1_8
when: rhel9cis_rule_2_4_1_8
tags:
- level1-server
- level1-workstation
@ -149,11 +141,10 @@
state: '{{ "file" if discovered_cron_allow_state.stat.exists else "touch" }}'
owner: root
group: root
mode: u-x,g-wx,o-rwx
mode: 'u-x,g-wx,o-rwx'
- name: "2.4.2.1 | PATCH | Ensure at is restricted to authorized users"
when:
- rhel9cis_rule_2_4_2_1
when: rhel9cis_rule_2_4_2_1
tags:
- level1-server
- level1-workstation
@ -179,4 +170,4 @@
state: '{{ "file" if discovered_at_allow_state.stat.exists else "touch" }}'
owner: root
group: root
mode: u-x,g-wx,o-rwx
mode: 'u-x,g-wx,o-rwx'

7
tasks/section_3/cis_3.1.x.yml
View file

@ -40,7 +40,7 @@
block:
- name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Check for network-manager tool"
when: "'network-manager' in ansible_facts.packages"
ansible.builtin.shell: nmcli radio wifi
ansible.builtin.command: nmcli radio wifi
changed_when: false
failed_when: false
check_mode: false
@ -50,7 +50,7 @@
when:
- "'network-manager' in ansible_facts.packages"
- "'enabled' in discovered_wifi_status.stdout"
ansible.builtin.shell: nmcli radio all off
ansible.builtin.command: nmcli radio all off
changed_when: discovered_nmcli_radio_off.rc == 0
register: discovered_nmcli_radio_off
@ -65,8 +65,7 @@
file: warning_facts.yml
- name: "3.1.3 | PATCH | Ensure bluetooth services are not in use"
when:
- rhel9cis_rule_3_1_3
when: rhel9cis_rule_3_1_3
tags:
- level1-server
- level2-workstation

24
tasks/section_3/cis_3.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "3.2.1 | PATCH | Ensure dccp kernel module is not available"
when:
- rhel9cis_rule_3_2_1
when: rhel9cis_rule_3_2_1
tags:
- level2-server
- level2-workstation
@ -18,6 +17,7 @@
regexp: '^(#)?install dccp(\\s|$)'
line: "{{ item }}"
create: true
mode: 'go-wx'
loop:
- install dccp /bin/true
- blacklist dccp
@ -28,11 +28,10 @@
regexp: "^(#)?blacklist cramfs(\\s|$)"
line: "blacklist cramfs"
create: true
mode: '0600'
mode: 'go-wx'
- name: "3.2.2 | PATCH | Ensure tipc kernel module is not available"
when:
- rhel9cis_rule_3_2_2
when: rhel9cis_rule_3_2_2
tags:
- level2-server
- level2-workstation
@ -48,6 +47,7 @@
regexp: '^(#)?install tipc(\\s|$)'
line: "{{ item }}"
create: true
mode: 'go-wx'
loop:
- install tipc /bin/true
- blacklist tipc
@ -58,11 +58,10 @@
regexp: "^(#)?blacklist tipc(\\s|$)"
line: "blacklist tipc"
create: true
mode: '0600'
mode: 'go-wx'
- name: "3.2.3 | PATCH | Ensure rds kernel module is not available"
when:
- rhel9cis_rule_3_2_3
when: rhel9cis_rule_3_2_3
tags:
- level2-server
- level2-workstation
@ -78,6 +77,7 @@
regexp: '^(#)?install rds(\\s|$)'
line: "{{ item }}"
create: true
mode: 'go-wx'
loop:
- install rds /bin/true
- blacklist rds
@ -88,11 +88,10 @@
regexp: "^(#)?blacklist rds(\\s|$)"
line: "blacklist rds"
create: true
mode: '0600'
mode: 'go-wx'
- name: "3.2.4 | PATCH | Ensure sctp kernel module is not available"
when:
- rhel9cis_rule_3_2_4
when: rhel9cis_rule_3_2_4
tags:
- level2-server
- level2-workstation
@ -108,6 +107,7 @@
regexp: '^(#)?install sctp(\\s|$)'
line: "{{ item }}"
create: true
mode: 'go-wx'
loop:
- install sctp /bin/true
- blacklist sctp
@ -118,4 +118,4 @@
regexp: "^(#)?blacklist sctp(\\s|$)"
line: "blacklist sctp"
create: true
mode: '0600'
mode: 'go-wx'

24
tasks/section_3/cis_3.3.x.yml
View file

@ -61,8 +61,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.3 | PATCH | Ensure bogus ICMP responses are ignored"
when:
- rhel9cis_rule_3_3_3
when: rhel9cis_rule_3_3_3
tags:
- level1-server
- level1-workstation
@ -85,8 +84,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.4 | PATCH | Ensure broadcast ICMP requests are ignored"
when:
- rhel9cis_rule_3_3_4
when: rhel9cis_rule_3_3_4
tags:
- level1-server
- level1-workstation
@ -109,8 +107,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.5 | PATCH | Ensure ICMP redirects are not accepted"
when:
- rhel9cis_rule_3_3_5
when: rhel9cis_rule_3_3_5
tags:
- level1-server
- level1-workstation
@ -144,8 +141,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.6 | PATCH | Ensure secure ICMP redirects are not accepted"
when:
- rhel9cis_rule_3_3_6
when: rhel9cis_rule_3_3_6
tags:
- level1-server
- level1-workstation
@ -179,8 +175,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
when:
- rhel9cis_rule_3_3_7
when: rhel9cis_rule_3_3_7
tags:
- level1-server
- level1-workstation
@ -203,8 +198,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.8 | PATCH | Ensure source routed packets are not accepted"
when:
- rhel9cis_rule_3_3_8
when: rhel9cis_rule_3_3_8
tags:
- level1-server
- level1-workstation
@ -237,8 +231,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.9 | PATCH | Ensure suspicious packets are logged"
when:
- rhel9cis_rule_3_3_9
when: rhel9cis_rule_3_3_9
tags:
- level1-server
- level1-workstation
@ -257,8 +250,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.10 | PATCH | Ensure TCP SYN Cookies is enabled"
when:
- rhel9cis_rule_3_3_10
when: rhel9cis_rule_3_3_10
tags:
- level1-server
- level1-workstation

5
tasks/section_4/cis_4.1.x.yml
View file

@ -17,8 +17,7 @@
state: present
- name: "4.1.2 | PATCH | Ensure a single firewall configuration utility is in use"
when:
- rhel9cis_rule_4_1_2
when: rhel9cis_rule_4_1_2
tags:
- level1-server
- level1-workstation
@ -52,7 +51,7 @@
name: "{{ rhel9cis_firewall }}"
state: installed
- name: "4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | {{ rhel9cis_firewall }} started and enabled"
- name: "4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | {{ rhel9cis_firewall }} started and enabled" # noqa name[template]
ansible.builtin.systemd:
name: "{{ rhel9cis_firewall }}"
enabled: true

6
tasks/section_4/cis_4.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "4.2.1 | AUDIT | Ensure firewalld drops unnecessary services and ports"
when:
- rhel9cis_rule_4_2_1
when: rhel9cis_rule_4_2_1
tags:
- level1-server
- level1-workstation
@ -25,8 +24,7 @@
- "{{ discovered_services_and_ports.stdout_lines }}"
- name: "4.2.2 | PATCH | Ensure firewalld loopback traffic is configured | firewalld"
when:
- rhel9cis_rule_4_2_2
when: rhel9cis_rule_4_2_2
tags:
- level1-server
- level1-workstation

33
tasks/section_4/cis_4.3.x.yml
View file

@ -8,11 +8,11 @@
- rhel9cis_rule_4_3_3
- rhel9cis_rule_4_3_4
tags: always
ansible.builtin.shell: "nft add table inet {{ rhel9cis_nft_tables_tablename }}"
ansible.builtin.command: "nft add table inet {{ rhel9cis_nft_tables_tablename }}"
changed_when: true
- name: "4.3.1 | PATCH | Ensure nftables base chains exist"
when:
- rhel9cis_rule_4_3_1
when: rhel9cis_rule_4_3_1
tags:
- level1-server
- level1-workstation
@ -52,7 +52,8 @@
- name: "4.3.1 | PATCH | Ensure nftables base chains exist | Create chains if needed"
when: rhel9cis_nft_tables_autochaincreate
ansible.builtin.shell: "{{ item }}"
ansible.builtin.command: "{{ item }}"
changed_when: true
failed_when: false
loop:
- nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
@ -60,8 +61,7 @@
- nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" output { type filter hook output priority 0 \; }
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured"
when:
- rhel9cis_rule_4_3_2
when: rhel9cis_rule_4_3_2
tags:
- level1-server
- level1-workstation
@ -84,31 +84,36 @@
- name: "4.3.2| PATCH | Ensure nftables established connections are configured | Add input tcp established accept policy"
when: '"ip protocol tcp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
ansible.builtin.shell: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
changed_when: true
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add input udp established accept policy"
when: '"ip protocol udp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept
changed_when: true
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add input icmp established accept policy"
when: '"ip protocol icmp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept
changed_when: true
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output tcp new, related, established accept policy"
when: '"ip protocol tcp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept
changed_when: true
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output udp new, related, established accept policy"
when: '"ip protocol udp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept
changed_when: true
- name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output icmp new, related, established accept policy"
when: '"ip protocol icmp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept
changed_when: true
- name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy"
when:
- rhel9cis_rule_4_3_3
when: rhel9cis_rule_4_3_3
tags:
- level1-server
- level1-workstation
@ -144,22 +149,25 @@
- name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic"
when: '"tcp dport ssh accept" not in discovered_nftables_sshallowcheck.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept
changed_when: true
- name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy"
when: '"type filter hook input priority 0; policy drop;" not in discovered_nftables_inputpolicy.stdout'
ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; }
changed_when: true
- name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy"
when: '"type filter hook forward priority 0; policy drop;" not in discovered_nftables_forwardpolicy.stdout'
ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; }
changed_when: true
- name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy"
when: '"type filter hook output priority 0; policy drop;" not in discovered_nftables_outputpolicy.stdout'
ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; }
changed_when: true
- name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured"
when:
- rhel9cis_rule_4_3_4
when: rhel9cis_rule_4_3_4
tags:
- level1-server
- level1-workstation
@ -189,11 +197,14 @@
- name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set iif lo accept rule | nftables"
when: '"iif \"lo\" accept" not in discovered_nftables_iiflo.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept
changed_when: true
- name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set ip sddr rule | nftables"
when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in discovered_nftables_ipsaddr.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop
changed_when: true
- name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set ip6 saddr rule | nftables"
when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in discovered_nftables_ip6saddr.stdout'
ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop
changed_when: true

65
tasks/section_5/cis_5.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.1.1 | PATCH | Ensure permissions on /etc/ssh/sshd_config are configured"
when:
- rhel9cis_rule_5_1_1
when: rhel9cis_rule_5_1_1
tags:
- level1-server
- level1-workstation
@ -16,11 +15,10 @@
path: "/etc/ssh/sshd_config"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.1.2 | PATCH | Ensure permissions on SSH private host key files are configured"
when:
- rhel9cis_rule_5_1_2
when: rhel9cis_rule_5_1_2
tags:
- level1-server
- level1-workstation
@ -50,8 +48,7 @@
label: "{{ item.path }}"
- name: "5.1.3 | PATCH | Ensure permissions on SSH public host key files are configured"
when:
- rhel9cis_rule_5_1_3
when: rhel9cis_rule_5_1_3
tags:
- level1-server
- level1-workstation
@ -98,7 +95,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SSHWEAKCIPHERS.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
notify:
- Update Crypto Policy
- Set Crypto Policy
@ -126,7 +123,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SHA1.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
notify:
- Update Crypto Policy
- Set Crypto Policy
@ -154,7 +151,7 @@
dest: /etc/crypto-policies/policies/modules/NO-SSHWEAKMACS.pmod
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
notify:
- Update Crypto Policy
- Set Crypto Policy
@ -164,8 +161,7 @@
rhel9cis_crypto_policy_module: "{{ rhel9cis_crypto_policy_module + ':' + 'NO-SSHWEAKMACS' }}"
- name: "5.1.7 | PATCH | Ensure sshd access is configured"
when:
- rhel9cis_rule_5_1_7
when: rhel9cis_rule_5_1_7
tags:
- level1-server
- level1-workstation
@ -212,8 +208,7 @@
notify: Restart sshd
- name: "5.1.8 | PATCH | Ensure sshd Banner is configured"
when:
- rhel9cis_rule_5_1_8
when: rhel9cis_rule_5_1_8
tags:
- level1-server
- level1-workstation
@ -231,8 +226,7 @@
line: 'Banner /etc/issue.net'
- name: "5.1.9 | PATCH | Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured"
when:
- rhel9cis_rule_5_1_9
when: rhel9cis_rule_5_1_9
tags:
- level1-server
- level1-workstation
@ -262,8 +256,7 @@
notify: Restart sshd
- name: "5.1.10 | PATCH | Ensure sshd DisableForwarding is enabled"
when:
- rhel9cis_rule_5_1_10
when: rhel9cis_rule_5_1_10
tags:
- level2-server
- level1-workstation
@ -289,8 +282,7 @@
notify: Restart sshd
- name: "5.1.11 | PATCH | Ensure sshd GSSAPIAuthentication is disabled"
when:
- rhel9cis_rule_5_1_11
when: rhel9cis_rule_5_1_11
tags:
- level1-server
- level1-workstation
@ -320,8 +312,7 @@
notify: Restart sshd
- name: "5.1.12 | PATCH | Ensure sshd HostbasedAuthentication is disabled"
when:
- rhel9cis_rule_5_1_12
when: rhel9cis_rule_5_1_12
tags:
- level1-server
- level1-workstation
@ -341,8 +332,7 @@
notify: Restart sshd
- name: "5.1.13 | PATCH | Ensure sshd IgnoreRhosts is enabled"
when:
- rhel9cis_rule_5_1_13
when: rhel9cis_rule_5_1_13
tags:
- level1-server
- level1-workstation
@ -362,8 +352,7 @@
notify: Restart sshd
- name: "5.1.14 | PATCH | Ensure sshd LoginGraceTime is set to one minute or less"
when:
- rhel9cis_rule_5_1_14
when: rhel9cis_rule_5_1_14
tags:
- level1-server
- level1-workstation
@ -379,8 +368,7 @@
notify: Restart sshd
- name: "5.1.15 | PATCH | Ensure sshd LogLevel is appropriate"
when:
- rhel9cis_rule_5_1_15
when: rhel9cis_rule_5_1_15
tags:
- level1-server
- level1-workstation
@ -398,8 +386,7 @@
notify: Restart sshd
- name: "5.1.16 | PATCH | Ensure sshd MaxAuthTries is set to 4 or less"
when:
- rhel9cis_rule_5_1_16
when: rhel9cis_rule_5_1_16
tags:
- level1-server
- level1-workstation
@ -415,8 +402,7 @@
notify: Restart sshd
- name: "5.1.17 | PATCH | Ensure sshd MaxStartups is configured"
when:
- rhel9cis_rule_5_1_17
when: rhel9cis_rule_5_1_17
tags:
- level1-server
- level1-workstation
@ -436,8 +422,7 @@
notify: Restart sshd
- name: "5.1.18 | PATCH | Ensure SSH MaxSessions is set to 10 or less"
when:
- rhel9cis_rule_5_1_18
when: rhel9cis_rule_5_1_18
tags:
- level1-server
- level1-workstation
@ -457,8 +442,7 @@
notify: Restart sshd
- name: "5.1.19 | PATCH | Ensure sshd PermitEmptyPasswords is disabled"
when:
- rhel9cis_rule_5_1_19
when: rhel9cis_rule_5_1_19
tags:
- level1-server
- level1-workstation
@ -478,8 +462,7 @@
notify: Restart sshd
- name: "5.1.20 | PATCH | Ensure sshd PermitRootLogin is disabled"
when:
- rhel9cis_rule_5_1_20
when: rhel9cis_rule_5_1_20
tags:
- level1-server
- level1-workstation
@ -503,8 +486,7 @@
notify: Restart sshd
- name: "5.1.21 | PATCH | Ensure sshd PermitUserEnvironment is disabled"
when:
- rhel9cis_rule_5_1_21
when: rhel9cis_rule_5_1_21
tags:
- level1-server
- level1-workstation
@ -524,8 +506,7 @@
notify: Restart sshd
- name: "5.1.22 | PATCH | Ensure SSH PAM is enabled"
when:
- rhel9cis_rule_5_1_22
when: rhel9cis_rule_5_1_22
tags:
- level1-server
- level1-workstation

21
tasks/section_5/cis_5.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.2.1 | PATCH | Ensure sudo is installed"
when:
- rhel9cis_rule_5_2_1
when: rhel9cis_rule_5_2_1
tags:
- level1-server
- level1-workstation
@ -15,8 +14,7 @@
state: present
- name: "5.2.2 | PATCH | Ensure sudo commands use pty"
when:
- rhel9cis_rule_5_2_2
when: rhel9cis_rule_5_2_2
tags:
- level1-server
- level1-workstation
@ -30,8 +28,7 @@
validate: '/usr/sbin/visudo -cf %s'
- name: "5.2.3 | PATCH | Ensure sudo log file exists"
when:
- rhel9cis_rule_5_2_3
when: rhel9cis_rule_5_2_3
tags:
- level1-server
- level1-workstation
@ -47,8 +44,7 @@
validate: '/usr/sbin/visudo -cf %s'
- name: "5.2.4 | PATCH | Ensure users must provide password for escalation"
when:
- rhel9cis_rule_5_2_4
when: rhel9cis_rule_5_2_4
tags:
- level2-server
- level2-workstation
@ -74,8 +70,7 @@
loop: "{{ discovered_nopasswd_sudoers.stdout_lines }}"
- name: "5.2.5 | PATCH | Ensure re-authentication for privilege escalation is not disabled globally"
when:
- rhel9cis_rule_5_2_5
when: rhel9cis_rule_5_2_5
tags:
- level1-server
- level1-workstation
@ -101,8 +96,7 @@
loop: "{{ discovered_priv_reauth.stdout_lines }}"
- name: "5.2.6 | PATCH | Ensure sudo authentication timeout is configured correctly"
when:
- rhel9cis_rule_5_2_6
when: rhel9cis_rule_5_2_6
tags:
- level1-server
- level1-workstation
@ -134,8 +128,7 @@
loop: "{{ discovered_sudo_timeout_files.stdout_lines }}"
- name: "5.2.7 | PATCH | Ensure access to the su command is restricted"
when:
- rhel9cis_rule_5_2_7
when: rhel9cis_rule_5_2_7
tags:
- level1-server
- level1-workstation

35
tasks/section_5/cis_5.3.2.x.yml
View file

@ -17,12 +17,13 @@
when:
- rhel9cis_authselect_custom_profile_name not in prelim_authselect_current_profile.stdout or
prelim_authselect_current_profile.stdout is not defined
ansible.builtin.shell: "/usr/bin/authselect create-profile {{ rhel9cis_authselect_custom_profile_name }} -b {{ rhel9cis_authselect_default_profile_to_copy }}"
ansible.builtin.command: "/usr/bin/authselect create-profile {{ rhel9cis_authselect_custom_profile_name }} -b {{ rhel9cis_authselect_default_profile_to_copy }}"
changed_when: true
args:
creates: "/etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}"
- name: "5.3.2.1 | AUDIT | Ensure active authselect profile includes pam modules | get profile features"
ansible.builtin.shell: "/usr/bin/authselect list-features custom/{{ rhel9cis_authselect_custom_profile_name }}"
ansible.builtin.command: "/usr/bin/authselect list-features custom/{{ rhel9cis_authselect_custom_profile_name }}"
changed_when: false
register: discovered_authselect_profile_features
@ -37,7 +38,8 @@
- password
- name: "5.3.2.1 | PATCH | Ensure active authselect profile includes pam modules | Backup and Add pam modules"
ansible.builtin.shell: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %} --force --backup=rhel9cis-preremediate-{{ lookup('pipe', 'date +%Y-%m-%d-%H%M') }}"
ansible.builtin.command: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %} --force --backup=rhel9cis-preremediate-{{ lookup('pipe', 'date +%Y-%m-%d-%H%M') }}"
changed_when: true
- name: "5.3.2.2 | PATCH | Ensure pam_faillock module is enabled"
when:
@ -64,9 +66,11 @@
failed_when: discovered_authselect_current_faillock.rc not in [ 0, 1 ]
register: discovered_authselect_current_faillock
- name: "5.3.2.2 | AUDIT | Ensure pam_faillock module is enabled | Add feature if missing"
- name: "5.3.2.2 | AUDIT | Ensure pam_faillock module is enabled | Add feature if missing" # noqa syntax-check[specific]"
when: discovered_authselect_current_faillock.rc != 0
ansible.builtin.shell: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
ansible.builtin.command: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
changed_when: true
notify: Authselect update
- name: "5.3.2.3 | PATCH | Ensure pam_pwquality module is enabled"
when:
@ -90,7 +94,8 @@
- name: "5.3.2.3 | AUDIT | Ensure pam_pwquality module is enabled | Add feature if missing"
when: discovered_authselect_current_quality.rc != 0
ansible.builtin.shell: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
ansible.builtin.command: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
changed_when: true
notify: Authselect update
- name: "5.3.2.4 | PATCH | Ensure pam_pwhistory module is enabled"
@ -115,7 +120,8 @@
- name: "5.3.2.4 | PATCH | Ensure pam_pwhistory module is enabled | enable feature"
when: discovered_authselect_current_history.rc != 0
ansible.builtin.shell: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
ansible.builtin.command: "/usr/bin/authselect select custom/{{ rhel9cis_authselect_custom_profile_name }}{% if rhel9cis_rule_5_3_2_2 %} with-faillock{% endif %}{% if rhel9cis_rule_5_3_2_3 %} with-pwquality{% endif %}{% if rhel9cis_rule_5_3_2_4 %} with-pwhistory{% endif %}{% if rhel9cis_rule_5_3_3_4_1 %} without-nullok{% endif %}"
changed_when: true
notify: Authselect update
- name: "5.3.2.5 | PATCH | Ensure pam_unix module is enabled"
@ -133,8 +139,7 @@
- rule_5.3.2.5
block:
- name: "5.3.2.5 | AUDIT | Ensure pam_unix module is enabled"
ansible.builtin.shell: |
grep -P -- '\b(pam_unix\.so)\b' /etc/authselect/"$(head -1 /etc/authselect/authselect.conf)"/{system,password}-auth
ansible.builtin.command: grep -P -- '\b(pam_unix\.so)\b' /etc/authselect/"$(head -1 /etc/authselect/authselect.conf)"/{system,password}-auth
changed_when: false
failed_when: discovered_discovered_authselect_pam_unix.rc not in [ 0, 1 ]
register: discovered_discovered_authselect_pam_unix
@ -142,12 +147,12 @@
- name: "5.3.2.5 | PATCH | Ensure pam_unix module is enabled | system-auth"
when: "'system-auth:password' not in discovered_authselect_pam_unix.stdout"
ansible.builtin.lineinfile:
path: /etc/authselect/custom/{{ rhel9cis_authselect['custom_profile_name'] }}/system-auth
path: /etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/system-auth
regexp: "{{ item.regexp }}"
line: "{{ item.line }}"
backrefs: true
insertafter: "{{ item.after | default (omit) }}"
insertbefore: "{{ item.before | default (omit) }}"
insertafter: "{{ item.after | default(omit) }}"
insertbefore: "{{ item.before | default(omit) }}"
loop:
- { regexp: '^(auth\s+)sufficient(\s+pam_unix.so.*)(.*)', line: '\1sufficient\2\3', after: '^auth.*pam_faillock.*preauth' }
- { regexp: '^(password\s+)sufficient(\s+pam_unix.so.*)(.*)', line: '\1sufficient\2\3', before: '^password.*pam_deny.so' }
@ -156,12 +161,12 @@
- name: "5.3.2.5 | PATCH | Ensure pam_unix module is enabled | password-auth"
when: "'password-auth:password' not in discovered_authselect_pam_unix.stdout"
ansible.builtin.lineinfile:
path: /etc/authselect/custom/{{ rhel9cis_authselect['custom_profile_name'] }}/password-auth
path: /etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/password-auth
line: "{{ item.line }}"
regexp: "{{ item.regexp }}"
backrefs: true
insertafter: "{{ item.after | default (omit) }}"
insertbefore: "{{ item.before | default (omit) }}"
insertafter: "{{ item.after | default(omit) }}"
insertbefore: "{{ item.before | default(omit) }}"
loop:
- { regexp: '^(auth\s+)sufficient(\s+pam_unix.so.*)(.*)', line: '\1sufficient\2\2', after: '^auth.*pam_faillock.*preauth' }
- { regexp: '^(password\s+)sufficient(\s+pam_unix.so.*)(.*)', line: '\1sufficient\2\3', before: '^password.*pam_deny.so' }

10
tasks/section_5/cis_5.3.3.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.3.3.1.1 | PATCH | Ensure password failed attempts lockout is configured"
when:
- rhel9cis_rule_5_3_3_1_1
when: rhel9cis_rule_5_3_3_1_1
tags:
- level1-server
- level1-workstation
@ -44,8 +43,7 @@
notify: Authselect update
- name: "5.3.3.1.2 | PATCH | Ensure password unlock time is configured"
when:
- rhel9cis_rule_5_3_3_1_2
when: rhel9cis_rule_5_3_3_1_2
tags:
- level1-server
- level1-workstation
@ -87,8 +85,7 @@
notify: Authselect update
- name: "5.3.3.1.3 | PATCH | Ensure password failed attempts lockout includes root account"
when:
- rhel9cis_rule_5_3_3_1_3
when: rhel9cis_rule_5_3_3_1_3
tags:
- level1-server
- level1-workstation
@ -104,6 +101,7 @@
line: "{{ rhel9cis_pamroot_lock_option }}"
insertafter: '^# end of pam-auth-update config'
create: true
mode: 'go-rwx'
- name: "5.3.3.1.3 | PATCH | Ensure password failed attempts lockout includes root account | remove lockout from pam files NOT AuthSelect"
when:

38
tasks/section_5/cis_5.3.3.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured"
when:
- rhel9cis_rule_5_3_3_2_1
when: rhel9cis_rule_5_3_3_2_1
tags:
- level1-server
- level1-workstation
@ -30,7 +29,7 @@
dest: "/{{ rhel9cis_passwd_difok_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Remove difok from pam files Not AuthSelect"
when:
@ -58,8 +57,7 @@
notify: Authselect update
- name: "5.3.3.2.2 | PATCH | Ensure password length is configured"
when:
- rhel9cis_rule_5_3_3_2_2
when: rhel9cis_rule_5_3_3_2_2
tags:
- level1-server
- level1-workstation
@ -87,7 +85,7 @@
dest: "/{{ rhel9cis_passwd_minlen_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Remove minlen from pam files NOT AuthSelect"
when:
@ -115,8 +113,7 @@
notify: Authselect update
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured"
when:
- rhel9cis_rule_5_3_3_2_3
when: rhel9cis_rule_5_3_3_2_3
tags:
- level1-server
- level1-workstation
@ -144,7 +141,7 @@
dest: "/{{ rhel9cis_passwd_complex_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Remove complexity from pam files NOT AuthSelect"
when:
@ -172,8 +169,7 @@
notify: Authselect update
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured"
when:
- rhel9cis_rule_5_3_3_2_4
when: rhel9cis_rule_5_3_3_2_4
tags:
- level1-server
- level1-workstation
@ -183,8 +179,7 @@
- pam
block:
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Remove maxrepeat settings from conf files except expected file"
when:
- item != rhel9cis_passwd_maxrepeat_file
when: item != rhel9cis_passwd_maxrepeat_file
ansible.builtin.replace:
path: "{{ item }}"
regexp: 'maxrepeat\s*=\s*\d+\b'
@ -200,7 +195,7 @@
dest: "/{{ rhel9cis_passwd_maxrepeat_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Remove maxrepeat from pam files NOT AuthSelect"
when:
@ -228,8 +223,7 @@
notify: Authselect update
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is is configured"
when:
- rhel9cis_rule_5_3_3_2_5
when: rhel9cis_rule_5_3_3_2_5
tags:
- level1-server
- level1-workstation
@ -257,7 +251,7 @@
dest: "/{{ rhel9cis_passwd_maxsequence_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Remove maxsequence from pam files NOT AuthSelect"
when:
@ -285,8 +279,7 @@
notify: Authselect update
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled"
when:
- rhel9cis_rule_5_3_3_2_6
when: rhel9cis_rule_5_3_3_2_6
tags:
- level1-server
- level1-workstation
@ -313,7 +306,7 @@
dest: "/{{ rhel9cis_passwd_dictcheck_file }}"
owner: root
group: root
mode: '0600'
mode: 'go-rwx'
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Remove dictcheck from pam files NOT AuthSelect"
when:
@ -342,8 +335,7 @@
notify: Authselect update
- name: "5.3.3.2.7 | PATCH | Ensure password quality is enforced for the root user"
when:
- rhel9cis_rule_5_3_3_2_7
when: rhel9cis_rule_5_3_3_2_7
tags:
- level1-server
- level1-workstation
@ -356,4 +348,4 @@
dest: "/{{ rhel9cis_passwd_quality_enforce_root_file }}"
owner: root
group: root
mode: '0600'
mode: 'o-rwx'

9
tasks/section_5/cis_5.3.3.3.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.3.3.3.1 | PATCH | Ensure password history remember is configured"
when:
- rhel9cis_rule_5_3_3_3_1
when: rhel9cis_rule_5_3_3_3_1
tags:
- level1-server
- level1-workstation
@ -48,8 +47,7 @@
notify: Authselect update
- name: "5.3.3.3.2 | PATCH | Ensure password history is enforced for the root user"
when:
- rhel9cis_rule_5_3_3_3_2
when: rhel9cis_rule_5_3_3_3_2
tags:
- level1-server
- level1-workstation
@ -95,8 +93,7 @@
notify: Authselect update
- name: "5.3.3.3.3 | PATCH | Ensure pam_pwhistory includes use_authtok"
when:
- rhel9cis_rule_5_3_3_3_3
when: rhel9cis_rule_5_3_3_3_3
tags:
- level1-server
- level1-workstation

12
tasks/section_5/cis_5.3.3.4.x.yml
View file

@ -28,8 +28,7 @@
loop: "{{ discovered_pam_nullok.stdout_lines }}"
- name: "5.3.3.4.1 | PATCH | Ensure password number of changed characters is configured | Remove nullok from pam files AuthSelect"
when:
- rhel9cis_allow_authselect_updates
when: rhel9cis_allow_authselect_updates
ansible.builtin.replace:
path: "/etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/{{ item }}-auth"
regexp: ^(\s*password\s+(requisite|required|sufficient)\s+pam_unix\.so)(.*)\snullok(.*$)
@ -67,8 +66,7 @@
loop: "{{ discovered_pam_remember.stdout_lines }}"
- name: "5.3.3.4.2 | PATCH | Ensure pam_unix does not include remember | Remove remember from pam files AuthSelect"
when:
- rhel9cis_allow_authselect_updates
when: rhel9cis_allow_authselect_updates
ansible.builtin.replace:
path: "/etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/{{ item }}-auth"
regexp: ^(\s*password\s+(requisite|required|sufficient)\s+pam_unix\.so)(.*)\sremember\s*=\s*=\d*(.*$)
@ -107,8 +105,7 @@
loop: "{{ discovered_pam_remember.stdout_lines }}"
- name: "5.3.3.4.3 | PATCH | Ensure pam_unix includes a strong password hashing algorithm | Add hash algorithm to pam files AuthSelect"
when:
- rhel9cis_allow_authselect_updates
when: rhel9cis_allow_authselect_updates
ansible.builtin.lineinfile:
path: "/etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/{{ item }}-auth"
regexp: ^(\s*password\s+)(requisite|required|sufficient)(\s+pam_unix.so\s)(.*)(sha512|yescrypt)(.*$)
@ -150,8 +147,7 @@
loop: "{{ discovered_pam_authtok.stdout_lines }}"
- name: "5.3.3.4.4 | PATCH | Ensure pam_unix includes use_authtok | Add use_authtok pam files AuthSelect"
when:
- rhel9cis_allow_authselect_updates
when: rhel9cis_allow_authselect_updates
ansible.builtin.lineinfile:
path: "/etc/authselect/custom/{{ rhel9cis_authselect_custom_profile_name }}/{{ item }}-auth"
regexp: ^(\s*password\s+)(requisite|required|sufficient)(\s+pam_unix.so\s)(.*)use_authtok(.*$)

42
tasks/section_5/cis_5.4.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.4.1.1 | PATCH | Ensure password expiration is 365 days or less"
when:
- rhel9cis_rule_5_4_1_1
when: rhel9cis_rule_5_4_1_1
tags:
- level1-server
- level1-workstation
@ -38,8 +37,7 @@
loop: "{{ discovered_max_days.stdout_lines }}"
- name: "5.4.1.2 | PATCH | Ensure minimum password days is configured"
when:
- rhel9cis_rule_5_4_1_2
when: rhel9cis_rule_5_4_1_2
tags:
- level1-server
- level1-workstation
@ -70,8 +68,7 @@
loop: "{{ discovered_min_days.stdout_lines }}"
- name: "5.4.1.3 | PATCH | Ensure password expiration warning days is configured"
when:
- rhel9cis_rule_5_4_1_3
when: rhel9cis_rule_5_4_1_3
tags:
- level1-server
- level1-workstation
@ -96,12 +93,12 @@
- discovered_warn_days.stdout_lines | length > 0
- item in prelim_interactive_usernames.stdout
- rhel9cis_force_user_warnage
ansible.builtin.shell: "chage --warndays {{ rhel9cis_pass['warn_age'] }} {{ item }}"
ansible.builtin.command: "chage --warndays {{ rhel9cis_pass['warn_age'] }} {{ item }}"
changed_when: true
loop: "{{ discovered_warn_days.stdout_lines }}"
- name: "5.4.1.4 | PATCH | Ensure strong password hashing algorithm is configured"
when:
- rhel9cis_rule_5_4_1_4
when: rhel9cis_rule_5_4_1_4
tags:
- level1-server
- level1-workstation
@ -115,8 +112,7 @@
line: 'ENCRYPT_METHOD {{ rhel9cis_passwd_hash_algo | upper }}'
- name: "5.4.1.5 | PATCH | Ensure inactive password lock is configured"
when:
- rhel9cis_rule_5_4_1_5
when: rhel9cis_rule_5_4_1_5
tags:
- level1-server
- level1-workstation
@ -132,23 +128,24 @@
register: discovered_passwdlck_inactive_settings
- name: "5.4.1.5 | PATCH | Ensure inactive password lock is configured | Set default inactive setting"
ansible.builtin.shell: useradd -D -f {{ rhel9cis_inactivelock.lock_days }}
ansible.builtin.command: useradd -D -f {{ rhel9cis_inactivelock.lock_days }}
changed_when: true
when: discovered_passwdlck_inactive_settings.stdout | length == 0
- name: "5.4.1.5 | AUDIT | Ensure inactive password lock is 30 days or less | Getting user list"
ansible.builtin.shell: "awk -F: '/^[^#:]+:[^\\!\\*:]*:[^:]*:[^:]*:[^:]*:[^:]*:(\\s*|-1|3[1-9]|[4-9][0-9]|[1-9][0-9][0-9]+):[^:]*:[^:]*\\s*$/ {print $1}' /etc/shadow"
ansible.builtin.command: "awk -F: '/^[^#:]+:[^\\!\\*:]*:[^:]*:[^:]*:[^:]*:[^:]*:(\\s*|-1|3[1-9]|[4-9][0-9]|[1-9][0-9][0-9]+):[^:]*:[^:]*\\s*$/ {print $1}' /etc/shadow"
changed_when: false
check_mode: false
register: discovered_passwdlck_user_list
- name: "5.4.1.5 | PATCH | Ensure inactive password lock is 30 days or less | Apply Inactive setting to existing accounts"
when: item in prelim_interactive_usernames.stdout
ansible.builtin.shell: chage --inactive {{ rhel9cis_inactivelock.lock_days }} "{{ item }}"
ansible.builtin.command: chage --inactive {{ rhel9cis_inactivelock.lock_days }} "{{ item }}"
changed_when: true
loop: "{{ discovered_passwdlck_user_list.stdout_lines }}"
- name: "5.4.1.6 | PATCH | Ensure all users last password change date is in the past"
when:
- rhel9cis_rule_5_4_1_6
when: rhel9cis_rule_5_4_1_6
tags:
- level1-server
- level1-workstation
@ -172,22 +169,23 @@
register: discovered_passwdlck_user_future
- name: "5.4.1.6 | AUDIT | Ensure all users last password change date is in the past | Alert on accounts with pw change in the future"
when:
- discovered_passwdlck_user_future.stdout | length > 0
- not rhel9cis_futurepwchgdate_autofix
ansible.builtin.debug:
msg: "Warning!! The following accounts have the last PW change date in the future: {{ discovered_passwdlck_user_future.stdout_lines }}"
when:
- discovered_passwdlck_user_future.stdout | length > 0
- not rhel9cis_futurepwchgdate_autofix
- name: "5.4.1.6 | AUDIT | Ensure all users last password change date is in the past | warning count"
ansible.builtin.import_tasks:
file: warning_facts.yml
when:
- discovered_passwdlck_user_future.stdout | length > 0
- not rhel9cis_futurepwchgdate_autofix
ansible.builtin.import_tasks:
file: warning_facts.yml
- name: "5.4.1.6 | PATCH | Ensure all users last password change date is in the past | Fix accounts with pw change in the future"
ansible.builtin.shell: passwd --expire {{ item }}
when:
- discovered_passwdlck_user_future.stdout | length > 0
- rhel9cis_futurepwchgdate_autofix
ansible.builtin.command: passwd --expire {{ item }}
changed_when: true
loop: "{{ discovered_passwdlck_user_future.stdout_lines }}"

19
tasks/section_5/cis_5.4.2.x.yml
View file

@ -17,7 +17,7 @@
- NIST800-53R5_CM-6
- NIST800-53R5_CM-7
- NIST800-53R5_IA-5
ansible.builtin.shell: passwd -l {{ item }}
ansible.builtin.command: passwd -l {{ item }}
changed_when: false
failed_when: false
loop: "{{ prelim_uid_zero_accounts_except_root.stdout_lines }}"
@ -56,8 +56,7 @@
loop: "{{ discovered_gid0_members.stdout_lines }}"
- name: "5.4.2.3 | AUDIT | Ensure group root is the only GID 0 group"
when:
- rhel9cis_rule_5_4_2_3
when: rhel9cis_rule_5_4_2_3
tags:
- level1-server
- level1-workstation
@ -96,8 +95,7 @@
warn_control_id: '5.4.2.3'
- name: "5.4.2.4 | PATCH | Ensure root account access is controlled "
when:
- rhel9cis_rule_5_4_2_4
when: rhel9cis_rule_5_4_2_4
tags:
- level1-server
- level1-workstation
@ -108,8 +106,7 @@
msg: "This is set as an assert in tasks/main"
- name: "5.4.2.5 | PATCH | Ensure root PATH Integrity"
when:
- rhel9cis_rule_5_4_2_5
when: rhel9cis_rule_5_4_2_5
tags:
- level1-server
- level1-workstation
@ -172,15 +169,14 @@
state: directory
owner: root
group: root
mode: '0755'
mode: 'go-w'
follow: false
loop: "{{ discovered_root_path_perms.results }}"
loop_control:
label: "{{ item }}"
- name: "5.4.2.6 | PATCH | Ensure root user umask is configured"
when:
- rhel9cis_rule_5_4_2_6
when: rhel9cis_rule_5_4_2_6
tags:
- level1-server
- level1-workstation
@ -194,6 +190,9 @@
regexp: \s*umask
line: "umask {{ rhel9cis_root_umask }}"
create: true
owner: root
group: root
mode: 'go-rwx'
- name: "5.4.2.7 | PATCH | Ensure system accounts do not have a valid login shell"
when:

11
tasks/section_5/cis_5.4.3.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "5.4.3.1 | PATCH | Ensure nologin is not listed in /etc/shells"
when:
- rhel9cis_rule_5_4_3_1
when: rhel9cis_rule_5_4_3_1
tags:
- level2-server
- level2-workstation
@ -20,8 +19,7 @@
replace: ""
- name: "5.4.3.2 | PATCH | Ensure default user shell timeout is configured"
when:
- rhel9cis_rule_5_4_3_2
when: rhel9cis_rule_5_4_3_2
tags:
- level1-server
- level1-workstation
@ -33,7 +31,7 @@
state: "{{ item.state }}"
marker: "# {mark} - CIS benchmark - Ansible-lockdown"
create: true
mode: '0644'
mode: 'go-wx'
block: |
TMOUT={{ rhel9cis_shell_session_timeout }}
readonly TMOUT
@ -43,8 +41,7 @@
- { path: /etc/profile, state: "{{ (rhel9cis_shell_session_file == '/etc/profile') | ternary('present', 'absent') }}" }
- name: "5.4.3.3 | PATCH | Ensure default user umask is configured"
when:
- rhel9cis_rule_5_4_3_3
when: rhel9cis_rule_5_4_3_3
tags:
- level1-server
- level1-workstation

12
tasks/section_6/cis_6.1.x.yml
View file

@ -19,10 +19,11 @@
register: discovered_aide_installed
- name: "6.1.1 | PATCH | Ensure AIDE is installed| Build AIDE DB"
when: discovered_aide_installed.changed # noqa: no-handler
when: discovered_aide_installed.changed # noqa no-handler
block:
- name: "6.1.1 | PATCH | Ensure AIDE is installed| Build AIDE DB"
ansible.builtin.shell: /usr/sbin/aide --init
ansible.builtin.command: /usr/sbin/aide --init
changed_when: true
- name: "6.1.1 | PATCH | Ensure AIDE is installed| Build AIDE DB | Wait for file before continuing"
ansible.builtin.wait_for:
@ -33,6 +34,7 @@
src: /var/lib/aide/aide.db.new.gz
dest: /var/lib/aide/aide.db.gz
remote_src: true
mode: 'go-wx'
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked"
when:
@ -62,15 +64,15 @@
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
when: rhel9cis_aide_scan == "timer"
ansible.builtin.systemd:
ansible.builtin.systemd_service:
name: aidecheck.service
enabled: true
- name: "6.1.2 | PATCH | Ensure filesystem integrity is regularly checked | aide service"
when: rhel9cis_aide_scan == "timer"
ansible.builtin.systemd:
ansible.builtin.systemd_service:
name: aidecheck.timer
state: running
state: started
enabled: true
- name: "6.1.3 | PATCH | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"

16
tasks/section_6/cis_6.2.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.1.1 | PATCH | Ensure journald service is enabled and active"
when:
- rhel9cis_rule_6_2_1_1
when: rhel9cis_rule_6_2_1_1
tags:
- level1-server
- level1-workstation
@ -15,8 +14,7 @@
state: started
- name: "6.2.1.2 | PATCH | Ensure journald log file access is configured"
when:
- rhel9cis_rule_6_2_1_2
when: rhel9cis_rule_6_2_1_2
tags:
- level1-server
- level1-workstation
@ -27,7 +25,7 @@
- name: "6.2.1.2 | PATCH | Ensure journald log file access is configured | Default file permissions"
ansible.builtin.file:
path: /usr/lib/tmpfiles.d/systemd.conf
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | Check for override file"
ansible.builtin.stat:
@ -58,8 +56,7 @@
warn_control_id: '6.2.1.2'
- name: "6.2.1.3 | PATCH | Ensure journald log file rotation is configured"
when:
- rhel9cis_rule_6_2_1_3
when: rhel9cis_rule_6_2_1_3
tags:
- level1-server
- level1-workstation
@ -74,7 +71,7 @@
dest: /etc/systemd/journald.conf.d/rotation.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.1.3 | PATCH | Ensure journald log file rotation is configured | comment out current entries"
ansible.builtin.replace:
@ -89,8 +86,7 @@
- '^(\s*MaxFileSec\s*=.*)'
- name: "6.2.1.4 | PATCH | Ensure only one logging system is in use"
when:
- rhel9cis_rule_6_2_1_4
when: rhel9cis_rule_6_2_1_4
tags:
- level1-server
- level1-workstation

15
tasks/section_6/cis_6.2.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled"
when:
- rhel9cis_rule_6_2_2_2
when: rhel9cis_rule_6_2_2_2
tags:
- level1-server
- level2-workstation
@ -21,7 +20,7 @@
dest: /etc/systemd/journald.conf.d/forwardtosyslog.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | comment out current entries"
ansible.builtin.replace:
@ -30,8 +29,7 @@
replace: '#\1'
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured"
when:
- rhel9cis_rule_6_2_2_3
when: rhel9cis_rule_6_2_2_3
tags:
- level1-server
- level1-workstation
@ -47,7 +45,7 @@
dest: /etc/systemd/journald.conf.d/storage.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | comment out current entries"
ansible.builtin.replace:
@ -56,8 +54,7 @@
replace: '#\1'
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured"
when:
- rhel9cis_rule_6_2_2_4
when: rhel9cis_rule_6_2_2_4
tags:
- level1-server
- level1-workstation
@ -74,7 +71,7 @@
dest: /etc/systemd/journald.conf.d/storage.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | comment out current entries"
ansible.builtin.replace:

20
tasks/section_6/cis_6.2.3.x.yml
View file

@ -18,8 +18,7 @@
state: present
- name: "6.2.3.2 | PATCH | Ensure rsyslog Service is enabled and active"
when:
- rhel9cis_rule_6_2_3_2
when: rhel9cis_rule_6_2_3_2
tags:
- level1-server
- level1-workstation
@ -35,8 +34,7 @@
state: started
- name: "6.2.3.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
when:
- rhel9cis_rule_6_2_3_3
when: rhel9cis_rule_6_2_3_3
tags:
- level1-server
- level1-workstation
@ -54,8 +52,7 @@
notify: Restart rsyslog
- name: "6.2.3.4 | PATCH | Ensure rsyslog log file creation mode is configured"
when:
- rhel9cis_rule_6_2_3_4
when: rhel9cis_rule_6_2_3_4
tags:
- level1-server
- level1-workstation
@ -72,8 +69,7 @@
notify: Restart rsyslog
- name: "6.2.3.5 | PATCH | Ensure logging is configured"
when:
- rhel9cis_rule_6_2_3_5
when: rhel9cis_rule_6_2_3_5
tags:
- level1-server
- level1-workstation
@ -200,8 +196,7 @@
notify: Restart rsyslog
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
when:
- rhel9cis_rule_6_2_3_7
when: rhel9cis_rule_6_2_3_7
tags:
- level1-server
- level1-workstation
@ -238,8 +233,7 @@
- 'InputTCPServerRun'
- name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured"
when:
- rhel9cis_rule_6_2_3_8
when: rhel9cis_rule_6_2_3_8
tags:
- level1-server
- level1-workstation
@ -266,4 +260,4 @@
dest: /etc/logrotate.d/rsyslog.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'

3
tasks/section_6/cis_6.2.4.1.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured"
when:
- rhel9cis_rule_6_2_4_1
when: rhel9cis_rule_6_2_4_1
tags:
- level1-server
- level1-workstation

22
tasks/section_6/cis_6.3.1.x.yml
View file

@ -27,8 +27,7 @@
state: present
- name: "6.3.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled"
when:
- rhel9cis_rule_6_3_1_2
when: rhel9cis_rule_6_3_1_2
tags:
- level2-server
- level2-workstation
@ -49,11 +48,11 @@
- discovered_grubby_curr_value_audit_linux.stdout == '' or
'0' in discovered_grubby_curr_value_audit_linux.stdout or
'off' in discovered_grubby_curr_value_audit_linux.stdout|lower
ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1"
ansible.builtin.command: grubby --update-kernel=ALL --args="audit=1"
changed_when: true
- name: "6.3.1.3 | PATCH | Ensure audit_backlog_limit is sufficient"
when:
- rhel9cis_rule_6_3_1_3
when: rhel9cis_rule_6_3_1_3
tags:
- level2-server
- level2-workstation
@ -81,21 +80,18 @@
discovered_reset_backlog_limits: true
- name: "6.3.1.3 | AUDIT | Check to see if any limits are too low"
when:
- (item | int < rhel9cis_audit_back_log_limit)
when: (item | int < rhel9cis_audit_back_log_limit)
ansible.builtin.set_fact:
discovered_reset_backlog_limits: true
loop: "{{ discovered_grubby_curr_value_backlog_linux.stdout_lines }}"
- name: "6.3.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update applied"
when:
- discovered_reset_backlog_limits is defined
ansible.builtin.shell:
cmd: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'
when: discovered_reset_backlog_limits is defined
ansible.builtin.command: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'
changed_when: true
- name: "6.3.1.4 | PATCH | Ensure auditd service is enabled and active"
when:
- rhel9cis_rule_6_3_1_4
when: rhel9cis_rule_6_3_1_4
tags:
- level2-server
- level2-workstation

12
tasks/section_6/cis_6.3.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.3.2.1 | PATCH | Ensure audit log storage size is configured"
when:
- rhel9cis_rule_6_3_2_1
when: rhel9cis_rule_6_3_2_1
tags:
- level2-server
- level2-workstation
@ -17,8 +16,7 @@
notify: Restart auditd
- name: "6.3.2.2 | PATCH | Ensure audit logs are not automatically deleted"
when:
- rhel9cis_rule_6_3_2_2
when: rhel9cis_rule_6_3_2_2
tags:
- level2-server
- level2-workstation
@ -33,8 +31,7 @@
notify: Restart auditd
- name: "6.3.2.3 | PATCH | Ensure system is disabled when audit logs are full"
when:
- rhel9cis_rule_6_3_2_3
when: rhel9cis_rule_6_3_2_3
tags:
- level2-server
- level2-workstation
@ -55,8 +52,7 @@
- { regexp: '^disk_error_action', line: 'disk_error_action = {{ rhel9cis_auditd_disk_error_action }}' }
- name: "6.3.2.4 | PATCH | Ensure system warns when audit logs are low on space"
when:
- rhel9cis_rule_6_3_2_4
when: rhel9cis_rule_6_3_2_4
tags:
- level2-server
- level2-workstation

66
tasks/section_6/cis_6.3.3.x.yml
View file

@ -2,8 +2,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.1 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
when:
- rhel9cis_rule_6_3_3_1
when: rhel9cis_rule_6_3_3_1
tags:
- level2-server
- level2-workstation
@ -16,8 +15,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.2 | PATCH | Ensure actions as another user are always logged"
when:
- rhel9cis_rule_6_3_3_2
when: rhel9cis_rule_6_3_3_2
tags:
- level2-server
- level2-workstation
@ -30,8 +28,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.3 | PATCH | Ensure events that modify the sudo log file are collected"
when:
- rhel9cis_rule_6_3_3_3
when: rhel9cis_rule_6_3_3_3
tags:
- level2-server
- level2-workstation
@ -43,8 +40,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.4 | PATCH | Ensure events that modify date and time information are collected"
when:
- rhel9cis_rule_6_3_3_4
when: rhel9cis_rule_6_3_3_4
tags:
- level2-server
- level2-workstation
@ -58,8 +54,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.5 | PATCH | Ensure events that modify the system's network environment are collected"
when:
- rhel9cis_rule_6_3_3_5
when: rhel9cis_rule_6_3_3_5
tags:
- level2-server
- level2-workstation
@ -73,8 +68,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.6 | PATCH | Ensure use of privileged commands is collected"
when:
- rhel9cis_rule_6_3_3_6
when: rhel9cis_rule_6_3_3_6
tags:
- level2-server
- level2-workstation
@ -97,8 +91,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.7 | PATCH | Ensure unsuccessful file access attempts are collected"
when:
- rhel9cis_rule_6_3_3_7
when: rhel9cis_rule_6_3_3_7
tags:
- level2-server
- level2-workstation
@ -111,8 +104,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.8 | PATCH | Ensure events that modify user/group information are collected"
when:
- rhel9cis_rule_6_3_3_8
when: rhel9cis_rule_6_3_3_8
tags:
- level2-server
- level2-workstation
@ -125,8 +117,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.9 | PATCH | Ensure discretionary access control permission modification events are collected"
when:
- rhel9cis_rule_6_3_3_9
when: rhel9cis_rule_6_3_3_9
tags:
- level2-server
- level2-workstation
@ -140,8 +131,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.10 | PATCH | Ensure successful file system mounts are collected"
when:
- rhel9cis_rule_6_3_3_10
when: rhel9cis_rule_6_3_3_10
tags:
- level2-server
- level2-workstation
@ -154,8 +144,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.11 | PATCH | Ensure session initiation information is collected"
when:
- rhel9cis_rule_6_3_3_11
when: rhel9cis_rule_6_3_3_11
tags:
- level2-server
- level2-workstation
@ -168,8 +157,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.12 | PATCH | Ensure login and logout events are collected"
when:
- rhel9cis_rule_6_3_3_12
when: rhel9cis_rule_6_3_3_12
tags:
- level2-server
- level2-workstation
@ -182,8 +170,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.13 | PATCH | Ensure file deletion events by users are collected"
when:
- rhel9cis_rule_6_3_3_13
when: rhel9cis_rule_6_3_3_13
tags:
- level2-server
- level2-workstation
@ -197,8 +184,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.14 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
when:
- rhel9cis_rule_6_3_3_14
when: rhel9cis_rule_6_3_3_14
tags:
- level2-server
- level2-workstation
@ -212,8 +198,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.15 | PATCH | Ensure successful and unsuccessful attempts to use the chcon command are recorded"
when:
- rhel9cis_rule_6_3_3_15
when: rhel9cis_rule_6_3_3_15
tags:
- level2-server
- level2- workstation
@ -228,8 +213,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.16 | PATCH | Ensure successful and unsuccessful attempts to use the setfacl command are recorded"
when:
- rhel9cis_rule_6_3_3_16
when: rhel9cis_rule_6_3_3_16
tags:
- level2-server
- level2-workstation
@ -244,8 +228,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.17 | PATCH | Ensure successful and unsuccessful attempts to use the chacl command are recorded"
when:
- rhel9cis_rule_6_3_3_17
when: rhel9cis_rule_6_3_3_17
tags:
- level2-server
- level2-workstation
@ -260,8 +243,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.18 | PATCH | Ensure successful and unsuccessful attempts to use the usermod command are recorded"
when:
- rhel9cis_rule_6_3_3_18
when: rhel9cis_rule_6_3_3_18
tags:
- level2-server
- level2-workstation
@ -276,8 +258,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.19 | PATCH | Ensure kernel module loading and unloading and modification is collected"
when:
- rhel9cis_rule_6_3_3_19
when: rhel9cis_rule_6_3_3_19
tags:
- level2-server
- level2-workstation
@ -291,8 +272,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.20 | PATCH | Ensure the audit configuration is immutable"
when:
- rhel9cis_rule_6_3_3_20
when: rhel9cis_rule_6_3_3_20
tags:
- level2-server
- level2-workstation
@ -306,8 +286,7 @@
update_audit_template: true
- name: "6.3.3.21 | AUDIT | Ensure the running and on disk configuration is the same"
when:
- rhel9cis_rule_6_3_3_21
when: rhel9cis_rule_6_3_3_21
tags:
- level2-server
- level2-workstation
@ -321,8 +300,7 @@
- "Please run augenrules --load if you suspect there is a configuration that is not active"
- name: Auditd | 6.3.3.x | Auditd controls updated
when:
- update_audit_template
when: update_audit_template
ansible.builtin.debug:
msg: "Auditd Controls handled in POST using template - updating /etc/auditd/rules.d/99_auditd.rules"
changed_when: false

21
tasks/section_6/cis_6.3.4.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.3.4.1 | PATCH | Ensure the audit log file directory mode is configured"
when:
- rhel9cis_rule_6_3_4_1
when: rhel9cis_rule_6_3_4_1
tags:
- level2-server
- level2-workstation
@ -39,8 +38,7 @@
group: root
- name: "6.3.4.5 | PATCH | Ensure audit configuration files mode is configured"
when:
- rhel9cis_rule_6_3_4_5
when: rhel9cis_rule_6_3_4_5
tags:
- level2-server
- level2-workstation
@ -57,8 +55,7 @@
label: "{{ item.path }}"
- name: "6.3.4.6 | PATCH | Ensure audit configuration files owner is configured"
when:
- rhel9cis_rule_6_3_4_6
when: rhel9cis_rule_6_3_4_6
tags:
- level2-server
- level2-workstation
@ -75,8 +72,7 @@
label: "{{ item.path }}"
- name: "6.3.4.7 | PATCH | Ensure audit configuration files group owner is configured"
when:
- rhel9cis_rule_6_3_4_7
when: rhel9cis_rule_6_3_4_7
tags:
- level2-server
- level2-workstation
@ -93,8 +89,7 @@
label: "{{ item.path }}"
- name: "6.3.4.8 | PATCH | Ensure audit tools mode is configured"
when:
- rhel9cis_rule_6_3_4_8
when: rhel9cis_rule_6_3_4_8
tags:
- level2-server
- level2-workstation
@ -114,8 +109,7 @@
- /sbin/augenrules
- name: "6.3.4.9 | PATCH | Ensure audit tools owner is configured"
when:
- rhel9cis_rule_6_3_4_9
when: rhel9cis_rule_6_3_4_9
tags:
- level2-server
- level2-workstation
@ -135,8 +129,7 @@
- /sbin/augenrules
- name: "6.3.4.10 | PATCH | Ensure audit tools group owner is configured"
when:
- rhel9cis_rule_6_3_4_10
when: rhel9cis_rule_6_3_4_10
tags:
- level2-server
- level2-workstation

14
tasks/section_7/cis_7.1.x.yml
View file

@ -83,7 +83,7 @@
path: /etc/shadow
owner: root
group: root
mode: '0000'
mode: 'ugo-rwx'
- name: "7.1.6 | PATCH | Ensure permissions on /etc/shadow- are configured"
when:
@ -100,7 +100,7 @@
path: /etc/shadow-
owner: root
group: root
mode: '0000'
mode: 'ugo-rwx'
- name: "7.1.7 | PATCH | Ensure permissions on /etc/gshadow are configured"
when:
@ -117,7 +117,7 @@
path: /etc/gshadow
owner: root
group: root
mode: '0000'
mode: 'ugo-rwx'
- name: "7.1.8 | PATCH | Ensure permissions on /etc/gshadow- are configured"
when:
@ -134,7 +134,7 @@
path: /etc/gshadow-
owner: root
group: root
mode: '0000'
mode: 'ugo-rwx'
- name: "7.1.9 | PATCH | Ensure permissions on /etc/shells are configured"
when:
@ -196,7 +196,7 @@
- rhel9cis_no_world_write_adjust
ansible.builtin.file:
path: '{{ item }}'
mode: o-w
mode: 'o-w'
state: touch
loop: "{{ discovered_world_writable.stdout_lines }}"
@ -221,7 +221,7 @@
warn_control_id: '7.1.12'
block:
- name: "7.1.12 | AUDIT | Ensure no files or directories without an owner and a group exist | Get list files or directories"
ansible.builtin.shell: find {{ rhel9cis_exclude_unowned_search_path }} {{ item.mount }} -xdev \( -nouser -o -nogroup \) -not -fstype nfs
ansible.builtin.command: find {{ rhel9cis_exclude_unowned_search_path }} {{ item.mount }} -xdev \( -nouser -o -nogroup \) -not -fstype nfs
changed_when: false
failed_when: false
check_mode: false
@ -283,7 +283,7 @@
warn_control_id: '7.1.13'
block:
- name: "7.1.13 | AUDIT | Ensure SUID and SGID files are reviewed | Find SUID and SGID"
ansible.builtin.shell: find {{ item.mount }} -xdev -type f -perm \( -02000 or -04000 \) -not -fstype nfs
ansible.builtin.command: find {{ item.mount }} -xdev -type f -perm \( -02000 or -04000 \) -not -fstype nfs
changed_when: false
failed_when: false
check_mode: false

2
tasks/section_7/cis_7.2.x.yml
View file

@ -237,7 +237,7 @@
- users
- rule_7.2.8
block:
- name: "7.2.8 | PATCH | Ensure local interactive user home directories are configured | Create dir if absent"
- name: "7.2.8 | PATCH | Ensure local interactive user home directories are configured | Create dir if absent" # noqa risky-file-permissions
ansible.builtin.file:
path: "{{ item.dir }}"
state: directory

3
tasks/warning_facts.yml
View file

@ -1,5 +1,4 @@
---
# This task is used to create variables used in giving a warning summary for manual tasks
# that need attention
#
@ -14,7 +13,7 @@
#
# warn_count the main variable for the number of warnings and each time a warn_control_id is added
# the count increases by a value of 1
- name: "{{ warn_control_id }} | AUDIT | Set fact for manual task warning."
- name: "{{ warn_control_id }} | AUDIT | Set fact for manual task warning." # noqa name[template]
ansible.builtin.set_fact:
warn_control_list: "{{ warn_control_list }} [{{ warn_control_id }}]"
warn_count: "{{ warn_count | int + 1 }}"

2
templates/audit/98_auditd_exception.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST!
# This file contains users whose actions are not logged by auditd

2
templates/audit/99_auditd.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST!
# This template will set all of the auditd configurations via a handler in the role in one task instead of individually

2
templates/etc/cron.d/aide.cron.j2
View file

@ -1,7 +1,7 @@
# Run AIDE integrity check
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST!
# CIS 1.3.2

2
templates/etc/dconf/db/00-automount_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling automount setting
/org/gnome/desktop/media-handling/automount

2
templates/etc/dconf/db/00-autorun_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling settings
/org/gnome/desktop/media-handling/autorun-never

2
templates/etc/dconf/db/00-media-automount.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling]
automount=false

2
templates/etc/dconf/db/00-media-autorun.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling]
autorun-never=true

2
templates/etc/dconf/db/00-screensaver.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
# Specify the dconf path
[org/gnome/desktop/session]

2
templates/etc/dconf/db/00-screensaver_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop screensaver idle-delay setting
/org/gnome/desktop/session/idle-delay

2
templates/etc/dconf/db/gdm.d/01-banner-message.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC
# provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/login-screen]
banner-message-enable=true

5
templates/fs_with_cves.sh
View file

@ -1,11 +1,8 @@
{% raw %}
#! /usr/bin/env bash
{% raw %}#! /usr/bin/env bash
# Based on original Script provided by CIS
# CVEs correct at time of creation - April2024
#! /usr/bin/env bash
{
a_output=(); a_output2=(); a_modprope_config=(); a_excluded=(); a_available_modules=()
a_ignore=("xfs" "vfat" "ext2" "ext3" "ext4")

2
vars/audit.yml
View file

@ -35,7 +35,7 @@ audit_format: json
audit_vars_path: "{{ audit_conf_dir }}/vars/{{ ansible_facts.hostname }}.yml"
audit_results: |
The{% if not audit_only %} pre remediation{% endif %} audit results are: {{ pre_audit_results}}
The{% if not audit_only %} pre remediation{% endif %} audit results are: {{ pre_audit_results }}
{% if not audit_only %}The post remediation audit results are: {{ post_audit_results }}{% endif %}
Full breakdown can be found in {{ audit_log_dir }}