mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
dc5f71d461
commit
8c79bfe7fb
25 changed files with 253 additions and 266 deletions
|
|
@ -16,7 +16,7 @@
|
|||
state: absent
|
||||
when: ansible_connection != 'docker'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_1_1
|
||||
- rhel9cis_rule_1_1_1_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -41,7 +41,7 @@
|
|||
state: absent
|
||||
when: ansible_connection != 'docker'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_1_2
|
||||
- rhel9cis_rule_1_1_1_2
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -66,7 +66,7 @@
|
|||
state: absent
|
||||
when: ansible_connection != 'docker'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_1_3
|
||||
- rhel9cis_rule_1_1_1_3
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
debug:
|
||||
msg: "WARNING!! /tmp is not mounted on a separate partition"
|
||||
when:
|
||||
- rhel8cis_rule_1_1_2_1
|
||||
- rhel9cis_rule_1_1_2_1
|
||||
- ansible_mounts | selectattr('mount', 'match', '^/tmp$') | list | length == 0
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
@ -24,7 +24,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_2_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_2_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_2_4 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_2_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_2_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_2_4 %}nosuid{% endif %}
|
||||
notify: remount tmp
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
|
|
@ -32,10 +32,10 @@
|
|||
label: "{{ item.device }}"
|
||||
when:
|
||||
- item.mount == "/tmp"
|
||||
- not rhel8cis_tmp_svc
|
||||
- rhel8cis_rule_1_1_2_2 or
|
||||
rhel8cis_rule_1_1_2_3 or
|
||||
rhel8cis_rule_1_1_2_4
|
||||
- not rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -60,11 +60,11 @@
|
|||
mode: 0644
|
||||
notify: systemd restart tmp.mount
|
||||
when:
|
||||
- rhel8cis_tmp_svc
|
||||
- rhel8cis_rule_1_1_2_1 or
|
||||
rhel8cis_rule_1_1_2_2 or
|
||||
rhel8cis_rule_1_1_2_3 or
|
||||
rhel8cis_rule_1_1_2_4
|
||||
- rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_1 or
|
||||
rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@
|
|||
vars:
|
||||
required_mount: '/var'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_3_1
|
||||
- rhel9cis_rule_1_1_3_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -38,7 +38,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_3_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_3_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_3_4 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_3_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_3_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_3_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -47,10 +47,10 @@
|
|||
when:
|
||||
- var_mount_present is defined
|
||||
- item.mount == "/var"
|
||||
- rhel8cis_rule_1_1_3_1 # This is required so the check takes place
|
||||
- rhel8cis_rule_1_1_3_2 or
|
||||
rhel8cis_rule_1_1_3_3 or
|
||||
rhel8cis_rule_1_1_3_4
|
||||
- rhel9cis_rule_1_1_3_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_3_2 or
|
||||
rhel9cis_rule_1_1_3_3 or
|
||||
rhel9cis_rule_1_1_3_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@
|
|||
vars:
|
||||
required_mount: '/var/tmp'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_4_1
|
||||
- rhel9cis_rule_1_1_4_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -39,7 +39,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_4_4 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_4_3 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_4 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -48,10 +48,10 @@
|
|||
when:
|
||||
- var_tmp_mount_present is defined
|
||||
- item.mount == "/var/tmp"
|
||||
- rhel8cis_rule_1_1_4_1 # This is required so the check takes place
|
||||
- rhel8cis_rule_1_1_4_2 or
|
||||
rhel8cis_rule_1_1_4_3 or
|
||||
rhel8cis_rule_1_1_4_4
|
||||
- rhel9cis_rule_1_1_4_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_4_2 or
|
||||
rhel9cis_rule_1_1_4_3 or
|
||||
rhel9cis_rule_1_1_4_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
vars:
|
||||
required_mount: '/var/log'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_5_1
|
||||
- rhel9cis_rule_1_1_5_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -37,7 +37,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_5_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_5_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_5_4 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_5_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_5_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_5_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -46,10 +46,10 @@
|
|||
when:
|
||||
- var_log_mount_present is defined
|
||||
- item.mount == "/var/log"
|
||||
- rhel8cis_rule_1_1_5_1 # This is required so the check takes place
|
||||
- rhel8cis_rule_1_1_5_2 or
|
||||
rhel8cis_rule_1_1_5_3 or
|
||||
rhel8cis_rule_1_1_5_4
|
||||
- rhel9cis_rule_1_1_5_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_5_2 or
|
||||
rhel9cis_rule_1_1_5_3 or
|
||||
rhel9cis_rule_1_1_5_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
vars:
|
||||
required_mount: '/var/log/audit'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_6_1
|
||||
- rhel9cis_rule_1_1_6_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -36,7 +36,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_6_2 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_6_3 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_6_4 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_6_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_6_3 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_6_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -45,10 +45,10 @@
|
|||
when:
|
||||
- var_log_audit_mount_present is defined
|
||||
- item.mount == "/var/log/audit"
|
||||
- rhel8cis_rule_1_1_6_1 # This is required so the check takes place
|
||||
- rhel8cis_rule_1_1_6_2 or
|
||||
rhel8cis_rule_1_1_6_3 or
|
||||
rhel8cis_rule_1_1_6_4
|
||||
- rhel9cis_rule_1_1_6_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_6_2 or
|
||||
rhel9cis_rule_1_1_6_3 or
|
||||
rhel9cis_rule_1_1_6_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
vars:
|
||||
required_mount: '/home'
|
||||
when:
|
||||
- rhel8cis_rule_1_1_7_1
|
||||
- rhel9cis_rule_1_1_7_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -38,7 +38,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_7_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_7_3 %}nosuid,{% endif %}{% if rhel8cis_rule_1_1_7_4 %}usrquota,{% endif %}{% if rhel8cis_rule_1_1_7_5 %}grpquota{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_7_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_7_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_7_4 %}usrquota,{% endif %}{% if rhel9cis_rule_1_1_7_5 %}grpquota{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -47,11 +47,11 @@
|
|||
when:
|
||||
- home_mount_present is defined
|
||||
- item.mount == "/home"
|
||||
- rhel8cis_rule_1_1_7_1
|
||||
- rhel8cis_rule_1_1_7_2 or
|
||||
rhel8cis_rule_1_1_7_3 or
|
||||
rhel8cis_rule_1_1_7_4 or
|
||||
rhel8cis_rule_1_1_7_5
|
||||
- rhel9cis_rule_1_1_7_1
|
||||
- rhel9cis_rule_1_1_7_2 or
|
||||
rhel9cis_rule_1_1_7_3 or
|
||||
rhel9cis_rule_1_1_7_4 or
|
||||
rhel9cis_rule_1_1_7_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@
|
|||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: no
|
||||
register: rhel8cis_1_1_8_x_dev_shm_status
|
||||
register: rhel9cis_1_1_8_x_dev_shm_status
|
||||
|
||||
- name: |
|
||||
"1.1.8.1 | PATCH | Ensure nodev option set on /dev/shm partition | Set nodev option
|
||||
|
|
@ -25,13 +25,13 @@
|
|||
src: tmpfs
|
||||
fstype: tmpfs
|
||||
state: mounted
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_8_2 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_8_1 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_8_3 %}nosuid{% endif %}
|
||||
when: "'dev/shm' in rhel8cis_1_1_8_x_dev_shm_status.stdout"
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_8_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_8_1 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_8_3 %}nosuid{% endif %}
|
||||
when: "'dev/shm' in rhel9cis_1_1_8_x_dev_shm_status.stdout"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- rhel8cis_rule_1_1_8_1 or
|
||||
rhel8cis_rule_1_1_8_2 or
|
||||
rhel8cis_rule_1_1_8_3
|
||||
- rhel9cis_rule_1_1_8_1 or
|
||||
rhel9cis_rule_1_1_8_2 or
|
||||
rhel9cis_rule_1_1_8_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -5,9 +5,9 @@
|
|||
name: autofs
|
||||
enabled: no
|
||||
when:
|
||||
- not rhel8cis_allow_autofs
|
||||
- not rhel9cis_allow_autofs
|
||||
- "'autofs' in ansible_facts.packages"
|
||||
- rhel8cis_rule_1_1_9
|
||||
- rhel9cis_rule_1_1_9
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
|
|
@ -34,7 +34,7 @@
|
|||
name: usb-storage
|
||||
state: absent
|
||||
when:
|
||||
- rhel8cis_rule_1_1_10
|
||||
- rhel9cis_rule_1_1_10
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
|
|
|
|||
|
|
@ -2,11 +2,11 @@
|
|||
|
||||
- name: "1.10 | PATCH | Ensure system-wide crypto policy is not legacy"
|
||||
shell: |
|
||||
update-crypto-policies --set "{{ rhel8cis_crypto_policy }}"
|
||||
update-crypto-policies --set "{{ rhel9cis_crypto_policy }}"
|
||||
update-crypto-policies
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- rhel8cis_rule_1_10
|
||||
- rhel9cis_rule_1_10
|
||||
- system_wide_crypto_policy['stdout'] == 'LEGACY'
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
|
|||
|
|
@ -3,14 +3,14 @@
|
|||
- name: "1.2.1 | PATCH | Ensure Red Hat Subscription Manager connection is configured"
|
||||
redhat_subscription:
|
||||
state: present
|
||||
username: "{{ rhel8cis_rh_sub_user }}"
|
||||
password: "{{ rhel8cis_rh_sub_password }}"
|
||||
username: "{{ rhel9cis_rh_sub_user }}"
|
||||
password: "{{ rhel9cis_rh_sub_password }}"
|
||||
auto_attach: true
|
||||
no_log: true
|
||||
when:
|
||||
- ansible_distribution == "RedHat"
|
||||
- rhel8cis_rhnsd_required
|
||||
- rhel8cis_rule_1_2_1
|
||||
- rhel9cis_rhnsd_required
|
||||
- rhel9cis_rule_1_2_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -22,7 +22,7 @@
|
|||
- name: "1.2.2 | AUDIT | Ensure GPG keys are configured"
|
||||
command: gpg --quiet --with-fingerprint "{{ rpm_gpg_key }}"
|
||||
when:
|
||||
- rhel8cis_rule_1_2_2
|
||||
- rhel9cis_rule_1_2_2
|
||||
- ansible_distribution == "RedHat" or
|
||||
ansible_distribution == "Rocky"
|
||||
tags:
|
||||
|
|
@ -51,7 +51,7 @@
|
|||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
when:
|
||||
- rhel8cis_rule_1_2_3
|
||||
- rhel9cis_rule_1_2_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -76,7 +76,7 @@
|
|||
- "Alert! Below are the configured repos. Please review and make sure all align with site policy"
|
||||
- "{{ dnf_configured.stdout_lines }}"
|
||||
when:
|
||||
- rhel8cis_rule_1_2_4
|
||||
- rhel9cis_rule_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -17,8 +17,8 @@
|
|||
creates: /var/lib/aide/aide.db.gz
|
||||
when: not ansible_check_mode
|
||||
when:
|
||||
- rhel8cis_config_aide
|
||||
- rhel8cis_rule_1_3_1
|
||||
- rhel9cis_config_aide
|
||||
- rhel9cis_rule_1_3_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -30,16 +30,16 @@
|
|||
- name: "1.3.2 | PATCH | Ensure filesystem integrity is regularly checked"
|
||||
cron:
|
||||
name: Run AIDE integrity check
|
||||
cron_file: "{{ rhel8cis_aide_cron['cron_file'] }}"
|
||||
user: "{{ rhel8cis_aide_cron['cron_user'] }}"
|
||||
minute: "{{ rhel8cis_aide_cron['aide_minute'] | default('0') }}"
|
||||
hour: "{{ rhel8cis_aide_cron['aide_hour'] | default('5') }}"
|
||||
day: "{{ rhel8cis_aide_cron['aide_day'] | default('*') }}"
|
||||
month: "{{ rhel8cis_aide_cron['aide_month'] | default('*') }}"
|
||||
weekday: "{{ rhel8cis_aide_cron['aide_weekday'] | default('*') }}"
|
||||
job: "{{ rhel8cis_aide_cron['aide_job'] }}"
|
||||
cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
|
||||
user: "{{ rhel9cis_aide_cron['cron_user'] }}"
|
||||
minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
|
||||
hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
|
||||
day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
|
||||
month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
|
||||
weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
|
||||
job: "{{ rhel9cis_aide_cron['aide_job'] }}"
|
||||
when:
|
||||
- rhel8cis_rule_1_3_2
|
||||
- rhel9cis_rule_1_3_2
|
||||
- not system_is_ec2
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
|
|||
|
|
@ -3,16 +3,16 @@
|
|||
- name: "1.4.1 | PATCH | Ensure bootloader password is set"
|
||||
copy:
|
||||
dest: /boot/grub2/user.cfg
|
||||
content: "GRUB2_PASSWORD={{ rhel8cis_bootloader_password_hash }}"
|
||||
content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0600
|
||||
notify: grub2cfg
|
||||
when:
|
||||
- rhel8cis_set_boot_pass
|
||||
- rhel9cis_set_boot_pass
|
||||
- grub_pass is defined and grub_pass.passhash is defined
|
||||
- grub_pass.passhash | length > 0
|
||||
- rhel8cis_rule_1_4_1
|
||||
- rhel9cis_rule_1_4_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -43,10 +43,10 @@
|
|||
loop_control:
|
||||
label: "{{ item.mount }}"
|
||||
when:
|
||||
- not rhel8cis_legacy_boot
|
||||
- not rhel9cis_legacy_boot
|
||||
- item.mount == "/boot/efi"
|
||||
when:
|
||||
- rhel8cis_rule_1_4_2
|
||||
- rhel9cis_rule_1_4_2
|
||||
- grub_cfg.stat.exists
|
||||
- grub_cfg.stat.islnk
|
||||
tags:
|
||||
|
|
@ -67,7 +67,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_4_3
|
||||
- rhel9cis_rule_1_4_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
line: 'Storage=none'
|
||||
notify: systemd_daemon_reload
|
||||
when:
|
||||
- rhel8cis_rule_1_5_1
|
||||
- rhel9cis_rule_1_5_1
|
||||
- systemd_coredump.stat.exists
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
@ -22,7 +22,7 @@
|
|||
regexp: 'ProcessSizeMax='
|
||||
line: 'ProcessSizeMax=0'
|
||||
when:
|
||||
- rhel8cis_rule_1_5_2
|
||||
- rhel9cis_rule_1_5_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -40,7 +40,7 @@
|
|||
sysctl_set: yes
|
||||
ignoreerrors: yes
|
||||
when:
|
||||
- rhel8cis_rule_1_5_3
|
||||
- rhel9cis_rule_1_5_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
name: libselinux
|
||||
state: present
|
||||
when:
|
||||
- rhel8cis_rule_1_6_1_1
|
||||
- rhel9cis_rule_1_6_1_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -22,7 +22,7 @@
|
|||
ignore_errors: yes
|
||||
notify: grub2cfg
|
||||
when:
|
||||
- rhel8cis_rule_1_6_1_2
|
||||
- rhel9cis_rule_1_6_1_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -34,11 +34,11 @@
|
|||
- name: "1.6.1.3 | PATCH | Ensure SELinux policy is configured"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel8cis_selinux_pol }}"
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel8cis_selinux_disable
|
||||
- rhel8cis_rule_1_6_1_3
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -51,11 +51,11 @@
|
|||
- name: "1.6.1.4 | PATCH | Ensure the SELinux mode is not disabled"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel8cis_selinux_pol }}"
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel8cis_selinux_disable
|
||||
- rhel8cis_rule_1_6_1_4
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -67,11 +67,11 @@
|
|||
- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel8cis_selinux_pol }}"
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel8cis_selinux_disable
|
||||
- rhel8cis_rule_1_6_1_5
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_5
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -98,7 +98,7 @@
|
|||
msg: "Warning! You have unconfined services: {{ rhelcis_1_6_1_6_unconf_services.stdout_lines }}"
|
||||
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
|
||||
when:
|
||||
- rhel8cis_rule_1_6_1_6
|
||||
- rhel9cis_rule_1_6_1_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -112,7 +112,7 @@
|
|||
name: setroubleshoot
|
||||
state: absent
|
||||
when:
|
||||
- rhel8cis_rule_1_6_1_7
|
||||
- rhel9cis_rule_1_6_1_7
|
||||
- "'setroubleshoot' in ansible_facts.packages"
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
@ -126,7 +126,7 @@
|
|||
name: mcstrans
|
||||
state: absent
|
||||
when:
|
||||
- rhel8cis_rule_1_6_1_8
|
||||
- rhel9cis_rule_1_6_1_8
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_1
|
||||
- rhel9cis_rule_1_7_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -25,7 +25,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_2
|
||||
- rhel9cis_rule_1_7_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -41,7 +41,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_3
|
||||
- rhel9cis_rule_1_7_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -58,7 +58,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_4
|
||||
- rhel9cis_rule_1_7_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -75,7 +75,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_5
|
||||
- rhel9cis_rule_1_7_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -92,7 +92,7 @@
|
|||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel8cis_rule_1_7_6
|
||||
- rhel9cis_rule_1_7_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
name: gdm
|
||||
state: absent
|
||||
when:
|
||||
- rhel8cis_rule_1_8_1
|
||||
- rhel9cis_rule_1_8_1
|
||||
- "'gdm' in ansible_facts.packages"
|
||||
tags:
|
||||
- level2-server
|
||||
|
|
@ -32,10 +32,10 @@
|
|||
- { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-enable', line: 'banner-message-enable=true' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel8cis_warning_banner }}' " }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel9cis_warning_banner }}' " }
|
||||
when:
|
||||
- rhel8cis_rule_1_8_2
|
||||
- rhel8cis_gui
|
||||
- rhel9cis_rule_1_8_2
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -62,8 +62,8 @@
|
|||
- { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
|
||||
- { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: 'disable-user-list=', line: 'disable-user-list=true' }
|
||||
when:
|
||||
- rhel8cis_rule_1_8_3
|
||||
- rhel8cis_gui
|
||||
- rhel9cis_rule_1_8_3
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -78,8 +78,8 @@
|
|||
regexp: 'Enable=true'
|
||||
state: absent
|
||||
when:
|
||||
- rhel8cis_rule_1_8_4
|
||||
- rhel8cis_gui
|
||||
- rhel9cis_rule_1_8_4
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -100,8 +100,8 @@
|
|||
- { regex: 'automount=', line: 'automount=false' }
|
||||
- { regex: 'automount-open=', line: 'automount-open=false'}
|
||||
when:
|
||||
- rhel8cis_rule_1_8_5
|
||||
- rhel8cis_gui
|
||||
- rhel9cis_rule_1_8_5
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
state: latest
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- rhel8cis_rule_1_9
|
||||
- rhel9cis_rule_1_9
|
||||
- not system_is_ec2
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@
|
|||
|
||||
- name: "SECTION | 1.3 | Filesystem Integrity Checking"
|
||||
import_tasks: cis_1.3.x.yml
|
||||
when: rhel8cis_config_aide
|
||||
when: rhel9cis_config_aide
|
||||
|
||||
- name: "SECTION | 1.4 | Secure Boot Settings"
|
||||
import_tasks: cis_1.4.x.yml
|
||||
|
|
@ -42,7 +42,7 @@
|
|||
|
||||
- name: "SECTION | 1.6 | Mandatory Access Control"
|
||||
include_tasks: cis_1.6.1.x.yml
|
||||
when: not rhel8cis_selinux_disable
|
||||
when: not rhel9cis_selinux_disable
|
||||
|
||||
- name: "SECTION | 1.7 | Command Line Warning Banners"
|
||||
import_tasks: cis_1.7.x.yml
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue