ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

March 24 to devel (#186)

Browse source 
* Issue #170, PR #181 thanks to @ipruteanu-sie

* issue #182, PR #183 thansk to @ipruteanu-sie

* PR #180 thanks to @ipruteanu-sie and @raabf

* Addressed PR #165 thanks to @ipruteanu-sie

* PT #184 addressed thansk to @ipruteanu-sie

* updated credits

* typo and ssh allow_deny comments

* enable OS check

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
uk-bolly 2024-03-06 16:52:38 +00:00 • committed by GitHub
parent 0f58436212
commit 7d7b6132f4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 58 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

21
defaults/main.yml
View file

@ -1003,11 +1003,11 @@ rhel9cis_sshd:
# This variable sets the maximum number of unresponsive "keep-alive" messages
# that can be sent from the server to the client before the connection is considered
# inactive and thus, closed.
clientalivecountmax: 0
clientalivecountmax: 3
# This variable sets the time interval in seconds between sending "keep-alive"
# messages from the server to the client. These types of messages are intended to
# keep the connection alive and prevent it being terminated due to inactivity.
clientaliveinterval: 900
clientaliveinterval: 15
# This variable specifies the amount of seconds allowed for successful authentication to
# the SSH server.
logingracetime: 60
@ -1017,26 +1017,29 @@ rhel9cis_sshd:
# If an USER@HOST format will be used, the specified user will be allowed only on that particular host.
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
# For more info, see https://linux.die.net/man/5/sshd_config
allow_users: ""
# (String) This variable, if spcieifed, configures a list of GROUP name patterns, separated by spaces, to allow SSH access
# allowusers: ""
# (String) This variable, if specified, configures a list of GROUP name patterns, separated by spaces, to allow SSH access
# for users whose primary group or supplementary group list matches one of the patterns. This is done
# by setting the value of `AllowGroups` option in `/etc/ssh/sshd_config` file.
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
# For more info, https://linux.die.net/man/5/sshd_config
allow_groups: "wheel"
# allowgroups: "wheel"
# This variable, if specified, configures a list of USER name patterns, separated by spaces, to prevent SSH access
# for users whose user name matches one of the patterns. This is done
# by setting the value of `DenyUsers` option in `/etc/ssh/sshd_config` file.
# If an USER@HOST format will be used, the specified user will be restricted only on that particular host.
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
# For more info, see https://linux.die.net/man/5/sshd_config
deny_users: "nobody"
denyusers: "nobody"
# This variable, if specified, configures a list of GROUP name patterns, separated by spaces, to prevent SSH access
# for users whose primary group or supplementary group list matches one of the patterns. This is done
# by setting the value of `DenyGroups` option in `/etc/ssh/sshd_config` file.
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
# For more info, see https://linux.die.net/man/5/sshd_config
deny_groups: ""
denygroups: ""
## Control 5.2.5 - Ensure SSH LogLevel is appropriate
# This variable is used to control the verbosity of the logging produced by the SSH server.
@ -1060,10 +1063,6 @@ rhel9cis_inactivelock:
# This variable specifies the number of days of inactivity before an account will be locked.
# CIS requires a value of 30 days or less.
lock_days: 30
# This variable governs if authconfig package should be installed. This package provides a simple method of
# configuring /etc/sysconfig/network to handle NIS, as well as /etc/passwd and /etc/shadow, the files used
# for shadow password support. Basic LDAP, Kerberos 5, and Winbind client configuration is also provided.
rhel9cis_use_authconfig: false
## Section 5.4 - Configure authselect: Custom authselect profile settings(name, profile to customize, options)
## Controls: