ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'lint_dec24' into alignment

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-12-11 13:36:08 +00:00
commit 82f7b53a67
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
49 changed files with 375 additions and 606 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tasks/section_6/cis_6.2.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.1.1 | PATCH | Ensure journald service is enabled and active"
when:
- rhel9cis_rule_6_2_1_1
when: rhel9cis_rule_6_2_1_1
tags:
- level1-server
- level1-workstation
@ -15,8 +14,7 @@
state: started
- name: "6.2.1.2 | PATCH | Ensure journald log file access is configured"
when:
- rhel9cis_rule_6_2_1_2
when: rhel9cis_rule_6_2_1_2
tags:
- level1-server
- level1-workstation
@ -27,7 +25,7 @@
- name: "6.2.1.2 | PATCH | Ensure journald log file access is configured | Default file permissions"
ansible.builtin.file:
path: /usr/lib/tmpfiles.d/systemd.conf
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.1.2 | AUDIT | Ensure journald log file access is configured | Check for override file"
ansible.builtin.stat:
@ -58,8 +56,7 @@
warn_control_id: '6.2.1.2'
- name: "6.2.1.3 | PATCH | Ensure journald log file rotation is configured"
when:
- rhel9cis_rule_6_2_1_3
when: rhel9cis_rule_6_2_1_3
tags:
- level1-server
- level1-workstation
@ -74,7 +71,7 @@
dest: /etc/systemd/journald.conf.d/rotation.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.1.3 | PATCH | Ensure journald log file rotation is configured | comment out current entries"
ansible.builtin.replace:
@ -89,8 +86,7 @@
- '^(\s*MaxFileSec\s*=.*)'
- name: "6.2.1.4 | PATCH | Ensure only one logging system is in use"
when:
- rhel9cis_rule_6_2_1_4
when: rhel9cis_rule_6_2_1_4
tags:
- level1-server
- level1-workstation

15
tasks/section_6/cis_6.2.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled"
when:
- rhel9cis_rule_6_2_2_2
when: rhel9cis_rule_6_2_2_2
tags:
- level1-server
- level2-workstation
@ -21,7 +20,7 @@
dest: /etc/systemd/journald.conf.d/forwardtosyslog.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | comment out current entries"
ansible.builtin.replace:
@ -30,8 +29,7 @@
replace: '#\1'
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured"
when:
- rhel9cis_rule_6_2_2_3
when: rhel9cis_rule_6_2_2_3
tags:
- level1-server
- level1-workstation
@ -47,7 +45,7 @@
dest: /etc/systemd/journald.conf.d/storage.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | comment out current entries"
ansible.builtin.replace:
@ -56,8 +54,7 @@
replace: '#\1'
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured"
when:
- rhel9cis_rule_6_2_2_4
when: rhel9cis_rule_6_2_2_4
tags:
- level1-server
- level1-workstation
@ -74,7 +71,7 @@
dest: /etc/systemd/journald.conf.d/storage.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | comment out current entries"
ansible.builtin.replace:

20
tasks/section_6/cis_6.2.3.x.yml
View file

@ -18,8 +18,7 @@
state: present
- name: "6.2.3.2 | PATCH | Ensure rsyslog Service is enabled and active"
when:
- rhel9cis_rule_6_2_3_2
when: rhel9cis_rule_6_2_3_2
tags:
- level1-server
- level1-workstation
@ -35,8 +34,7 @@
state: started
- name: "6.2.3.3 | PATCH | Ensure journald is configured to send logs to rsyslog"
when:
- rhel9cis_rule_6_2_3_3
when: rhel9cis_rule_6_2_3_3
tags:
- level1-server
- level1-workstation
@ -54,8 +52,7 @@
notify: Restart rsyslog
- name: "6.2.3.4 | PATCH | Ensure rsyslog log file creation mode is configured"
when:
- rhel9cis_rule_6_2_3_4
when: rhel9cis_rule_6_2_3_4
tags:
- level1-server
- level1-workstation
@ -72,8 +69,7 @@
notify: Restart rsyslog
- name: "6.2.3.5 | PATCH | Ensure logging is configured"
when:
- rhel9cis_rule_6_2_3_5
when: rhel9cis_rule_6_2_3_5
tags:
- level1-server
- level1-workstation
@ -200,8 +196,7 @@
notify: Restart rsyslog
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
when:
- rhel9cis_rule_6_2_3_7
when: rhel9cis_rule_6_2_3_7
tags:
- level1-server
- level1-workstation
@ -238,8 +233,7 @@
- 'InputTCPServerRun'
- name: "6.2.3.8 | PATCH | Ensure rsyslog logrotate is configured"
when:
- rhel9cis_rule_6_2_3_8
when: rhel9cis_rule_6_2_3_8
tags:
- level1-server
- level1-workstation
@ -266,4 +260,4 @@
dest: /etc/logrotate.d/rsyslog.conf
owner: root
group: root
mode: '0640'
mode: 'g-wx,o-rwx'

3
tasks/section_6/cis_6.2.4.1.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured"
when:
- rhel9cis_rule_6_2_4_1
when: rhel9cis_rule_6_2_4_1
tags:
- level1-server
- level1-workstation

6
tasks/section_6/cis_6.3.1.x.yml
View file

@ -51,8 +51,7 @@
changed_when: true
- name: "6.3.1.3 | PATCH | Ensure audit_backlog_limit is sufficient"
when:
- rhel9cis_rule_6_3_1_3
when: rhel9cis_rule_6_3_1_3
tags:
- level2-server
- level2-workstation
@ -92,8 +91,7 @@
changed_when: true
- name: "6.3.1.4 | PATCH | Ensure auditd service is enabled and active"
when:
- rhel9cis_rule_6_3_1_4
when: rhel9cis_rule_6_3_1_4
tags:
- level2-server
- level2-workstation

12
tasks/section_6/cis_6.3.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.3.2.1 | PATCH | Ensure audit log storage size is configured"
when:
- rhel9cis_rule_6_3_2_1
when: rhel9cis_rule_6_3_2_1
tags:
- level2-server
- level2-workstation
@ -17,8 +16,7 @@
notify: Restart auditd
- name: "6.3.2.2 | PATCH | Ensure audit logs are not automatically deleted"
when:
- rhel9cis_rule_6_3_2_2
when: rhel9cis_rule_6_3_2_2
tags:
- level2-server
- level2-workstation
@ -33,8 +31,7 @@
notify: Restart auditd
- name: "6.3.2.3 | PATCH | Ensure system is disabled when audit logs are full"
when:
- rhel9cis_rule_6_3_2_3
when: rhel9cis_rule_6_3_2_3
tags:
- level2-server
- level2-workstation
@ -55,8 +52,7 @@
- { regexp: '^disk_error_action', line: 'disk_error_action = {{ rhel9cis_auditd_disk_error_action }}' }
- name: "6.3.2.4 | PATCH | Ensure system warns when audit logs are low on space"
when:
- rhel9cis_rule_6_3_2_4
when: rhel9cis_rule_6_3_2_4
tags:
- level2-server
- level2-workstation

66
tasks/section_6/cis_6.3.3.x.yml
View file

@ -2,8 +2,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.1 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
when:
- rhel9cis_rule_6_3_3_1
when: rhel9cis_rule_6_3_3_1
tags:
- level2-server
- level2-workstation
@ -16,8 +15,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.2 | PATCH | Ensure actions as another user are always logged"
when:
- rhel9cis_rule_6_3_3_2
when: rhel9cis_rule_6_3_3_2
tags:
- level2-server
- level2-workstation
@ -30,8 +28,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.3 | PATCH | Ensure events that modify the sudo log file are collected"
when:
- rhel9cis_rule_6_3_3_3
when: rhel9cis_rule_6_3_3_3
tags:
- level2-server
- level2-workstation
@ -43,8 +40,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.4 | PATCH | Ensure events that modify date and time information are collected"
when:
- rhel9cis_rule_6_3_3_4
when: rhel9cis_rule_6_3_3_4
tags:
- level2-server
- level2-workstation
@ -58,8 +54,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.5 | PATCH | Ensure events that modify the system's network environment are collected"
when:
- rhel9cis_rule_6_3_3_5
when: rhel9cis_rule_6_3_3_5
tags:
- level2-server
- level2-workstation
@ -73,8 +68,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.6 | PATCH | Ensure use of privileged commands is collected"
when:
- rhel9cis_rule_6_3_3_6
when: rhel9cis_rule_6_3_3_6
tags:
- level2-server
- level2-workstation
@ -97,8 +91,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.7 | PATCH | Ensure unsuccessful file access attempts are collected"
when:
- rhel9cis_rule_6_3_3_7
when: rhel9cis_rule_6_3_3_7
tags:
- level2-server
- level2-workstation
@ -111,8 +104,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.8 | PATCH | Ensure events that modify user/group information are collected"
when:
- rhel9cis_rule_6_3_3_8
when: rhel9cis_rule_6_3_3_8
tags:
- level2-server
- level2-workstation
@ -125,8 +117,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.9 | PATCH | Ensure discretionary access control permission modification events are collected"
when:
- rhel9cis_rule_6_3_3_9
when: rhel9cis_rule_6_3_3_9
tags:
- level2-server
- level2-workstation
@ -140,8 +131,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.10 | PATCH | Ensure successful file system mounts are collected"
when:
- rhel9cis_rule_6_3_3_10
when: rhel9cis_rule_6_3_3_10
tags:
- level2-server
- level2-workstation
@ -154,8 +144,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.11 | PATCH | Ensure session initiation information is collected"
when:
- rhel9cis_rule_6_3_3_11
when: rhel9cis_rule_6_3_3_11
tags:
- level2-server
- level2-workstation
@ -168,8 +157,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.12 | PATCH | Ensure login and logout events are collected"
when:
- rhel9cis_rule_6_3_3_12
when: rhel9cis_rule_6_3_3_12
tags:
- level2-server
- level2-workstation
@ -182,8 +170,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.13 | PATCH | Ensure file deletion events by users are collected"
when:
- rhel9cis_rule_6_3_3_13
when: rhel9cis_rule_6_3_3_13
tags:
- level2-server
- level2-workstation
@ -197,8 +184,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.14 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
when:
- rhel9cis_rule_6_3_3_14
when: rhel9cis_rule_6_3_3_14
tags:
- level2-server
- level2-workstation
@ -212,8 +198,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.15 | PATCH | Ensure successful and unsuccessful attempts to use the chcon command are recorded"
when:
- rhel9cis_rule_6_3_3_15
when: rhel9cis_rule_6_3_3_15
tags:
- level2-server
- level2- workstation
@ -228,8 +213,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.16 | PATCH | Ensure successful and unsuccessful attempts to use the setfacl command are recorded"
when:
- rhel9cis_rule_6_3_3_16
when: rhel9cis_rule_6_3_3_16
tags:
- level2-server
- level2-workstation
@ -244,8 +228,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.17 | PATCH | Ensure successful and unsuccessful attempts to use the chacl command are recorded"
when:
- rhel9cis_rule_6_3_3_17
when: rhel9cis_rule_6_3_3_17
tags:
- level2-server
- level2-workstation
@ -260,8 +243,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.18 | PATCH | Ensure successful and unsuccessful attempts to use the usermod command are recorded"
when:
- rhel9cis_rule_6_3_3_18
when: rhel9cis_rule_6_3_3_18
tags:
- level2-server
- level2-workstation
@ -276,8 +258,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.19 | PATCH | Ensure kernel module loading and unloading and modification is collected"
when:
- rhel9cis_rule_6_3_3_19
when: rhel9cis_rule_6_3_3_19
tags:
- level2-server
- level2-workstation
@ -291,8 +272,7 @@
# All changes selected are managed by the POST audit and handlers to update
- name: "6.3.3.20 | PATCH | Ensure the audit configuration is immutable"
when:
- rhel9cis_rule_6_3_3_20
when: rhel9cis_rule_6_3_3_20
tags:
- level2-server
- level2-workstation
@ -306,8 +286,7 @@
update_audit_template: true
- name: "6.3.3.21 | AUDIT | Ensure the running and on disk configuration is the same"
when:
- rhel9cis_rule_6_3_3_21
when: rhel9cis_rule_6_3_3_21
tags:
- level2-server
- level2-workstation
@ -321,8 +300,7 @@
- "Please run augenrules --load if you suspect there is a configuration that is not active"
- name: Auditd | 6.3.3.x | Auditd controls updated
when:
- update_audit_template
when: update_audit_template
ansible.builtin.debug:
msg: "Auditd Controls handled in POST using template - updating /etc/auditd/rules.d/99_auditd.rules"
changed_when: false

21
tasks/section_6/cis_6.3.4.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "6.3.4.1 | PATCH | Ensure the audit log file directory mode is configured"
when:
- rhel9cis_rule_6_3_4_1
when: rhel9cis_rule_6_3_4_1
tags:
- level2-server
- level2-workstation
@ -39,8 +38,7 @@
group: root
- name: "6.3.4.5 | PATCH | Ensure audit configuration files mode is configured"
when:
- rhel9cis_rule_6_3_4_5
when: rhel9cis_rule_6_3_4_5
tags:
- level2-server
- level2-workstation
@ -57,8 +55,7 @@
label: "{{ item.path }}"
- name: "6.3.4.6 | PATCH | Ensure audit configuration files owner is configured"
when:
- rhel9cis_rule_6_3_4_6
when: rhel9cis_rule_6_3_4_6
tags:
- level2-server
- level2-workstation
@ -75,8 +72,7 @@
label: "{{ item.path }}"
- name: "6.3.4.7 | PATCH | Ensure audit configuration files group owner is configured"
when:
- rhel9cis_rule_6_3_4_7
when: rhel9cis_rule_6_3_4_7
tags:
- level2-server
- level2-workstation
@ -93,8 +89,7 @@
label: "{{ item.path }}"
- name: "6.3.4.8 | PATCH | Ensure audit tools mode is configured"
when:
- rhel9cis_rule_6_3_4_8
when: rhel9cis_rule_6_3_4_8
tags:
- level2-server
- level2-workstation
@ -108,8 +103,7 @@
loop: "{{ audit_bins }}"
- name: "6.3.4.9 | PATCH | Ensure audit tools owner is configured"
when:
- rhel9cis_rule_6_3_4_9
when: rhel9cis_rule_6_3_4_9
tags:
- level2-server
- level2-workstation
@ -123,8 +117,7 @@
loop: "{{ audit_bins }}"
- name: "6.3.4.10 | PATCH | Ensure audit tools group owner is configured"
when:
- rhel9cis_rule_6_3_4_10
when: rhel9cis_rule_6_3_4_10
tags:
- level2-server
- level2-workstation