Initial

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/LE_audit_setup.yml

@@ -0,0 +1,22 @@
+---
+
+- name: Download audit binary
+  get_url:
+      url: "{{ goss_url }}"
+      dest: "{{ audit_bin }}"
+      owner: root
+      group: root
+      checksum: "{{ goss_version.checksum }}"
+      mode: 0555
+  when:
+      - get_goss_file == 'download'
+
+- name: copy audit binary
+  copy:
+      src:
+      dest: "{{ audit_bin }}"
+      mode: 0555
+      owner: root
+      group: root
+  when:
+      - get_goss_file == 'copy'

tasks/audit_homedirperms.yml

@@ -0,0 +1,46 @@
+---
+- name: "SCORED | 6.2.8 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+  find:
+      paths:
+          - "{{ homedir }}"
+      recurse: true
+      file_type: any
+  register: rhel_09_6_2_8_results
+  when:
+      - rhel9cis_rule_6_2_8|bool
+  tags:
+      - level1
+      - patch
+      - rule_6.2.8
+
+- name: "SCORED | 6.2.8 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+  file:
+      path: "{{ line_item.path }}"
+      mode: 0640
+  loop: "{{ rhel_09_6_2_8_results.files }}"
+  loop_control:
+      label: "{{ line_item.path }}"
+      loop_var: line_item
+  when:
+      - rhel_09_6_2_8_results.files.isreg is defined
+      - rhel9cis_rule_6_2_8|bool
+  tags:
+      - level1
+      - patch
+      - rule_6.2.8
+
+- name: "SCORED | 6.2.8 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+  file:
+      path: "{{ line_item.path }}"
+      mode: 0750
+  loop: "{{ rhel_09_6_2_8_results.files }}"
+  loop_control:
+      label: "{{ line_item.path }}"
+      loop_var: line_item
+  when:
+      - rhel_09_6_2_8_results.files.isdir is defined
+      - rhel9cis_rule_6_2_8|bool
+  tags:
+      - level1
+      - patch
+      - rule_6.2.8

tasks/check_prereqs.yml

@@ -0,0 +1,36 @@
+---
+
+- name: "PREREQ | Add the required packages | Python 3"
+  block:
+      - name: Check if python36-rpm package installed
+        command: rpm -q python36-rpm
+        failed_when: ( python36_rpm_present.rc not in [ 0, 1 ] )
+        changed_when: false
+        args:
+            warn: false
+        register: python36_rpm_present
+
+      - name: Add the EPEL repository required for the python36-rpm pkg
+        package:
+            name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
+            state: present
+        register: epel_installed
+        when:
+            - python36_rpm_present.rc != '0'
+
+      - name: "PREREQ | Check required packages installed | Python3 "
+        package:
+            name: "{{ item }}"
+            state: present
+        register: python3reqs_installed
+        loop:
+            - python36-rpm
+            - libselinux-python3
+
+      - name: Disable Epel repo if installed earlier
+        command: yum-config-manager disable epel
+        when: epel_installed.changed
+  when:
+      - ( ansible_python.version.major == 3  and ansible_python.version.minor == 6 )
+  vars:
+      ansible_python_interpreter: "{{ python2_bin }}"

tasks/main.yml

@@ -0,0 +1,111 @@
+---
+# tasks file for RHEL9-CIS
+- name: Check OS version and family
+  fail:
+      msg: "This role can only be run against RHEL 8. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported."
+  when:
+  - ansible_os_family == 'RedHat'
+  - ansible_distribution_major_version is version_compare('9', '!=')
+  tags:
+  - always
+
+- name: Check ansible version
+  fail:
+      msg: You must use ansible 2.9 or greater
+  when: not ansible_version.full is version_compare('2.9', '>=')
+  tags:
+  - always
+
+- name: Check crypto-policy input
+  assert:
+      that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
+
+- name: Check rhel9cis_bootloader_password_hash variable has been changed
+  assert:
+      that: rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword'
+      msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password_hash variable has not been set"
+  when:
+  - rhel9cis_set_boot_pass
+  - rhel9cis_rule_1_5_2
+
+- name: "check sugroup exists if used"
+  block:
+  - name: "Check su group exists if defined"
+    shell: grep -w "{{ rhel9cis_sugroup }}" /etc/group
+    register: sugroup_exists
+    changed_when: false
+    failed_when: sugroup_exists.rc >= 2
+    tags:
+    - skip_ansible_lint
+
+  - name: Check sugroup if defined exists before continuing
+    assert:
+        that: sugroup_exists.rc == 0
+        msg: "The variable rhel9cis_sugroup is defined but does not exist please rectify"
+  when:
+  - rhel9cis_sugroup is defined
+  - rhel9cis_rule_5_7
+  tags:
+  - rule_5.7
+
+- include: prelim.yml
+  become: yes
+  tags:
+  - prelim_tasks
+  - always
+
+- import_tasks: pre_remediation_audit.yml
+  when:
+  - run_audit
+
+- name: Gather the package facts
+  package_facts:
+      manager: auto
+  tags:
+  - always
+
+- include: parse_etc_password.yml
+  become: yes
+  when: rhel9cis_section6
+
+- include: section_1/main.yml
+  become: yes
+  when: rhel9cis_section1
+  tags:
+  - rhel9cis_section1
+
+- include: section_2/main.yml
+  become: yes
+  when: rhel9cis_section2
+
+- include: section_3/main.yml
+  become: yes
+  when: rhel9cis_section3
+
+- include: section_4/main.yml
+  become: yes
+  when: rhel9cis_section4
+
+- include: section_5/main.yml
+  become: yes
+  when: rhel9cis_section5
+
+- include: section_6/main.yml
+  become: yes
+  when: rhel9cis_section6
+
+- include: post.yml
+  become: yes
+  tags:
+  - post_tasks
+  - always
+
+- import_tasks: post_remediation_audit.yml
+  when:
+  - run_audit
+
+- name: Show Audit Summary
+  debug:
+      msg: "{{ audit_results.split('\n') }}"
+  when:
+  - run_audit

tasks/parse_etc_password.yml

@@ -0,0 +1,32 @@
+---
+
+- name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Parse /etc/passwd"
+  block:
+      - name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Parse /etc/passwd"
+        command: cat /etc/passwd
+        changed_when: no
+        check_mode: no
+        register: rhel9cis_passwd_file_audit
+
+      - name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Split passwd entries"
+        set_fact:
+            rhel9cis_passwd: "{{ rhel9cis_passwd_file_audit.stdout_lines | map('regex_replace', ld_passwd_regex, ld_passwd_yaml) | map('from_yaml') | list }}"
+        with_items: "{{ rhel9cis_passwd_file_audit.stdout_lines }}"
+        vars:
+            ld_passwd_regex: >-
+                ^(?P<id>[^:]*):(?P<password>[^:]*):(?P<uid>[^:]*):(?P<gid>[^:]*):(?P<gecos>[^:]*):(?P<dir>[^:]*):(?P<shell>[^:]*)
+            ld_passwd_yaml: |
+                id: >-4
+                    \g<id>
+                password: >-4
+                    \g<password>
+                uid: \g<uid>
+                gid: \g<gid>
+                gecos: >-4
+                    \g<gecos>
+                dir: >-4
+                    \g<dir>
+                shell: >-4
+                    \g<shell>
+  tags:
+      - always

tasks/post.yml

@@ -0,0 +1,56 @@
+---
+# Post tasks
+
+- name: Perform DNF package cleanup
+  dnf:
+      autoremove: yes
+  changed_when: no
+
+- name: trigger update sysctl
+  command: /bin/true
+  changed_when: false
+  check_mode: false
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_1_6_1 or
+        rhel9cis_rule_1_6_2 or
+        rhel9cis_rule_3_1_2 or
+        rhel9cis_rule_3_1_2 or
+        rhel9cis_rule_3_2_1 or
+        rhel9cis_rule_3_2_2 or
+        rhel9cis_rule_3_2_3 or
+        rhel9cis_rule_3_2_4 or
+        rhel9cis_rule_3_2_5 or
+        rhel9cis_rule_3_2_6 or
+        rhel9cis_rule_3_2_7 or
+        rhel9cis_rule_3_2_8 or
+        rhel9cis_rule_3_2_9
+  tags:
+      - sysctl
+
+- name: trigger update auditd
+  command: /bin/true
+  notify: update auditd
+  changed_when: false
+  check_mode: false
+  when:
+      - rhel9cis_rule_4_1_3 or
+        rhel9cis_rule_4_1_4 or
+        rhel9cis_rule_4_1_5 or
+        rhel9cis_rule_4_1_6 or
+        rhel9cis_rule_4_1_7 or
+        rhel9cis_rule_4_1_8 or
+        rhel9cis_rule_4_1_9 or
+        rhel9cis_rule_4_1_10 or
+        rhel9cis_rule_4_1_11 or
+        rhel9cis_rule_4_1_12
+  tags:
+      - auditd
+
+- name: flush handlers
+  meta: flush_handlers
+
+- name: Reboot host
+  reboot:
+  when:
+  - not rhel9cis_skip_reboot

tasks/post_remediation_audit.yml

@@ -0,0 +1,43 @@
+---
+
+- name: "Post Audit | Run post_remediation {{ benchmark }} audit"
+  shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }}"
+  vars:
+      warn: false
+
+- name: Post Audit | ensure audit files readable by users
+  file:
+      path: "{{ item }}"
+      mode: 0644
+      state: file
+  loop:
+      - "{{ post_audit_outfile }}"
+      - "{{ pre_audit_outfile }}"
+
+- name: Post Audit | Capture audit data if json format
+  block:
+      - name: "capture data {{ post_audit_outfile }}"
+        command: "cat {{ post_audit_outfile }}"
+        register: post_audit
+        changed_when: false
+
+      - name: Capture post-audit result
+        set_fact:
+            post_audit_summary: "{{ post_audit.stdout | from_json |json_query(summary) }}"
+        vars:
+            summary: 'summary."summary-line"'
+  when:
+      - audit_format == "json"
+
+- name: Post Audit | Capture audit data if documentation format
+  block:
+      - name: "Post Audit | capture data {{ post_audit_outfile }}"
+        command: "tail -2 {{ post_audit_outfile }}"
+        register: post_audit
+        changed_when: false
+
+      - name: Post Audit | Capture post-audit result
+        set_fact:
+            post_audit_summary: "{{ post_audit.stdout_lines }}"
+  when:
+      - audit_format == "documentation"

tasks/pre_remediation_audit.yml

@@ -0,0 +1,118 @@
+---
+
+- name: Pre Audit | Setup the audit
+  include_tasks: LE_audit_setup.yml
+  when:
+  - setup_audit
+  tags:
+  - setup_audit
+
+- name: "Pre Audit | Ensure {{ audit_conf_dir }} exists"
+  file:
+      path: "{{ audit_conf_dir }}"
+      state: directory
+      mode: '0755'
+
+- name: Pre Audit | If using git for content set up
+  block:
+  - name: Pre Audit | Install git (rh8 python3)
+    package:
+        name: git
+        state: present
+    when: ansible_distribution_major_version == 8
+
+  - name: Pre Audit | Install git (rh7 python2)
+    package:
+        name: git
+        state: present
+    vars:
+        ansible_python_interpreter: "{{ python2_bin }}"
+    when: ansible_distribution_major_version == 7
+
+  - name: Pre Audit | retrieve audit content files from git
+    git:
+        repo: "{{ audit_file_git }}"
+        dest: "{{ audit_conf_dir }}"
+        version: "{{ audit_git_version }}"
+  when:
+  - audit_content == 'git'
+
+- name: Pre Audit | copy to audit content files to server
+  copy:
+      src: "{{ audit_local_copy }}"
+      dest: "{{ audit_conf_dir }}"
+      mode: 0644
+  when:
+  - audit_content == 'copy'
+
+- name: Pre Audit | get audit content from url
+  get_url:
+      url: "{{ audit_files_url }}"
+      dest: "{{ audit_conf_dir }}"
+  when:
+  - audit_content == 'get_url'
+
+- name: Pre Audit | Check Goss is available
+  block:
+  - name: Pre Audit | Check for goss file
+    stat:
+        path: "{{ audit_bin }}"
+    register: goss_available
+
+  - name: Pre Audit | If audit ensure goss is available
+    assert:
+        msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
+    when:
+    - not goss_available.stat.exists
+  when:
+  - run_audit
+
+- name: "Pre Audit | Check whether machine is UEFI-based"
+  stat:
+      path: /sys/firmware/efi
+  register: rhel9_efi_boot
+  tags:
+  - goss_template
+
+- name: Pre Audit | Copy ansible default vars values to test audit
+  template:
+      src: ansible_vars_goss.yml.j2
+      dest: "{{ audit_vars_path }}"
+      mode: 0600
+  when:
+  - run_audit
+  tags:
+  - goss_template
+
+- name: "Pre Audit | Run pre_remediation {{ benchmark }} audit"
+  shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
+  vars:
+      warn: false
+
+- name: Pre Audit | Capture audit data if json format
+  block:
+  - name: "Pre Audit | capture data {{ pre_audit_outfile }}"
+    command: "cat {{ pre_audit_outfile }}"
+    register: pre_audit
+    changed_when: false
+
+  - name: Pre Audit | Capture pre-audit result
+    set_fact:
+        pre_audit_summary: "{{ pre_audit.stdout | from_json |json_query(summary) }}"
+    vars:
+        summary: 'summary."summary-line"'
+  when:
+  - audit_format == "json"
+
+- name: Pre Audit | Capture audit data if documentation format
+  block:
+  - name: "Pre Audit | capture data {{ pre_audit_outfile }}"
+    command: "tail -2 {{ pre_audit_outfile }}"
+    register: pre_audit
+    changed_when: false
+
+  - name: Pre Audit | Capture pre-audit result
+    set_fact:
+        pre_audit_summary: "{{ pre_audit.stdout_lines }}"
+  when:
+  - audit_format == "documentation"

tasks/prelim.yml

@@ -0,0 +1,119 @@
+---
+# Preliminary tasks that should always be run
+# List users in order to look files inside each home directory
+- name: "PRELIM | List users accounts"
+  command: "awk -F: '{print $1}' /etc/passwd"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: users
+
+- name: "PRELIM | Gather accounts with empty password fields"
+  shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: empty_password_accounts
+
+- name: "PRELIM | Gather UID 0 accounts other than root"
+  shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: uid_zero_accounts_except_root
+
+- name: "PRELIM | Gather system-wide crypto-policy"
+  shell: update-crypto-policies --show
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: system_wide_crypto_policy
+
+- name: "PRELIM | if systemd coredump"
+  stat:
+      path: /etc/systemd/coredump.conf
+  register: systemd_coredump
+  when:
+      - rhel9cis_rule_1_6_1
+
+- name: "PRELIM | Section 1.1 | Create list of mount points"
+  set_fact:
+      mount_names: "{{ ansible_mounts | map(attribute='mount') | list }}"
+
+- name: "PRELIM | Section 4.1 | Configure System Accounting (auditd)"
+  package:
+      name: audit
+      state: present
+  when: rhel9cis_level_2
+
+- name: "PRELIM | 4.1.12 | Ensure successful file system mounts are collected"
+  shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
+  changed_when: false
+  failed_when: false
+  check_mode: no
+  register: priv_procs
+  tags:
+  - always
+
+- name: "PRELIM | Section 5.1 | Configure cron"
+  package:
+      name: cronie
+      state: present
+
+- name: "PRELIM | Install authconfig"
+  package:
+      name: authconfig
+      state: present
+  when:
+      - rhel9cis_use_authconfig
+      - rhel9cis_rule_5_3_1 or
+        rhel9cis_rule_5_3_2 or
+        rhel9cis_rule_5_3_3
+
+- name: "PRELIM | Set facts based on boot type"
+  block:
+      - name: "PRELIM | Check whether machine is UEFI-based"
+        stat:
+            path: /sys/firmware/efi
+        register: rhel_09_efi_boot
+
+      - name: "PRELIM | AUDIT | set legacy boot and grub path | Bios"
+        set_fact:
+            rhel9cis_legacy_boot: true
+            grub2_path: /etc/grub2.cfg
+        when: not rhel_09_efi_boot.stat.exists
+
+      - name: "PRELIM | set grub fact | UEFI"
+        set_fact:
+            grub2_path: /etc/grub2-efi.cfg
+        when: rhel_09_efi_boot.stat.exists
+
+# - name: debug legacy boot var
+#   debug:
+#       msg: |
+#           legacy_boot={{ rhel9cis_legacy_boot }}
+#           grub2_path={{ grub2_path }}
+
+- name: "PRELIM | AUDIT | Ensure permissions on bootloader config are configured | Get grub config file stats"
+  stat:
+      path: "{{ grub2_path }}"
+  changed_when: false
+  register: grub_cfg
+
+# - name: debug grub stat
+#   debug:
+#       var: grub_cfg.stat
+
+- name: "PRELIM | Check for rhnsd service"
+  shell: "systemctl show rhnsd | grep LoadState | cut -d = -f 2"
+  changed_when: false
+  check_mode: false
+  register: rhnsd_service_status
+  when:
+      - rhel9cis_rule_1_2_2
+  tags:
+      - skip_ansible_lint

tasks/section_1/cis_1.1.1.x.yml

@@ -0,0 +1,102 @@
+---
+
+- name: "1.1.1.1 | L1 | PATCH | Ensure mounting of cramfs filesystems is disabled"
+  block:
+      - name: "1.1.1.1 | L1 | PATCH | Ensure mounting of cramfs filesystems is disabled | Edit modprobe config"
+        lineinfile:
+            dest: /etc/modprobe.d/CIS.conf
+            regexp: "^(#)?install cramfs(\\s|$)"
+            line: "install cramfs /bin/true"
+            create: yes
+            mode: 0600
+
+      - name: "1.1.1.1 | L1 | PATCH | Ensure mounting of cramfs filesystems is disabled | Disable cramfs"
+        modprobe:
+            name: cramfs
+            state: absent
+        when: ansible_connection != 'docker'
+  when:
+      - rhel9cis_rule_1_1_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.1.1.1
+      - cramfs
+
+- name: "1.1.1.2 | L2 | PATCH | Ensure mounting of vFAT filesystems is limited"
+  block:
+      - name: "1.1.1.2 | L2 | PATCH | Ensure mounting of vFAT filesystems is limited | Edit modprobe config"
+        lineinfile:
+            dest: /etc/modprobe.d/CIS.conf
+            regexp: "^(#)?install vfat(\\s|$)"
+            line: "install vfat /bin/true"
+            create: yes
+            mode: 0600
+
+      - name: "1.1.1.2 | L2 | PATCH | Ensure mounting of vFAT filesystems is limited | Disable vFAT"
+        modprobe:
+            name: vfat
+            state: absent
+        when: ansible_connection != 'docker'
+  when:
+      - rhel9cis_rule_1_1_1_2
+      - rhel9cis_legacy_boot
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - patch
+      - rule_1.1.1.2
+      - vfat
+
+- name: "1.1.1.3 | L1 | PATCH | Ensure mounting of squashfs filesystems is disabled"
+  block:
+      - name: "1.1.1.3 | L1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Edit modprobe config"
+        lineinfile:
+            dest: /etc/modprobe.d/CIS.conf
+            regexp: "^(#)?install squashfs(\\s|$)"
+            line: "install squashfs /bin/true"
+            create: yes
+            mode: 0600
+
+      - name: "1.1.1.3 | L1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
+        modprobe:
+            name: squashfs
+            state: absent
+        when: ansible_connection != 'docker'
+  when:
+      - rhel9cis_rule_1_1_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.1.1.3
+      - squashfs
+
+- name: "1.1.1.4 | L1 | PATCH | Ensure mounting of udf filesystems is disabled"
+  block:
+      - name: "1.1.1.4 | L1 | PATCH | Ensure mounting of udf filesystems is disable | Edit modprobe config"
+        lineinfile:
+            dest: /etc/modprobe.d/CIS.conf
+            regexp: "^(#)?install udf(\\s|$)"
+            line: "install udf /bin/true"
+            create: yes
+            mode: 0600
+
+      - name: "1.1.1.4 | L1 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"
+        modprobe:
+            name: udf
+            state: absent
+        when: ansible_connection != 'docker'
+  when:
+      - rhel9cis_rule_1_1_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.1.1.4
+      - udf

tasks/section_1/cis_1.1.x.yml

@@ -0,0 +1,363 @@
+---
+
+- name: |
+        "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured"
+        "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition"
+        "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
+        "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition"
+        "via fstab"
+  mount:
+      name: /tmp
+      src: "{{ item.device }}"
+      fstype: "{{ item.fstype }}"
+      state: present
+      opts: defaults,{% if rhel9cis_rule_1_1_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_5 %}nosuid{% endif %}
+  notify: remount tmp
+  loop: "{{ ansible_mounts }}"
+  when:
+      - item.mount == "/tmp"
+      - not rhel9cis_tmp_svc
+      - rhel9cis_rule_1_1_2 or
+        rhel9cis_rule_1_1_3 or
+        rhel9cis_rule_1_1_4 or
+        rhel9cis_rule_1_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - mounts
+      - rule_1.1.3
+      - rule_1.1.4
+      - rule_1.1.5
+
+- name: |
+        "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured"
+        "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition"
+        "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
+        "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition"
+        "via systemd"
+  template:
+      src: etc/systemd/system/tmp.mount.j2
+      dest: /etc/systemd/system/tmp.mount
+      owner: root
+      group: root
+      mode: 0644
+  notify: systemd restart tmp.mount
+  when:
+      - rhel9cis_tmp_svc
+      - rhel9cis_rule_1_1_2 or
+        rhel9cis_rule_1_1_3 or
+        rhel9cis_rule_1_1_4 or
+        rhel9cis_rule_1_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - mounts
+      - rule_1.1.3
+      - rule_1.1.4
+      - rule_1.1.5
+
+- name: "1.1.6 | L2 | AUDIT | Ensure separate partition exists for /var"
+  block:
+      - name: "1.1.6 | L2 | AUDIT | Ensure separate partition exists for /var | Absent"
+        debug:
+            msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
+        register: var_mount_absent
+        changed_when: var_mount_absent.skipped is undefined
+        when:
+            - required_mount not in mount_names
+      - name: "1.1.6 | L2 | AUDIT | Ensure separate partition exists for /var | Present"
+        debug:
+            msg: "Congratulations: {{ required_mount }} exists."
+        when:
+            - required_mount in mount_names
+  vars:
+      required_mount: '/var'
+  when:
+      - rhel9cis_rule_1_1_6
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - patch
+      - mounts
+      - rule_1.1.6
+
+- name: "1.1.7 | L2 | AUDIT | Ensure separate partition exists for /var/tmp | skips if mount absent"
+  block:
+      - name: "1.1.7 | L2 | AUDIT | Ensure separate partition exists for /var/tmp | Absent"
+        debug:
+            msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
+        register: var_tmp_mount_absent
+        changed_when: var_tmp_mount_absent.skipped is undefined
+        when:
+            - required_mount not in mount_names
+      - name: "1.1.7 | L2 | AUDIT | Ensure separate partition exists for /var/tmp | Present"
+        debug:
+            msg: "Congratulations: {{ required_mount }} exists."
+        register: var_tmp_mount_present
+        when:
+            - required_mount in mount_names
+  vars:
+      required_mount: '/var/tmp'
+  when:
+      - rhel9cis_rule_1_1_7
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - audit
+      - mounts
+      - rule_1.1.7
+
+- name: |
+          "1.1.8  | L1 | PATCH | Ensure nodev option set on /var/tmp partition | skips if mount absent"
+          "1.1.9  | L1 | PATCH | Ensure nosuid option set on /var/tmp partition | skips if mount absent"
+          "1.1.10 | L1 | PATCH | Ensure noexec option set on /var/tmp partition | skips if mount absent"
+  mount:
+      name: /var/tmp
+      src: "{{ item.device }}"
+      fstype: "{{ item.fstype }}"
+      state: present
+      opts: defaults,{% if rhel9cis_rule_1_1_10 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_8 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_9 %}nosuid{% endif %}
+  loop: "{{ ansible_mounts }}"
+  when:
+      - var_tmp_mount_present is defined
+      - item.mount == "/var/tmp"
+      - rhel9cis_rule_1_1_7  # This is required so the check takes place
+      - rhel9cis_rule_1_1_8 or
+        rhel9cis_rule_1_1_9 or
+        rhel9cis_rule_1_1_10
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - mounts
+      - skip_ansible_lint
+
+- name: "1.1.11 | L2 | AUDIT | Ensure separate partition exists for /var/log"
+  block:
+      - name: "1.1.11 | L2 | AUDIT | Ensure separate partition exists for /var/log | Absent"
+        debug:
+            msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
+        register: var_log_mount_absent
+        changed_when: var_log_mount_absent.skipped is undefined
+        when:
+            - required_mount not in mount_names
+      - name: "1.1.11 | L2 | AUDIT | Ensure separate partition exists for /var/log | Present"
+        debug:
+            msg: "Congratulations: {{ required_mount }} exists."
+        when:
+            - required_mount in mount_names
+  vars:
+      required_mount: '/var/log'
+  when:
+      - rhel9cis_rule_1_1_11
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - audit
+      - mounts
+      - rule_1.1.11
+      - skip_ansible_lint
+
+- name: "1.1.12 | L2 | AUDIT | Ensure separate partition exists for /var/log/audit"
+  block:
+      - name: "1.1.12 | L2 | AUDIT | Ensure separate partition exists for /var/log/audit | Absent"
+        debug:
+            msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
+        register: var_log_audit_mount_absent
+        changed_when: var_log_audit_mount_absent.skipped is undefined
+        when:
+            - required_mount not in mount_names
+      - name: "1.1.12 | L2 | AUDIT | Ensure separate partition exists for /var/log/audit | Present"
+        debug:
+            msg: "Congratulations: {{ required_mount }} exists."
+        when:
+            - required_mount in mount_names
+  vars:
+      required_mount: '/var/log/audit'
+  when:
+      - rhel9cis_rule_1_1_12
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - audit
+      - mounts
+      - rule_1.1.12
+
+
+- name: "1.1.13 | L2 | AUDIT | Ensure separate partition exists for /home"
+  block:
+      - name: "1.1.13 | L2 | AUDIT | Ensure separate partition exists for /home | Absent"
+        debug:
+            msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
+        register: home_mount_absent
+        changed_when: home_mount_absent.skipped is undefined
+        when:
+            - required_mount not in mount_names
+      - name: "1.1.13 | L2 | AUDIT | Ensure separate partition exists for /home | Present"
+        debug:
+            msg: "Congratulations: {{ required_mount }} exists."
+        register: home_mount_present
+        when:
+            - required_mount in mount_names
+  vars:
+      required_mount: '/home'
+  when:
+      - rhel9cis_rule_1_1_13
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - audit
+      - mounts
+      - rule_1.1.13
+      - skip_ansible_lint
+
+- name: "1.1.14 | L1 | PATCH | Ensure nodev option set on /home partition | skips if mount absent"
+  mount:
+      name: /home
+      src: "{{ item.device }}"
+      fstype: "{{ item.fstype }}"
+      state: present
+      opts: defaults,{% if rhel9cis_rule_1_1_14 %}nodev{% endif %}
+  loop: "{{ ansible_mounts }}"
+  when:
+      - home_mount_present is defined
+      - item.mount == "/home"
+      - rhel9cis_rule_1_1_14
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - mounts
+      - rule_1.1.13
+      - skip_ansible_lint
+
+- name: |
+         "1.1.15 | L1 | PATCH | Ensure nodev option set on /dev/shm partition | skips if mount absent
+          1.1.16 | L1 | PATCH | Ensure nosuid option set on /dev/shm partition | skips if mount absent
+          1.1.17 | L1 | PATCH | Ensure noexec option set on /dev/shm partition | skips if mount absent"
+  block:
+      - name: |
+         "1.1.15 | L1 | AUDIT | Ensure nodev option set on /dev/shm partition | Check for /dev/shm existence
+          1.1.16 | L1 | AUDIT | Ensure nosuid option set on /dev/shm partition | Check for /dev/shm existence
+          1.1.17 | L1 | AUDIT | Ensure noexec option set on /dev/shm partition | Check for /dev/shm existence"
+        shell: mount -l | grep -E '\s/dev/shm\s'
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_1_1_15_dev_shm_status
+
+      - name: |
+              "1.1.15 | L1 | PATCH | Ensure nodev option set on /dev/shm partition | skips if mount absent
+               1.1.16 | L1 | PATCH | Ensure nosuid option set on /dev/shm partition | skips if mount absent
+               1.1.17 | L1 | PATCH | Ensure noexec option set on /dev/shm partition | skips if mount absent"
+        mount:
+            name: /dev/shm
+            src: tmpfs
+            fstype: tmpfs
+            state: mounted
+            opts: defaults,{% if rhel9cis_rule_1_1_17 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_15 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_16 %}nosuid{% endif %}
+        when: "'dev/shm' in rhel9cis_1_1_15_dev_shm_status.stdout"
+  when:
+      - rhel9cis_rule_1_1_15 or
+        rhel9cis_rule_1_1_16 or
+        rhel9cis_rule_1_1_17
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - mounts
+      - rule_1.1.15
+      - rule_1.1.16
+      - rule_1.1.17
+
+- name: |
+      "1.1.18 | L1 | PATCH | Ensure nodev option set on removable media partitions"
+      "1.1.19 | L1 | PATCH | Ensure nosuid option set on removable media partitions"
+      "1.1.20 | L1 | PATCH | Ensure noexec option set on removable media partitions"
+  debug:
+      msg: "--> Not relevant"
+  changed_when: false
+  when:
+      - rhel9cis_rule_1_1_18 or
+        rhel9cis_rule_1_1_19 or
+        rhel9cis_rule_1_1_20
+  tags:
+      - level1-server
+      - level1-workstation
+      - notscored
+      - audit
+      - mounts
+      - rule_1.1.18
+      - rule_1.1.19
+      - rule_1.1.20
+
+- name: "1.1.21 | L1 | PATCH | Ensure sticky bit is set on all world-writable directories"
+  shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t
+  args:
+      warn: no
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_1_1_21
+  tags:
+      - skip_ansible_lint
+      - level1-server
+      - level1-workstation
+      - patch
+      - stickybits
+      - permissons
+      - rule_1.1.21
+
+- name: "1.1.22 | L1 | PATCH | Disable Automounting"
+  service:
+      name: autofs
+      enabled: no
+  when:
+      - not rhel9cis_allow_autofs
+      - "'autofs' in ansible_facts.packages"
+      - rhel9cis_rule_1_1_22
+  tags:
+      - level1-server
+      - level2-workstation
+      - patch
+      - mounts
+      - automounting
+      - rule_1.1.22
+
+- name: "1.1.23 | L1 | PATCH | Disable USB Storage"
+  block:
+      - name: "1.1.23 | L1 | PATCH | Disable USB Storage | Edit modprobe config"
+        lineinfile:
+            dest: /etc/modprobe.d/CIS.conf
+            regexp: "^(#)?install usb-storage(\\s|$)"
+            line: "install usb-storage /bin/true"
+            create: yes
+            owner: root
+            group: root
+            mode: 0600
+
+      - name: "1.1.23 | L1 | PATCH | Disable USB Storage | Edit modprobe config"
+        modprobe:
+            name: usb-storage
+            state: absent
+  when:
+      - rhel9cis_rule_1_1_23
+  tags:
+      - level1-server
+      - level2-workstation
+      - patch
+      - mounts
+      - removable_storage
+      - rule_1.1.23

tasks/section_1/cis_1.10.yml

@@ -0,0 +1,15 @@
+---
+
+- name: "1.10 | L1 | PATCH | Ensure system-wide crypto policy is not legacy"
+  shell: |
+      update-crypto-policies --set "{{ rhel9cis_crypto_policy }}"
+      update-crypto-policies
+  when:
+      - rhel9cis_rule_1_10
+      - system_wide_crypto_policy['stdout'] == 'LEGACY'
+  tags:
+      - level1-server
+      - level1-workstation
+      - no system_is_ec2
+      - patch
+      - rule_1.10

tasks/section_1/cis_1.11.yml

@@ -0,0 +1,15 @@
+---
+
+- name: "1.11 | L2 | PATCH | Ensure system-wide crypto policy is FUTURE or FIPS"
+  shell: |
+      update-crypto-policies --set "{{ rhel9cis_crypto_policy }}"
+      update-crypto-policies
+  when:
+      - rhel9cis_rule_1_11
+      - system_wide_crypto_policy['stdout'] not in rhel9cis_allowed_crypto_policies
+  tags:
+      - level2-server
+      - level2-workstation
+      - not system_is_ec2
+      - patch
+      - rule_1.11

tasks/section_1/cis_1.2.x.yml

@@ -0,0 +1,100 @@
+---
+
+- name: "1.2.1 | L1 | PATCH | Ensure Red Hat Subscription Manager connection is configured"
+  redhat_subscription:
+      state: present
+      username: "{{ rhel9cis_rh_sub_user }}"
+      password: "{{ rhel9cis_rh_sub_password }}"
+      auto_attach: true
+      no_log: true
+  when:
+      - ansible_distribution == "RedHat"
+      - rhel9cis_rhnsd_required
+      - rhel9cis_rule_1_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - notscored
+      - patch
+      - rule_1.2.1
+      - skip_ansible_lint  # Added as no_log still errors on ansuible-lint
+
+- name: "1.2.2 | L1 | PATCH | Disable the rhnsd Daemon"
+  service:
+      name: rhnsd
+      state: stopped
+      enabled: no
+      masked: true
+  when:
+      - ansible_distribution == "RedHat"
+      - rhnsd_service_status.stdout == "loaded" and not rhel9cis_rhnsd_required
+      - rhel9cis_rule_1_2_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - notscored
+      - patch
+      - rule_1.2.2
+
+- name: "1.2.3 | L1 | AUDIT | Ensure GPG keys are configured"
+  command: gpg --quiet --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-{{ ansible_distribution|lower }}-release
+  when:
+      - rhel9cis_rule_1_2_3
+      - ansible_distribution == "RedHat"
+  tags:
+      - level1-server
+      - level1-workstation
+      - notscored
+      - patch
+      - rule_1.2.3
+
+- name: "1.2.4 | L1 | PATCH | Ensure gpgcheck is globally activated"
+  block:
+      - name: "1.2.4 | L1 | AUDIT | Ensure gpgcheck is globally activated | Find repos"
+        find:
+            paths: /etc/yum.repos.d
+            patterns: "*.repo"
+        register: yum_repos
+        changed_when: false
+
+      - name: "1.2.4 | L1 | PATCH | Ensure gpgcheck is globally activated | Update yum.repos"
+        replace:
+            name: "{{ item.path }}"
+            regexp: "^gpgcheck=0"
+            replace: "gpgcheck=1"
+        with_items:
+            - "{{ yum_repos.files }}"
+  when:
+      - rhel9cis_rule_1_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.2.4
+
+- name: "1.2.5 | L1 | Ensure package manager repositories are configured"
+  block:
+      - name: "1.2.5 | L1 | AUDIT | Ensure package manager repositories are configured | Get repo list"
+        command: dnf repolist
+        changed_when: false
+        failed_when: false
+        register: dnf_configured
+        check_mode: no
+        args:
+            warn: false
+
+      - name: "1.2.5 | L1 | AUDIT | Ensure package manager repositories are configured | Display repo list"
+        debug:
+            msg:
+                - "Alert! Below are the configured repos. Please review and make sure all align with site policy"
+                - "{{ dnf_configured.stdout_lines }}"
+  when:
+      - rhel9cis_rule_1_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - notscored
+      - patch
+      - rule_1.2.5
+      - skip_ansible_lint

tasks/section_1/cis_1.3.x.yml

@@ -0,0 +1,44 @@
+---
+
+- name: "1.3.1 | L1 | PATCH | Ensure sudo is installed"
+  package:
+      name: sudo
+      state: present
+  when:
+      - rhel9cis_rule_1_3_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - sudo
+      - patch
+      - rule_1.3.1
+
+- name: "1.3.2 | L1 | PATCH | Ensure sudo commands use pty"
+  lineinfile:
+      dest: /etc/sudoers
+      line: "Defaults    use_pty"
+      state: present
+  when:
+      - rhel9cis_rule_1_3_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.3.2
+
+- name: "1.3.3 | L1 | PATCH | Ensure sudo log file exists"
+  lineinfile:
+      dest: /etc/sudoers
+      regexp: '^Defaults    logfile='
+      line: 'Defaults    logfile="{{ rhel9cis_varlog_location }}"'
+      state: present
+  when:
+      - rhel9cis_rule_1_3_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.3.3

tasks/section_1/cis_1.4.x.yml

@@ -0,0 +1,50 @@
+---
+
+- name: "1.4.1 | L1 | PATCH | Ensure AIDE is installed"
+  block:
+      - name: "1.4.1 | L1 | PATCH | Ensure AIDE is installed | Install AIDE"
+        package:
+            name: aide
+            state: present
+
+      - name: "1.4.1 | L1 | PATCH | Ensure AIDE is installed | Configure AIDE"
+        command: /usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
+        changed_when: false
+        failed_when: false
+        async: 45
+        poll: 0
+        args:
+            creates: /var/lib/aide/aide.db.gz
+        when: not ansible_check_mode
+  when:
+      - rhel9cis_config_aide
+      - rhel9cis_rule_1_4_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - aide
+      - patch
+      - rule_1.4.1
+
+- name: "1.4.2 | L1 | PATCH | Ensure filesystem integrity is regularly checked"
+  cron:
+      name: Run AIDE integrity check
+      cron_file: "{{ rhel9cis_aide_cron['cron_file'] }}"
+      user: "{{ rhel9cis_aide_cron['cron_user'] }}"
+      minute: "{{ rhel9cis_aide_cron['aide_minute'] | default('0') }}"
+      hour: "{{ rhel9cis_aide_cron['aide_hour'] | default('5') }}"
+      day: "{{ rhel9cis_aide_cron['aide_day'] | default('*') }}"
+      month: "{{ rhel9cis_aide_cron['aide_month'] | default('*') }}"
+      weekday: "{{ rhel9cis_aide_cron['aide_weekday'] | default('*') }}"
+      job: "{{ rhel9cis_aide_cron['aide_job'] }}"
+  when:
+      - rhel9cis_rule_1_4_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - aide
+      - file_integrity
+      - patch
+      - rule_1.4.2

tasks/section_1/cis_1.5.x.yml

@@ -0,0 +1,76 @@
+---
+
+- name: "1.5.1 | L1 | PATCH | Ensure permissions on bootloader config are configured"
+  block:
+      - name: "1.5.1 | L1 | PATCH | Ensure permissions on bootloader config are configured"
+        file:
+            path: "{{ grub_cfg.stat.lnk_source }}"
+            owner: root
+            group: root
+            mode: 0600
+
+      - name: "1.5.1 | L1 | PATCH | Ensure permissions on bootloader config are configured | UEFI"
+        mount:
+            name: /boot/efi
+            src: "UUID={{ item.uuid }}"
+            fstype: vfat
+            state: present
+            opts: defaults,umask=0027,fmask=0077,uid=0,gid=0
+            passno: '0'
+        loop: "{{ ansible_mounts }}"
+        when:
+            - not rhel9cis_legacy_boot
+            - item.mount == "/boot/efi"
+  when:
+      - rhel9cis_rule_1_5_1
+      - grub_cfg.stat.exists
+      - grub_cfg.stat.islnk
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - grub
+      - patch
+      - rule_1.5.1
+
+- name: "1.5.2 | L1 | PATCH | Ensure bootloader password is set"
+  copy:
+      dest: /boot/grub2/user.cfg
+      content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}"
+      owner: root
+      group: root
+      mode: 0600
+  notify: grub2cfg
+  when:
+      - rhel9cis_set_boot_pass
+      - grub_pass is defined and grub_pass.passhash is defined
+      - grub_pass.passhash | length > 0
+      - rhel9cis_rule_1_5_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - grub
+      - patch
+      - rule_1.5.2
+
+- name: "1.5.3 | L1 | PATCH | Ensure authentication required for single user mode"
+  block:
+      - name: "1.5.3 | L1 | PATCH | Ensure authentication required for single user mode | Emergency service"
+        lineinfile:
+            dest: /usr/lib/systemd/system/emergency.service
+            regexp: '/sbin/sulogin'
+            line: 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency'
+
+      - name: "1.5.3 | L1 | PATCH | Ensure authentication required for single user mode | Rescue service"
+        lineinfile:
+            dest: /usr/lib/systemd/system/rescue.service
+            regexp: '/sbin/sulogin'
+            line: 'ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue'
+  when:
+      - rhel9cis_rule_1_5_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_1.5.3

tasks/section_1/cis_1.6.x.yml

@@ -0,0 +1,54 @@
+---
+
+- name: "1.6.1 | L1 | PATCH | Ensure core dumps are restricted"
+  block:
+      - name: "1.6.1 | L1 | Ensure core dumps are restricted | Update limits.conf file"
+        lineinfile:
+            state: present
+            dest: /etc/security/limits.conf
+            regexp: '^#?\\*.*core'
+            line: '*                hard    core            0'
+            insertbefore: '^# End of file'
+
+      - name: "1.6.1 | L1 | PATCH | Ensure core dumps are restricted | Set active kernel parameter"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify: 
+            - update sysctl
+
+      - name: "1.6.1 | L1 | PATCH | Ensure core dumps are restricted | if systemd coredump"
+        lineinfile:
+            path: /etc/systemd/coredump.conf
+            regexp: "{{ item.regexp }}"
+            line: "{{ item.regexp }}{{ item.line }}"
+            state: present
+        with_items:
+            - {'regexp': 'Storage=', 'line': 'none'}
+            - {'regexp': 'ProcessSizeMax=', 'line': '0'}
+        notify:
+            - systemd_daemon_reload
+        when:
+            - systemd_coredump.stat.exists
+  when:
+      - rhel9cis_rule_1_6_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - sysctl
+      - patch
+      - rule_1.6.1
+
+- name: "1.6.2 | L1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
+  debug:
+      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: 
+      - update sysctl
+  when:
+      - rhel9cis_rule_1_6_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_1.6.2

tasks/section_1/cis_1.7.1.x.yml

@@ -0,0 +1,115 @@
+---
+
+- name: "1.7.1.1 | L2 | PATCH | Ensure SELinux is installed"
+  package:
+      name: libselinux
+      state: present
+  when:
+      - rhel9cis_rule_1_7_1_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - patch
+      - rule_1.7.1.1
+
+- name: "1.7.1.2 | L2 | PATCH | Ensure SELinux is not disabled in bootloader configuration"
+  replace:
+      dest: /etc/default/grub
+      regexp: '(selinux|enforcing)\s*=\s*0\s*'
+      replace: ''
+  register: selinux_grub_patch
+  ignore_errors: yes
+  notify: grub2cfg
+  when:
+      - rhel9cis_rule_1_7_1_2
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - patch
+      - rule_1.7.1.2
+
+- name: "1.7.1.3 | L2 | PATCH | Ensure SELinux policy is configured"
+  selinux:
+      conf: /etc/selinux/config
+      policy: "{{ rhel9cis_selinux_pol }}"
+      state: enforcing
+  when:
+      - not rhel9cis_selinux_disable
+      - rhel9cis_rule_1_7_1_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - selinux
+      - patch
+      - rule_1.7.1.3
+
+- name: "1.7.1.4 | L2 | PATCH | Ensure the SELinux state is enforcing"
+  selinux:
+      conf: /etc/selinux/config
+      policy: "{{ rhel9cis_selinux_pol }}"
+      state: enforcing
+  when:
+      - not rhel9cis_selinux_disable
+      - rhel9cis_rule_1_7_1_4
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - selinux
+      - patch
+      - rule_1.7.1.4
+
+- name: "1.7.1.5 | L2 | AUDIT | Ensure no unconfined daemons exist"
+  block:
+      - name: "1.7.1.5 | L2 | AUDIT | Ensure no unconfined daemons exist | Find the unconfined daemons"
+        shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
+        register: rhelcis_1_7_1_5_unconf_daemons
+        failed_when: false
+        changed_when: false
+
+      - name: "1.7.1.5 | L2 | AUDIT | Ensure no unconfined daemons exist | Message on no unconfined daemones"
+        debug:
+            msg: "Good News! There are no unconfined daemons found on your system"
+        when: rhelcis_1_7_1_5_unconf_daemons.stdout | length == 0
+
+      - name: "1.7.1.5 | L2 | AUDIT | Ensure no unconfined daemons exist | Message on unconfined daemones"
+        debug:
+            msg: "Warning! You have unconfined daemons: {{ rhelcis_1_7_1_5_unconf_daemons.stdout_lines }}"
+        when: rhelcis_1_7_1_5_unconf_daemons.stdout | length > 0
+  when:
+      - rhel9cis_rule_1_7_1_5
+  tags:
+      - level2-server
+      - level2-workstation
+      - audit
+      - rule_1.7.1.5
+
+- name: "1.7.1.6 | L2 | PATCH | Ensure SETroubleshoot is not installed"
+  package:
+      name: setroubleshoot
+      state: absent
+  when:
+      - rhel9cis_rule_1_7_1_6
+      - "'setroubleshoot' in ansible_facts.packages"
+  tags:
+      - level2-server
+      - scored
+      - selinux
+      - patch
+      - rule_1.7.1.6
+
+- name: "1.7.1.7 | L2 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
+  package:
+      name: mcstrans
+      state: absent
+  when:
+      - rhel9cis_rule_1_7_1_7
+  tags:
+      - level2-server
+      - level2-workstation
+      - scored
+      - patch
+      - rule_1.7.1.7

tasks/section_1/cis_1.8.1.x.yml

@@ -0,0 +1,96 @@
+---
+
+- name: "1.8.1.1 | L1 | PATCH | Ensure message of the day is configured properly"
+  template:
+      src: etc/motd.j2
+      dest: /etc/motd
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - banner
+      - patch
+      - rule_1.8.1.1
+
+- name: "1.8.1.2 | L1 | PATCH | Ensure local login warning banner is configured properly"
+  template:
+      src: etc/issue.j2
+      dest: /etc/issue
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_1.8.1.2
+
+- name: "1.8.1.3 | L1 | PATCH | Ensure remote login warning banner is configured properly"
+  template:
+      src: etc/issue.net.j2
+      dest: /etc/issue.net
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - banner
+      - patch
+      - rule_1.8.1.3
+
+- name: "1.8.1.4 | L1 | PATCH | Ensure permissions on /etc/motd are configured"
+  file:
+      dest: /etc/motd
+      state: file
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - perms
+      - patch
+      - rule_1.8.1.4
+
+- name: "1.8.1.5 | L1 | PATCH | Ensure permissions on /etc/issue are configured"
+  file:
+      dest: /etc/issue
+      state: file
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - perms
+      - patch
+      - rule_1.8.1.5
+
+- name: "1.8.1.6 | L1 | PATCH | Ensure permissions on /etc/issue.net are configured"
+  file:
+      dest: /etc/issue.net
+      state: file
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_1_8_1_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - perms
+      - patch
+      - rule_1.8.1.6

tasks/section_1/cis_1.8.2.yml

@@ -0,0 +1,27 @@
+---
+
+- name: "1.8.2 | L1 | PATCH | Ensure GDM login banner is configured"
+  lineinfile:
+      dest: "{{ item.file }}"
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+      state: present
+      create: yes
+      owner: root
+      group: root
+      mode: 0644
+  with_items:
+      - { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-enable', line: 'banner-message-enable=true' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel9cis_warning_banner }}' " }
+  when:
+      - rhel9cis_gui
+      - rhel9cis_rule_1_8_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_1.8.2

tasks/section_1/cis_1.9.yml

@@ -0,0 +1,15 @@
+---
+
+- name: "1.9 | L1 | PATCH | Ensure updates, patches, and additional security software are installed"
+  package:
+      name: "*"
+      state: latest
+  when:
+      - rhel9cis_rule_1_9
+      - not system_is_ec2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_1.9
+      - skip_ansible_lint

tasks/section_1/main.yml

@@ -0,0 +1,42 @@
+---
+
+- name: "SECTION | 1.1 | FileSystem Configurations\n
+         SECTION | 1.1.1.x | Disable unused filesystems"
+  include: cis_1.1.1.x.yml
+- include: cis_1.1.x.yml
+
+- name: "SECTION | 1.2 | Configure Software Updates"
+  include: cis_1.2.x.yml
+
+- name: "SECTION | 1.3 | Configure sudo"
+  include: cis_1.3.x.yml
+
+- name: "SECTION | 1.4 | Filesystem Integrity"
+  include: cis_1.4.x.yml
+  when: rhel9cis_config_aide
+
+- name: "SECTION | 1.5 | Secure Boot Settings"
+  include: cis_1.5.x.yml
+
+- name: "SECTION | 1.6 | Additional Process Hardening"
+  include: cis_1.6.x.yml
+
+- name: "SECTION | 1.7 | bootloader and Mandatory Access Control"
+  include: cis_1.7.1.x.yml
+  when: not rhel9cis_selinux_disable
+
+- name: "SECTION | 1.8 | Warning Banners"
+  include: cis_1.8.1.x.yml
+
+- name: "SECTION | 1.9 | Updated and Patches"
+  include: cis_1.9.yml
+
+- name: "SECTION | 1.10 | Crypto policies"
+  include: cis_1.10.yml
+  when:
+  - not system_is_ec2
+
+- name: "SECTION | 1.11 | FIPS/FUTURE Crypto policies"
+  include: cis_1.11.yml
+  when:
+  - not system_is_ec2

tasks/section_2/cis_2.1.1.yml

@@ -0,0 +1,14 @@
+---
+
+- name: "2.1.1 | L1 | PATCH | Ensure xinetd is not installed"
+  package:
+      name: xinetd
+      state: absent
+  when:
+      - rhel9cis_rule_2_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - patch
+      - rule_2.1.1

tasks/section_2/cis_2.2.1.x.yml

@@ -0,0 +1,42 @@
+---
+
+- name: "2.2.1.1 | L1 | PATCH | Ensure time synchronization is in use - service install"
+  package:
+      name: "{{ rhel9cis_time_synchronization }}"
+      state: present
+  when:
+      - rhel9cis_rule_2_2_1_1
+      - not rhel9cis_system_is_container
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.1.1
+
+- name: "2.2.1.2 | L1 | PATCH | Ensure chrony is configured"
+  block:
+      - name: "2.2.1.2 | L1 | PATCH | Ensure chrony is configured | Set configuration"
+        template:
+            src: chrony.conf.j2
+            dest: /etc/chrony.conf
+            owner: root
+            group: root
+            mode: 0644
+
+      - name: "2.2.1.2 | L1 | PATCH | Ensure chrony is configured | modify /etc/sysconfig/chronyd | 1"
+        lineinfile:
+            dest: /etc/sysconfig/chronyd
+            regexp: "^(#)?OPTIONS"
+            line: "OPTIONS=\"-u chrony\""
+            state: present
+            create: yes
+            mode: 0644
+  when:
+      - rhel9cis_time_synchronization == "chrony"
+      - rhel9cis_rule_2_2_1_2
+      - not rhel9cis_system_is_container
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.1.2

tasks/section_2/cis_2.2.x.yml

@@ -0,0 +1,288 @@
+---
+
+- name: "2.2.2 | L1 | PATCH | Ensure X Window System is not installed"
+  block:
+      - name: "2.2.2 | L1 | AUDIT | Ensure X Window System is not installed | capture xorg-x11 packages"
+        shell: rpm -qa | grep xorg-x11
+        args:
+            warn: no
+        failed_when: xorg_x11_installed.rc >=2
+        check_mode: no
+        changed_when: false
+        register: xorg_x11_installed
+
+      - name: "2.2.2 | L1 | PATCH | Ensure X Window System is not installed | remove packages if found"
+        shell: "dnf remove {{ item }}"
+        args:
+            warn: no
+        with_items:
+            - xorg_x11_installed.stdout_lines
+        when: xorg_x11_installed.stdout | length > 0
+  when:
+      - not rhel9cis_xwindows_required
+      - rhel9cis_rule_2_2_2
+  tags:
+      - level1-server
+      - scored
+      - xwindows
+      - patch
+      - rule_2.2.2
+
+- name: "2.2.3 | L1 | PATCH | Ensure rsync service is not enabled "
+  service:
+      name: rsyncd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_rsyncd_server
+      - "'rsyncd' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.3
+
+- name: "2.2.4 | L1 | PATCH | Ensure Avahi Server is not enabled"
+  service:
+      name: avahi-daemon
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_avahi_server
+      - "'avahi' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - avahi
+      - services
+      - patch
+      - rule_2.2.4
+
+- name: "2.2.5 | L1 | PATCH | Ensure SNMP Server is not enabled"
+  service:
+      name: snmpd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_snmp_server
+      - "'net-snmp' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.5
+
+- name: "2.2.6 | L1 | PATCH | Ensure HTTP Proxy Server is not enabled"
+  service:
+      name: squid
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_squid_server
+      - "'squid' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.6
+
+- name: "2.2.7 | L1 | PATCH | Ensure Samba is not enabled"
+  service:
+      name: smb
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_smb_server
+      - "'samba' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.7
+
+- name: "2.2.8 | L1 | PATCH | Ensure IMAP and POP3 server is not enabled"
+  service:
+      name: dovecot
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_dovecot_server
+      - "'dovecot' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.8
+
+- name: "2.2.9 | L1 | PATCH | Ensure HTTP server is not enabled"
+  service:
+      name: httpd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_httpd_server
+      - "'httpd' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_9
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.9
+
+- name: "2.2.10 | L1 | PATCH | Ensure FTP Server is not enabled"
+  service:
+      name: vsftpd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_vsftpd_server
+      - "'vsftpd' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_10
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.10
+
+- name: "2.2.11 | L1 | PATCH | Ensure DNS Server is not enabled"
+  service:
+      name: named
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_named_server
+      - "'bind' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_11
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.11
+
+- name: "2.2.12 | L1 | PATCH | Ensure NFS is not enabled"
+  service:
+      name: nfs-server
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_nfs_rpc_server
+      - "'nfs-utils' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_12
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - nfs
+      - services
+      - patch
+      - rule_2.2.12
+
+- name: "2.2.13 | L1 | PATCH | Ensure RPC is not enabled"
+  service:
+      name: rpcbind
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_nfs_rpc_server
+      - "'rpcbind' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_13
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - rpc
+      - services
+      - patch
+      - rule_2.2.7
+
+- name: "2.2.14 | L1 | PATCH | Ensure LDAP server is not enabled"
+  service:
+      name: slapd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_ldap_server
+      - "'openldap-servers' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_14
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - ldap
+      - services
+      - patch
+      - rule_2.2.6
+
+- name: "2.2.15 | L1 | PATCH | Ensure DHCP Server is not enabled"
+  service:
+      name: dhcpd
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_dhcp_server
+      - "'dhcp' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_15
+  tags:
+      - level1-server
+      - level1-workstation
+      - scored
+      - dhcp
+      - services
+      - patch
+      - rule_2.2.15
+
+- name: "2.2.16 | L1 | PATCH | Ensure CUPS is not enabled"
+  service:
+      name: cups
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_cups_server
+      - "'cups' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_16
+  tags:
+      - level1-server
+      - level2-workstation
+      - scored
+      - cups
+      - services
+      - patch
+      - rule_2.2.16
+
+- name: "2.2.17 | L1 | PATCH | Ensure NIS Server is not enabled"
+  service:
+      name: ypserv
+      state: stopped
+      enabled: no
+  when:
+      - not rhel9cis_nis_server
+      - "'ypserv' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_17
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.17
+
+- name: "2.2.18 | L1 | PATCH | Ensure mail transfer agent is configured for local-only mode"
+  lineinfile:
+      dest: /etc/postfix/main.cf
+      regexp: "^(#)?inet_interfaces"
+      line: "inet_interfaces = loopback-only"
+  notify: restart postfix
+  when:
+      - not rhel9cis_is_mail_server
+      - "'postfix' in ansible_facts.packages"
+      - rhel9cis_rule_2_2_18
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.2.1

tasks/section_2/cis_2.3.x.yml

@@ -0,0 +1,43 @@
+---
+
+- name: "2.3.1 | L1 | PATCH | Ensure NIS Client is not installed"
+  package:
+      name: ypbind
+      state: absent
+  when:
+      - not rhel9cis_ypbind_required
+      - "'ypbind' in ansible_facts.packages"
+      - rhel9cis_rule_2_3_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.3.1
+
+- name: "2.3.2 | L1 | PATCH | Ensure telnet client is not installed"
+  package:
+      name: telnet
+      state: absent
+  when:
+      - not rhel9cis_telnet_required
+      - "'telnet' in ansible_facts.packages"
+      - rhel9cis_rule_2_3_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.3.2
+
+- name: "2.3.3 | L1 | PATCH | Ensure LDAP client is not installed"
+  package:
+      name: openldap-clients
+      state: absent
+  when:
+      - not rhel9cis_openldap_clients_required
+      - "'openldap-clients' in ansible_facts.packages"
+      - rhel9cis_rule_2_3_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_2.3.3

tasks/section_2/main.yml

@@ -0,0 +1,13 @@
+---
+
+- name: "SECTION | 2.1 | xinetd"
+  include: cis_2.1.1.yml
+
+- name: "SECTION | 2.2.1 | Time Synchronization"
+  include: cis_2.2.1.x.yml
+
+- name: "SECTION | 2.2 | Special Purpose Services"
+  include: cis_2.2.x.yml
+
+- name: "SECTION | 2.3 | Service Clients"
+  include: cis_2.3.x.yml

tasks/section_3/cis_3.1.x.yml

@@ -0,0 +1,43 @@
+---
+
+- name: "3.1.1 | L1 | PATCH | Ensure IP forwarding is disabled"
+  block:
+      - name: "3.1.1 | L1 | PATCH | Ensure IP forwarding is disabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify: 
+            - update sysctl
+            - sysctl flush ipv4 route table
+
+      - name: "3.1.1 | L1 | PATCH | Ensure IP forwarding is disabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify:
+            - sysctl flush ipv6 route table
+            - update sysctl
+        when: rhel9cis_ipv6_required
+  when:
+      - not rhel9cis_is_router
+      - rhel9cis_rule_3_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.1.1
+
+- name: "3.1.2 | L1 | PATCH | Ensure packet redirect sending is disabled"
+  debug:
+      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify:
+      - update sysctl
+      - sysctl flush ipv4 route table
+  when:
+      - not rhel9cis_is_router
+      - rhel9cis_rule_3_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.1.2

tasks/section_3/cis_3.2.x.yml

@@ -0,0 +1,155 @@
+---
+
+- name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
+  block:
+      - name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify: 
+            - update sysctl
+            - sysctl flush ipv4 route table
+
+      - name: "3.2.1 | L1 | PATCH | Ensure source routed packets are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify:
+            - sysctl flush ipv6 route table
+            - update sysctl
+        when: rhel9cis_ipv6_required
+  when:
+      - rhel9cis_rule_3_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.1
+
+- name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
+  block:
+      - name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify: 
+            - update sysctl
+            - sysctl flush ipv4 route table
+
+      - name: "3.2.2 | L1 | PATCH | Ensure ICMP redirects are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify:
+            - sysctl flush ipv6 route table
+            - update sysctl
+        when: rhel9cis_ipv6_required
+  when:
+      - rhel9cis_rule_3_2_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.2
+
+- name: "3.2.3 | L1 | PATCH | Ensure secure ICMP redirects are not accepted"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.3
+
+- name: "3.2.4 | L1 | PATCH | Ensure suspicious packets are logged"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.4
+
+- name: "3.2.5 | L1 | PATCH | Ensure broadcast ICMP requests are ignored"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.5
+
+- name: "3.2.6 | L1 | PATCH | Ensure bogus ICMP responses are ignored"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.6
+
+- name: "3.2.7 | L1 | PATCH | Ensure Reverse Path Filtering is enabled"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.7
+
+- name: "3.2.8 | L1 | PATCH | Ensure TCP SYN Cookies is enabled"
+  debug:
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+  notify: update sysctl
+  when:
+      - rhel9cis_rule_3_2_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - sysctl
+      - patch
+      - rule_3.2.8
+
+- name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
+  block:
+      - name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify: 
+            - update sysctl
+            - sysctl flush ipv4 route table
+
+      - name: "3.2.9 | L2 | PATCH | Ensure IPv6 router advertisements are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+        notify:
+            - sysctl flush ipv6 route table
+            - update sysctl
+        when: rhel9cis_ipv6_required
+  when:
+      - rhel9cis_ipv6_required
+      - rhel9cis_rule_3_2_9
+  tags:
+      - level2-server
+      - level2-workstation
+      - sysctl
+      - patch
+      - rule_3.2.9

tasks/section_3/cis_3.3.x.yml

@@ -0,0 +1,61 @@
+---
+
+- name: "3.3.1 | L2 | PATCH | Ensure DCCP is disabled"
+  lineinfile:
+      dest: /etc/modprobe.d/CIS.conf
+      regexp: "^(#)?install dccp(\\s|$)"
+      line: "install dccp /bin/true"
+      create: yes
+      mode: 0600
+  when:
+      - rhel9cis_rule_3_3_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_3.3.1
+
+- name: "3.3.2 | L2 | PATCH | Ensure SCTP is disabled"
+  lineinfile:
+      dest: /etc/modprobe.d/CIS.conf
+      regexp: "^(#)?install sctp(\\s|$)"
+      line: "install sctp /bin/true"
+      create: yes
+      mode: 0600
+  when:
+      - rhel9cis_rule_3_3_2
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_3.3.2
+
+- name: "3.3.3 | L2 | PATCH | Ensure RDS is disabled"
+  lineinfile:
+      dest: /etc/modprobe.d/CIS.conf
+      regexp: "^(#)?install rds(\\s|$)"
+      line: "install rds /bin/true"
+      create: yes
+      mode: 0600
+  when:
+      - rhel9cis_rule_3_3_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_3.3.3
+
+- name: "3.3.4 | L2 | PATCH | Ensure TIPC is disabled"
+  lineinfile:
+      dest: /etc/modprobe.d/CIS.conf
+      regexp: "^(#)?install tipc(\\s|$)"
+      line: "install tipc /bin/true"
+      create: yes
+      mode: 0600
+  when:
+      - rhel9cis_rule_3_3_4
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_3.3.4

tasks/section_3/cis_3.4.1.1.yml

@@ -0,0 +1,13 @@
+---
+
+- name: "3.4.1.1 | L1 | PATCH | Ensure a Firewall package is installed"
+  package:
+      name: "{{ rhel9cis_firewall }}"
+      state: present
+  when:
+      - rhel9cis_rule_3_4_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.1.1

tasks/section_3/cis_3.4.2.x.yml

@@ -0,0 +1,102 @@
+---
+
+- name: "3.4.2.1 | L1 | PATCH | Ensure firewalld service is enabled and running"
+  service:
+      name: firewalld
+      state: started
+      enabled: yes
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3_4_2_1
+
+- name: "3.4.2.2 | L1 | PATCH | Ensure iptables is not enabled with firewalld"
+  systemd:
+      name: iptables
+      enabled: false
+      masked: true
+  ignore_errors: true
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_2
+  tags:
+      - skip_ansible_lint
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3_4_2_2
+
+- name: "3.4.2.3 | L1 | PATCH | Ensure nftables is not enabled with firewalld"
+  systemd:
+      name: nftables
+      enabled: false
+      masked: true
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3_4_2_3
+
+- name: "3.4.2.4 | L1 | PATCH | Ensure default zone is set"
+  command: firewall-cmd --set-default-zone="{{ rhel9cis_default_zone }}"
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.2.4
+
+- name: "3.4.2.5 | L1 | AUDIT | Ensure network interfaces are assigned to appropriate zone"
+  block:
+      - name: "3.4.2.5 | L1 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies"
+        shell: "nmcli -t connection show | awk -F: '{ if($4){print $4} }' | while read INT; do firewall-cmd --get-active-zones | grep -B1 $INT; done"
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_3_4_2_5_interfacepolicy
+
+      - name: "3.4.2.5 | L1 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies | Show the interface to policy"
+        debug:
+            msg:
+                - "The items below are the policies tied to the interfaces, please correct as needed"
+                - "{{ rhel9cis_3_4_2_5_interfacepolicy.stdout_lines }}"
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_3.4.2.5
+
+- name: "3.4.2.6 | L1 | AUDIT | Ensure firewalld drops unnecessary services and ports"
+  block:
+      - name: "3.4.2.6 | L1 | AUDIT | Ensure firewalld drops unnecessary services and ports | Get list of services and ports"
+        shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done"
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_3_4_2_6_servicesport
+
+      - name: "3.4.2.6 | L1 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports"
+        debug:
+            msg:
+                - "The items below are the services and ports that are accepted, please correct as needed"
+                - "{{ rhel9cis_3_4_2_6_servicesport.stdout_lines }}"
+  when:
+      - rhel9cis_firewall == "firewalld"
+      - rhel9cis_rule_3_4_2_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_3.4.2.6

tasks/section_3/cis_3.4.3.x.yml

@@ -0,0 +1,264 @@
+---
+
+- name: "3.4.3.1 | L1 | PATCH | Ensure iptables are flushed with nftables"
+  command: ip6tables -F
+  when:
+      - rhel9cis_rule_3_4_3_1
+      - rhel9cis_firewall != "iptables"
+      - rhel9cis_ipv6_required
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.1
+
+- name: "3.4.3.2 | L1 | AUDIT | Ensure an nftables table exists"
+  block:
+      - name: "3.4.3.2 | L1 | AUDIT | Ensure a table exists | Check for tables"
+        command: nft list tables
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_2_nft_tables
+
+      - name: "3.4.3.2 | L1 | AUDIT | Ensure an nftables table exists | Show existing tables"
+        debug:
+            msg:
+                - "Below are the current nft tables, please review"
+                - "{{ rhel9cis_3_4_3_2_nft_tables.stdout_lines }}"
+        when: rhel9cis_3_4_3_2_nft_tables.stdout | length > 0
+
+      - name: "3.4.3.2 | L1 | AUDIT | Ensure an nftables table exists | Alert on no tables"
+        debug:
+            msg:
+                - "Warning! You currently have no nft tables, please review your setup"
+                - 'Use the command "nft create table inet <table name>" to create a new table'
+        when:
+            - rhel9cis_3_4_3_2_nft_tables.stdout | length == 0
+            - not rhel9cis_nft_tables_autonewtable
+
+      - name: "3.4.3.2 | L1 | PATCH | Ensure a table exists | Create table if needed"
+        command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}"
+        failed_when: no
+        when: rhel9cis_nft_tables_autonewtable
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.2
+
+- name: "3.4.3.3 | L1 | PATCH | Ensure nftables base chains exist"
+  block:
+      - name: "3.4.3.3 | L1 | Ensure nftables base chains exist | Get current chains for INPUT"
+        shell: nft list ruleset | grep 'hook input'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_3_input_chains
+
+      - name: "3.4.3.3 | L1 | AUDIT | Ensure nftables base chains exist | Get current chains for FORWARD"
+        shell: nft list ruleset | grep 'hook forward'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_3_forward_chains
+
+      - name: "3.4.3.3 | L1 | AUDIT | Ensure nftables base chains exist | Get current chains for OUTPUT"
+        shell: nft list ruleset | grep 'hook output'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_3_output_chains
+
+      - name: "3.4.3.3 | L1 | AUDIT | Ensure nftables base chains exist | Display chains for review"
+        debug:
+            msg:
+                - "Below are the current INPUT chains"
+                - "{{ rhel9cis_3_4_3_3_input_chains.stdout_lines }}"
+                - "Below are the current FORWARD chains"
+                - "{{ rhel9cis_3_4_3_3_forward_chains.stdout_lines }}"
+                - "Below are teh current OUTPUT chains"
+                - "{{ rhel9cis_3_4_3_3_output_chains.stdout_lines }}"
+        when: not rhel9cis_nft_tables_autochaincreate
+
+      - name: "3.4.3.3 | L1 | PATCH | Ensure nftables base chains exist | Create chains if needed"
+        shell: "{{ item }}"
+        args:
+            warn: no
+        failed_when: no
+        with_items:
+            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
+            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { type filter hook forward priority 0 \; }
+            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" output { type filter hook output priority 0 \; }
+        when: rhel9cis_nft_tables_autochaincreate
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.3
+
+- name: "3.4.3.4 | L1 | PATCH | Ensure nftables loopback traffic is configured"
+  block:
+      - name: "3.4.3.4 | L1 | AUDIT | Ensure nftables loopback traffic is configured | Gather iif lo accept existence"
+        shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_4_iiflo
+
+      - name: "3.4.3.4 | L1 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip saddr existence"
+        shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_4_ipsaddr
+
+      - name: "3.4.3.4 | L1 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip6 saddr existence"
+        shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_4_ip6saddr
+
+      - name: "3.4.3.4 | L1 | PATCH | Ensure nftables loopback traffic is configured | Set iif lo accept rule"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept
+        when: '"iif \"lo\" accept" not in rhel9cis_3_4_3_4_iiflo.stdout'
+
+      - name: "3.4.3.4 | L1 | PATCH | Ensure nftables loopback traffic is configured | Set ip sddr rule"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop
+        when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_3_4_ipsaddr.stdout'
+
+      - name: "3.4.3.4 | L1 | PATCH | Ensure nftables loopback traffic is configured | Set ip6 saddr rule"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop
+        when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_3_4_ip6saddr.stdout'
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.4
+
+- name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured"
+  block:
+      - name: "3.4.3.5 | L1 | AUDIT | Ensure nftables outbound and established connections are configured | Gather incoming connection rules"
+        shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_5_inconnectionrule
+
+      - name: "3.4.3.5 | L1 | AUDIT | Ensure nftables outbound and established connections are configured | Gather outbound connection rules"
+        shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_3_5_outconnectionrule
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add input tcp established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
+        when: '"ip protocol tcp ct state established accept" not in rhel9cis_3_4_3_5_inconnectionrule.stdout'
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add input udp established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept
+        when: '"ip protocol udp ct state established accept" not in rhel9cis_3_4_3_5_inconnectionrule.stdout'
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add input icmp established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept
+        when: '"ip protocol icmp ct state established accept" not in rhel9cis_3_4_3_5_inconnectionrule.stdout'
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add output tcp new, related, established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept
+        when: '"ip protocol tcp ct state established,related,new accept" not in rhel9cis_3_4_3_5_outconnectionrule.stdout'
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add output udp new, related, established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept
+        when: '"ip protocol udp ct state established,related,new accept" not in rhel9cis_3_4_3_5_outconnectionrule.stdout'
+
+      - name: "3.4.3.5 | L1 | PATCH | Ensure nftables outbound and established connections are configured | Add output icmp new, related, established accept policy"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept
+        when: '"ip protocol icmp ct state established,related,new accept" not in rhel9cis_3_4_3_5_outconnectionrule.stdout'
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.5
+
+- name: "3.4.3.6 | L1 | PATCH | Ensure nftables default deny firewall policy"
+  block:
+      - name: "3.4.3.6 | L1 | AUDIT | Ensure nftables default deny firewall policy | Check for hook input deny policy"
+        shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input'
+        failed_when: false
+        changed_when: false
+        register: rhel9cis_3_4_3_6_inputpolicy
+
+      - name: "3.4.3.6 | L1 | AUDIT | Ensure nftables default deny firewall policy | Check for hook forward deny policy"
+        shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward'
+        failed_when: false
+        changed_when: false
+        register: rhel9cis_3_4_3_6_forwardpolicy
+
+      - name: "3.4.3.6 | L1 | AUDIT | Ensure nftables default deny firewall policy | Check for hook output deny policy"
+        shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output'
+        failed_when: false
+        changed_when: false
+        register: rhel9cis_3_4_3_6_outputpolicy
+
+      - name: "3.4.3.6 | L1 | AUDIT | Ensure nftables default deny firewall policy | Check for SSH allow"
+        shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh'
+        failed_when: false
+        changed_when: false
+        register: rhel9cis_3_4_3_6_sshallowcheck
+
+      - name: "3.4.3.6 | L1 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic"
+        command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept
+        when: '"tcp dport ssh accept" not in rhel9cis_3_4_3_6_sshallowcheck.stdout'
+
+      - name: "3.4.3.6 | L1 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy"
+        command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; }
+        when: '"type filter hook input priority 0; policy drop;" not in rhel9cis_3_4_3_6_inputpolicy.stdout'
+
+      - name: "3.4.3.6 | L1 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy"
+        command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; }
+        when: '"type filter hook forward priority 0; policy drop;" not in rhel9cis_3_4_3_6_forwardpolicy.stdout'
+
+      - name: "3.4.3.6 | L1 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy"
+        command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; }
+        when: '"type filter hook output priority 0; policy drop;" not in rhel9cis_3_4_3_6_outputpolicy.stdout'
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.6
+
+- name: "3.4.3.7 | L1 | PATCH | Ensure nftables service is enabled | Check if nftables is enabled"
+  service:
+      name: nftables
+      enabled: yes
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.7
+
+- name: "3.4.3.8 | L1 | PATCH | Ensure nftables rules are permanent"
+  lineinfile:
+      path: /etc/sysconfig/nftables.conf
+      state: present
+      insertafter: EOF
+      line: include "/etc/nftables/inet-{{ rhel9cis_nft_tables_tablename }}"
+  when:
+      - rhel9cis_firewall == "nftables"
+      - rhel9cis_rule_3_4_3_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.3.8

tasks/section_3/cis_3.4.4.1.x.yml

@@ -0,0 +1,144 @@
+---
+
+- name: "3.4.4.1.1 | L1 | PATCH | Ensure iptables default deny firewall policy"
+  block:
+      - name: "3.4.4.1.1 | L1 |  PATCH |  Ensure iptables default deny firewall policy | Configure ssh to be allowed"
+        iptables:
+            chain: INPUT
+            protocol: tcp
+            destination_port: "22"
+            jump: ACCEPT
+
+      - name: "3.4.4.1.1 | L1 | PATCH | Ensure iptables default deny firewall policy | Set drop items"
+        iptables:
+            policy: DROP
+            chain: "{{ item }}"
+        with_items:
+            - INPUT
+            - FORWARD
+            - OUTPUT
+  when:
+      - rhel9cis_rule_3_4_4_1_1
+      - rhel9cis_firewall == "iptables"
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.1.1
+
+- name: "3.4.4.1.2 | L1 | PATCH | Ensure iptables loopback traffic is configured"
+  block:
+      - name: "3.4.4.1.2 | L1 | Ensure iptables loopback traffic is configured | INPUT Loopback ACCEPT"
+        iptables:
+            action: append
+            chain: INPUT
+            in_interface: lo
+            jump: ACCEPT
+
+      - name: "3.4.4.1.2 | L1 | PATCH | Ensure iptables loopback traffic is configured | OUTPUT Loopback ACCEPT"
+        iptables:
+            action: append
+            chain: OUTPUT
+            out_interface: lo
+            jump: ACCEPT
+
+      - name: "3.4.4.1.2 | L1 | PATCH | Ensure iptables loopback traffic is configured | INPUT Loopback 127.0.0.0/8"
+        iptables:
+            action: append
+            chain: INPUT
+            source: 127.0.0.0/8
+            jump: DROP
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.1.2
+
+- name: "3.4.4.1.3 | L1 | PATCH | Ensure iptables outbound and established connections are configured"
+  iptables:
+      action: append
+      chain: '{{ item.chain }}'
+      protocol: '{{ item.protocol }}'
+      match: state
+      ctstate: '{{ item.ctstate }}'
+      jump: ACCEPT
+  with_items:
+      - { chain: OUTPUT, protocol: tcp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: OUTPUT, protocol: udp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: OUTPUT, protocol: icmp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: INPUT, protocol: tcp, ctstate: ESTABLISHED }
+      - { chain: INPUT, protocol: udp, ctstate: ESTABLISHED }
+      - { chain: INPUT, protocol: icmp, ctstate: ESTABLISHED }
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.1.3
+
+- name: "3.4.4.1.4 | L1 | PATCH | Ensure iptables firewall rules exist for all open ports"
+  block:
+      - name: "3.4.4.1.4 | L1 | AUDIT | Ensure iptables firewall rules exist for all open ports | Get list of TCP open ports"
+        shell: netstat -ant |grep "tcp.*LISTEN" | awk '{ print $4 }'| sed 's/.*://'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_4_1_4_otcp
+
+      - name: "3.4.4.1.4 | L1 | AUDIT | Ensure iptables firewall rules exist for all open ports | Get the list of udp open ports"
+        shell: netstat -ant |grep "udp.*LISTEN" | awk '{ print $4 }'| sed 's/.*://'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_4_1_4_oudp
+
+      - name: "3.4.4.1.4 | L1 | PATCH | Ensure iptables firewall rules exist for all open ports | Adjust open tcp ports"
+        iptables:
+            action: append
+            chain: INPUT
+            protocol: tcp
+            destination_port: "{{ item }}"
+            match: state
+            ctstate: NEW
+            jump: ACCEPT
+        with_items:
+            - "{{ rhel9cis_3_4_4_1_4_otcp.stdout_lines }}"
+        when: rhel9cis_3_4_4_1_4_otcp.stdout is defined
+
+      - name: "3.4.4.1.4 | L1 | PATCH | Ensure iptables firewall rules exist for all open ports | Adjust open udp ports"
+        iptables:
+            action: append
+            chain: INPUT
+            protocol: udp
+            destination_port: "{{ item }}"
+            match: state
+            ctstate: NEW
+            jump: ACCEPT
+        with_items:
+            - "{{ rhel9cis_3_4_4_1_4_oudp.stdout_lines }}"
+        when: rhel9cis_3_4_4_1_4_otcp.stdout is defined
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.1.4
+
+- name: "3.4.4.1.5 | L1 | PATCH | Ensure iptables service is enabled and active | Check if iptables is enabled"
+  service:
+      name: iptables
+      enabled: yes
+      state: started
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.1.5

tasks/section_3/cis_3.4.4.2.x.yml

@@ -0,0 +1,136 @@
+---
+
+- name: "3.4.4.2.1 | L1 | PATCH | Ensure ip6tables default deny firewall policy"
+  block:
+      - name: "3.4.4.2.1 | L1 | Ensure ip6tables default deny firewall policy | Configure ssh to be allowed"
+        iptables:
+            chain: INPUT
+            protocol: tcp
+            destination_port: "22"
+            jump: ACCEPT
+            ip_version: ipv6
+
+      - name: "3.4.4.2.1 | L1 | PATCH | Ensure ip6tables default deny firewall policy | Set drop items"
+        iptables:
+            policy: DROP
+            chain: "{{ item }}"
+            ip_version: ipv6
+        with_items:
+            - INPUT
+            - FORWARD
+            - OUTPUT
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_2_1
+      - rhel9cis_ipv6_required
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.2.1
+
+- name: "3.4.4.2.2 | L1 | PATCH |  Ensure ip6tables loopback traffic is configured"
+  block:
+      - name: "3.4.4.2.2 | L1 | PATCH | Ensure ip6tables loopback traffic is configured | INPUT Loopback ACCEPT"
+        iptables:
+            action: append
+            chain: INPUT
+            in_interface: lo
+            jump: ACCEPT
+            ip_version: ipv6
+
+      - name: "3.4.4.2.2 | L1 | PATCH | Ensure ip6tables loopback traffic is configured | OUTPUT Loopback ACCEPT"
+        iptables:
+            action: append
+            chain: OUTPUT
+            out_interface: lo
+            jump: ACCEPT
+            ip_version: ipv6
+
+      - name: "3.4.4.2.2 | L1 | PATCH | Ensure ip6tables loopback traffic is configured | INPUT Loopback 127.0.0.0/8"
+        iptables:
+            action: append
+            chain: INPUT
+            source: ::1
+            jump: DROP
+            ip_version: ipv6
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_2_2
+      - rhel9cis_ipv6_required
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.2.2
+
+- name: "3.4.4.2.3 | L1 | PATCH | Ensure ip6tables outbound and established connections are configured"
+  iptables:
+      action: append
+      chain: '{{ item.chain }}'
+      protocol: '{{ item.protocol }}'
+      match: state
+      ctstate: '{{ item.ctstate }}'
+      jump: ACCEPT
+      ip_version: ipv6
+  with_items:
+      - { chain: OUTPUT, protocol: tcp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: OUTPUT, protocol: udp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: OUTPUT, protocol: icmp, ctstate: 'NEW,ESTABLISHED' }
+      - { chain: INPUT, protocol: tcp, ctstate: ESTABLISHED }
+      - { chain: INPUT, protocol: udp, ctstate: ESTABLISHED }
+      - { chain: INPUT, protocol: icmp, ctstate: ESTABLISHED }
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_2_3
+      - rhel9cis_ipv6_required
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.2.3
+
+- name: "3.4.4.2.4 | L1 | PATCH | Ensure ip6tables firewall rules exist for all open ports"
+  block:
+      - name: "3.4.4.2.4 | L1 | AUDIT | Ensure ip6tables firewall rules exist for all open ports | Get list of TCP6 open ports"
+        shell: netstat -ant |grep "tcp6.*LISTEN" | awk '{ print $4 }'| sed 's/.*://'
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_3_4_4_2_4_otcp
+
+      - name: "3.4.4.2.4 | L1 | PATCH |Ensure ip6tables firewall rules exist for all open ports| Adjust open tcp6 ports"
+        iptables:
+            action: append
+            chain: INPUT
+            protocol: tcp
+            destination_port: "{{ item }}"
+            match: state
+            ctstate: NEW
+            jump: ACCEPT
+            ip_version: ipv6
+        with_items:
+            - "{{ rhel9cis_3_4_4_2_4_otcp.stdout_lines }}"
+        when: rhel9cis_3_4_4_2_4_otcp.stdout is defined
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_2_4
+      - rhel9cis_ipv6_required
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.2.4
+
+- name: "3.4.4.2.5 | L1 | PATCH | Ensure ip6tables service is enabled and active | Check if ip6tables is enabled"
+  service:
+      name: ip6tables
+      enabled: yes
+      state: started
+  when:
+      - rhel9cis_firewall == "iptables"
+      - rhel9cis_rule_3_4_4_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_3.4.4.2.5

tasks/section_3/cis_3.5.yml

@@ -0,0 +1,32 @@
+---
+
+- name: "3.5 | L1 | PATCH | Ensure wireless interfaces are disabled"
+  block:
+      - name: "3.5 | L1 | AUDIT |  Ensure wireless interfaces are disabled | Check if nmcli command is available"
+        command: rpm -q NetworkManager
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        args:
+            warn: no
+        register: rhel_09_nmcli_available
+
+      - name: "3.5 | L1 | AUDIT | Ensure wireless interfaces are disabled | Check if wifi is enabled"
+        command: nmcli radio wifi
+        register: rhel_09_wifi_enabled
+        changed_when: rhel_09_wifi_enabled.stdout != "disabled"
+        failed_when: false
+        when: rhel_09_nmcli_available.rc == 0
+
+      - name: "3.5 | L1 | PATCH | Ensure wireless interfaces are disabled | Disable wifi if enabled"
+        command: nmcli radio all off
+        changed_when: false
+        failed_when: false
+        when: rhel_09_wifi_enabled is changed
+  when:
+      - rhel9cis_rule_3_5
+  tags:
+      - level1-server
+      - level2-workstation
+      - patch
+      - rule_3.5

tasks/section_3/cis_3.6.yml

@@ -0,0 +1,17 @@
+---
+
+- name: "3.6 | L2 | PATCH | Disable IPv6"
+  replace:
+      dest: /etc/default/grub
+      regexp: '(^GRUB_CMDLINE_LINUX\s*\=\s*)(?:")(.+)(?<!ipv6.disable=1)(?:")'
+      replace: '\1"\2 ipv6.disable=1"'
+      follow: yes
+  notify: grub2cfg
+  when:
+      - not rhel9cis_ipv6_required
+      - rhel9cis_rule_3_6
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_3.6

tasks/section_3/main.yml

@@ -0,0 +1,41 @@
+---
+
+- name: "SECTION | 3.1.x | Packet and IP redirection"
+  include: cis_3.1.x.yml
+
+- name: "SECTION | 3.2.x | Network Parameters (Host Only)"
+  include: cis_3.2.x.yml
+
+- name: "SECTION | 3.3.x | Uncommon Network Protocols"
+  include: cis_3.3.x.yml
+
+- name: "SECTION | 3.4.1.x | firewall defined"
+  include: cis_3.4.1.1.yml
+
+- name: "SECTION | 3.4.2.x | firewalld firewall"
+  include: cis_3.4.2.x.yml
+  when:
+  - rhel9cis_firewall == "firewalld"
+
+- name: "SECTION | 3.4.3.x | Configure nftables firewall"
+  include: cis_3.4.3.x.yml
+  when:
+  - rhel9cis_firewall == "nftables"
+
+- name: "SECTION | 3.4.4.1.x | Configure iptables IPv4"
+  include: cis_3.4.4.1.x.yml
+  when:
+  - rhel9cis_firewall == "iptables"
+
+- name: "SECTION | 3.4.4.2.x | Configure iptables IPv6"
+  include: cis_3.4.4.2.x.yml
+  when:
+  - ( rhel9cis_firewall == "iptables" and rhel9cis_ipv6_required )
+
+- name: "SECTION | 3.5 | Configure wireless"
+  include: cis_3.5.yml
+
+- name: "SECTION | 3.5 | disable IPv6"
+  include: cis_3.5.yml
+  when:
+  - not rhel9cis_ipv6_required

tasks/section_4/cis_4.1.1.x.yml

@@ -0,0 +1,103 @@
+---
+
+- name: "4.1.1.1 | L2 | PATCH | Ensure auditd is installed"
+  block:
+      - name: "4.1.1.1 | L2 | PATCH | Ensure auditd is installed | Install auditd packages"
+        package:
+            name: audit
+            state: present
+        when: '"auditd" not in ansible_facts.packages'
+
+      - name: "4.1.1.1 | L2 | PATCH | Ensure auditd is installed | Install auditd-lib packages"
+        package:
+            name: audit-libs
+            state: present
+        when: '"auditd-lib" not in ansible_facts.packages'
+  when:
+      - rhel9cis_rule_4_1_1_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_4.1.1.1
+
+- name: "4.1.1.2 | L2 | PATCH | Ensure auditd service is enabled"
+  service:
+      name: auditd
+      state: started
+      enabled: yes
+  when:
+      - not rhel9cis_skip_for_travis
+      - rhel9cis_rule_4_1_1_2
+      - ansible_connection != 'docker'
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.1.2
+
+- name: "4.1.1.3 | L2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled"
+  block:
+      - name: "4.1.1.3 | L2 | AUDIT | Ensure auditing for processes that start prior to auditd is enabled | Get GRUB_CMDLINE_LINUX"
+        shell: grep 'GRUB_CMDLINE_LINUX=' /etc/default/grub | sed 's/.$//'
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_4_1_1_3_grub_cmdline_linux
+
+      - name: "4.1.1.3 | L2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Replace existing setting"
+        replace:
+            dest: /etc/default/grub
+            regexp: 'audit=.'
+            replace: 'audit=1'
+        notify: grub2cfg
+        when: "'audit=' in rhel9cis_4_1_1_3_grub_cmdline_linux.stdout"
+
+      - name: "4.1.1.3 | L2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Add audit setting if missing"
+        lineinfile:
+            path: /etc/default/grub
+            regexp: '^GRUB_CMDLINE_LINUX='
+            line: '{{ rhel9cis_4_1_1_3_grub_cmdline_linux.stdout }} audit=1"'
+        notify: grub2cfg
+        when: "'audit=' not in rhel9cis_4_1_1_3_grub_cmdline_linux.stdout"
+  when:
+      - rhel9cis_rule_4_1_1_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.1.3
+
+- name: "4.1.1.4 | L2 | PATCH | Ensure audit_backlog_limit is sufficient"
+  block:
+      - name: "4.1.1.4 | L2 | AUDIT | Ensure audit_backlog_limit is sufficient | Get GRUB_CMDLINE_LINUX"
+        shell: grep 'GRUB_CMDLINE_LINUX=' /etc/default/grub | sed 's/.$//'
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_4_1_1_4_grub_cmdline_linux
+
+      - name: "4.1.1.4 | L2 | PATCH | Ensure audit_backlog_limit is sufficient | Replace existing setting"
+        replace:
+            dest: /etc/default/grub
+            regexp: 'audit_backlog_limit=\d+'
+            replace: 'audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}'
+        notify: grub2cfg
+        when: "'audit_backlog_limit=' in rhel9cis_4_1_1_4_grub_cmdline_linux.stdout"
+
+      - name: "4.1.1.4 | L2 | PATCH | Ensure audit_backlog_limit is sufficient | Add audit_backlog_limit setting if missing"
+        lineinfile:
+            path: /etc/default/grub
+            regexp: '^GRUB_CMDLINE_LINUX='
+            line: '{{ rhel9cis_4_1_1_4_grub_cmdline_linux.stdout }} audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'
+        notify: grub2cfg
+        when: "'audit_backlog_limit=' not in rhel9cis_4_1_1_4_grub_cmdline_linux.stdout"
+  when:
+      - rhel9cis_rule_4_1_1_4
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_4.1.1.4

tasks/section_4/cis_4.1.2.x.yml

@@ -0,0 +1,53 @@
+---
+
+- name: "4.1.2.1 | L2 | PATCH | Ensure audit log storage size is configured"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "^max_log_file( |=)"
+      line: "max_log_file = {{ rhel9cis_max_log_file_size }}"
+      state: present
+  notify: restart auditd
+  when:
+      - rhel9cis_rule_4_1_2_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.1
+
+- name: "4.1.2.2 | L2 | PATCH | Ensure audit logs are not automatically deleted"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "^max_log_file_action"
+      line: "max_log_file_action = {{ rhel9cis_auditd['max_log_file_action'] }}"
+      state: present
+  notify: restart auditd
+  when:
+      - rhel9cis_rule_4_1_2_2
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.2
+
+- name: "4.1.2.3 | L2 | PATCH | Ensure system is disabled when audit logs are full"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+      state: present
+  notify: restart auditd
+  with_items:
+      - { regexp: '^admin_space_left_action', line: 'admin_space_left_action = {{ rhel9cis_auditd.admin_space_left_action }}' }
+      - { regexp: '^action_mail_acct', line: 'action_mail_acct = {{ rhel9cis_auditd.action_mail_acct }}' }
+      - { regexp: '^space_left_action', line: 'space_left_action = {{ rhel9cis_auditd.space_left_action }}' }
+  when:
+      - rhel9cis_rule_4_1_2_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.3

tasks/section_4/cis_4.1.x.yml

@@ -0,0 +1,205 @@
+---
+
+- name: "4.1.3 | L2 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.3
+
+- name: "4.1.4 | L2 | PATCH | Ensure login and logout events are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_4
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.4
+
+- name: "4.1.5 | L2 | PATCH | Ensure session initiation information is collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_5
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.5
+
+- name: "4.1.6 | L2 | PATCH | Ensure events that modify date and time information are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_6
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.6
+
+- name: "4.1.7 | L2 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_7
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.7
+
+- name: "4.1.8 | L2 | PATCH | Ensure events that modify the system's network environment are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_8
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.8
+
+- name: "4.1.9 | L2 | PATCH | Ensure discretionary access control permission modification events are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_9
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.9
+
+- name: "4.1.10 | L2 | PATCH | Ensure unsuccessful unauthorized file access attempts are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_10
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.10
+
+- name: "4.1.11 | L2 | PATCH | Ensure events that modify user/group information are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_11
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.11
+
+- name: "4.1.12 | L2 | PATCH | Ensure successful file system mounts are collected"
+  block:
+      - name: "4.1.12 | L2 | AUDIT | Ensure successful file system mounts are collected"
+        shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: priv_procs
+
+      - name: "4.1.12 | L2 | PATCH | Ensure successful file system mounts are collected"
+        debug:
+          msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+        notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_12
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.12
+
+- name: "4.1.13 | L2 | PATCH | Ensure use of privileged commands is collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_13
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.13
+
+- name: "4.1.14 | L2 | PATCH | Ensure file deletion events by users are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_14
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.14
+
+- name: "4.1.15 | L2 | PATCH | Ensure kernel module loading and unloading is collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_15
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.15
+
+- name: "4.1.16 | L2 | PATCH | Ensure system administrator actions (sudolog) are collected"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_16
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.16
+
+- name: "4.1.17 | L2 | PATCH | Ensure the audit configuration is immutable"
+  debug:
+    msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
+  notify: update auditd
+  when:
+      - rhel9cis_rule_4_1_17
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.17

tasks/section_4/cis_4.2.1.x.yml

@@ -0,0 +1,177 @@
+---
+
+- name: "4.2.1.1 | L1 | PATCH | Ensure rsyslog installed"
+  package:
+      name: rsyslog
+      state: present
+  when:
+      - "'rsyslog' not in ansible_facts.packages"
+      - rhel9cis_rule_4_2_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.1.1
+
+- name: "4.2.1.2 | L1 | PATCH | Ensure rsyslog Service is enabled"
+  service:
+      name: rsyslog
+      enabled: yes
+  when:
+      - rhel9cis_rule_4_2_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rsyslog
+      - rule_4.2.1.2
+
+- name: "4.2.1.3 | L1 | PATCH | Ensure rsyslog default file permissions configured"
+  lineinfile:
+      dest: /etc/rsyslog.conf
+      regexp: '^\$FileCreateMode'
+      line: '$FileCreateMode 0640'
+  notify: restart rsyslog
+  when:
+      - rhel9cis_rule_4_2_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.1.3
+
+- name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured"
+  block:
+      - name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
+        command: cat /etc/rsyslog.conf
+        become: yes
+        changed_when: false
+        failed_when: no
+        check_mode: no
+        register: rhel_09_4_2_1_4_audit
+
+      - name: "4.2.1.4 | L1 | AUDIT | Ensure logging is configured | rsyslog current config message out"
+        debug:
+            msg:
+                - "These are the current logging configurations for rsyslog, please review:"
+                - "{{ rhel_09_4_2_1_4_audit.stdout_lines }}"
+
+      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | mail.* log setting"
+        blockinfile:
+            path: /etc/rsyslog.conf
+            state: present
+            marker: "# {mark} MAIL LOG SETTINGS (ANSIBLE MANAGED)"
+            block: |
+              # mail logging additions to meet CIS standards
+              mail.*                                                  -/var/log/mail
+              mail.info                                               -/var/log/mail.info
+              mail.warning                                            -/var/log/mail.warning
+              mail.err                                                /var/log/mail.err
+            insertafter: '# Log all the mail messages in one place.'
+        notify: restart rsyslog
+        when: rhel9cis_rsyslog_ansiblemanaged
+
+      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | news.crit log setting"
+        blockinfile:
+            path: /etc/rsyslog.conf
+            state: present
+            marker: "# {mark} NEWS LOG SETTINGS (ANSIBLE MANAGED)"
+            block: |
+              # news logging additions to meet CIS standards
+              news.crit                                               -/var/log/news/news.crit
+              news.notice                                             -/var/log/news/news.crit
+            insertafter: '# Save news errors of level crit and higher in a special file.'
+        notify: restart rsyslog
+        when: rhel9cis_rsyslog_ansiblemanaged
+
+      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Misc. log setting"
+        blockinfile:
+            path: /etc/rsyslog.conf
+            state: present
+            marker: "# {mark} MISC. LOG SETTINGS (ANSIBLE MANAGED)"
+            block: |
+              # misc. logging additions to meet CIS standards
+              *.=warning;*.=err                                        -/var/log/warn
+              *.crit                                                   /var/log/warn
+              *.*;mail.none;news.none                                  /var/log/messages
+            insertafter: '#### RULES ####'
+        notify: restart rsyslog
+        when: rhel9cis_rsyslog_ansiblemanaged
+
+      - name: "4.2.1.4 | L1 | PATCH | Ensure logging is configured | Local log settings"
+        blockinfile:
+            path: /etc/rsyslog.conf
+            state: present
+            marker: "#{mark} LOCAL LOG SETTINGS (ANSIBLE MANAGED)"
+            block: |
+              # local log settings
+              local0,local1.*                                          -/var/log/localmessages
+              local2,local3.*                                          -/var/log/localmessages
+              local4,local5.*                                          -/var/log/localmessages
+              local6,local7.*                                          -/var/log/localmessages
+              *.emrg                                                    :omusrmsg:*
+            insertafter: '#### RULES ####'
+        notify: restart rsyslog
+  when:
+      - rhel9cis_rule_4_2_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rsyslog
+      - rule_4.2.1.4
+
+- name: "4.2.1.5 | L1 | PATCH | Ensure rsyslog is configured to send logs to a remote log host"
+  blockinfile:
+      path: /etc/rsyslog.conf
+      state: present
+      block: |
+        # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
+        *.* @@{{ rhel9cis_remote_log_server }}
+      insertafter: EOF
+  register: result
+  failed_when:
+      - result is failed
+      - result.rc != 257
+  notify: restart rsyslog
+  when:
+      - rhel9cis_rule_4_2_1_5
+      - rhel9cis_remote_log_server is defined
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.1.5
+      - rsyslog
+
+- name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts."
+  block:
+      - name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When not log host"
+        replace:
+            path: /etc/rsyslog.conf
+            regexp: '({{ item }})'
+            replace: '#\1'
+        notify: restart rsyslog
+        with_items:
+            - '^(\$ModLoad imtcp)'
+            - '^(\$InputTCPServerRun)'
+        when: not rhel9cis_system_is_log_server
+
+      - name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When log host"
+        replace:
+            path: /etc/rsyslog.conf
+            regexp: '^#(.*{{ item }}.*)'
+            replace: '\1'
+        notify: restart rsyslog
+        with_items:
+            - 'ModLoad imtcp'
+            - 'InputTCPServerRun'
+        when: rhel9cis_system_is_log_server
+  when:
+      - rhel9cis_rule_4_2_1_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.1.6
+      - rsyslog

tasks/section_4/cis_4.2.2.x.yml

@@ -0,0 +1,43 @@
+---
+
+- name: "4.2.2.1 | L1 | PATCH | Ensure journald is configured to send logs to rsyslog"
+  lineinfile:
+      dest: /etc/systemd/journald.conf
+      regexp: "^#ForwardToSyslog=|^ForwardToSyslog="
+      line: ForwardToSyslog=yes
+      state: present
+  when:
+      - rhel9cis_rule_4_2_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.2.1
+
+- name: "4.2.2.2 | L1 | PATCH | Ensure journald is configured to compress large log files"
+  lineinfile:
+      dest: /etc/systemd/journald.conf
+      regexp: "^#Compress=|^Compress="
+      line: Compress=yes
+      state: present
+  when:
+      - rhel9cis_rule_4_2_2_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.2.2
+
+- name: "4.2.2.3 | L1 | PATCH | Ensure journald is configured to write logfiles to persistent disk"
+  lineinfile:
+      dest: /etc/systemd/journald.conf
+      regexp: "^#Storage=|^Storage="
+      line: Storage=persistent
+      state: present
+  when:
+      - rhel9cis_rule_4_2_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.2.3

tasks/section_4/cis_4.2.3.yml

@@ -0,0 +1,13 @@
+---
+
+- name: "4.2.3 | L1 | PATCH | Ensure permissions on all logfiles are configured"
+  command: find /var/log -type f -exec chmod g-wx,o-rwx "{}" +
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_4_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.2.3

tasks/section_4/cis_4.3.yml

@@ -0,0 +1,24 @@
+---
+
+- name: "4.3 | L1 | PATCH | Ensure logrotate is configured"
+  block:
+      - name: "4.3 | L1 | AUDIT | Ensure logrotate is configured | Get logrotate settings"
+        find:
+            paths: /etc/logrotate.d/
+        register: log_rotates
+
+      - name: "4.3 | L1 | PATCH | Ensure logrotate is configured"
+        replace:
+            path: "{{ item.path }}"
+            regexp: '^(\s*)(daily|weekly|monthly|yearly)$'
+            replace: "\\1{{ rhel9cis_logrotate }}"
+        with_items:
+            - "{{ log_rotates.files }}"
+            - { path: "/etc/logrotate.conf" }
+  when:
+      - rhel9cis_rule_4_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_4.3

tasks/section_4/main.yml

@@ -0,0 +1,23 @@
+---
+
+- name: "SECTION | 4.1| Configure System Accounting (auditd)"
+  include: cis_4.1.1.x.yml
+
+- name: "SECTION | 4.1.2.x| Configure Data Retention"
+  include: cis_4.1.2.x.yml
+
+- name: "SECTION | 4.1.x| Auditd rules"
+  include: cis_4.1.x.yml
+
+- name: "SECTION | 4.2.x| Configure Logging"
+  include: cis_4.2.1.x.yml
+  when: rhel9cis_syslog == 'rsyslog'
+
+- name: "SECTION | 4.2.2.x| Configure journald"
+  include: cis_4.2.2.x.yml
+
+- name: "SECTION | 4.2.3 | Configure logile perms"
+  include: cis_4.2.3.yml
+
+- name: "SECTION | 4.3 | Configure logrotate"
+  include: cis_4.3.yml

tasks/section_5/cis_5.1.x.yml

@@ -0,0 +1,147 @@
+---
+
+- name: "5.1.1 | L1 | PATCH | Ensure cron daemon is enabled"
+  service:
+      name: crond
+      enabled: yes
+  when:
+      - rhel9cis_rule_5_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.1
+
+- name: "5.1.2 | L1 | PATCH | Ensure permissions on /etc/crontab are configured"
+  file:
+      dest: /etc/crontab
+      owner: root
+      group: root
+      mode: 0600
+  when:
+      - rhel9cis_rule_5_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.2
+
+- name: "5.1.3 | L1 | PATCH | Ensure permissions on /etc/cron.hourly are configured"
+  file:
+      dest: /etc/cron.hourly
+      state: directory
+      owner: root
+      group: root
+      mode: 0700
+  when:
+      - rhel9cis_rule_5_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.3
+
+- name: "5.1.4 | L1 | PATCH | Ensure permissions on /etc/cron.daily are configured"
+  file:
+      dest: /etc/cron.daily
+      state: directory
+      owner: root
+      group: root
+      mode: 0700
+  when:
+      - rhel9cis_rule_5_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.4
+
+- name: "5.1.5 | L1 | PATCH | Ensure permissions on /etc/cron.weekly are configured"
+  file:
+      dest: /etc/cron.weekly
+      state: directory
+      owner: root
+      group: root
+      mode: 0700
+  when:
+      - rhel9cis_rule_5_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.5
+
+- name: "5.1.6 | L1 | PATCH | Ensure permissions on /etc/cron.monthly are configured"
+  file:
+      dest: /etc/cron.monthly
+      state: directory
+      owner: root
+      group: root
+      mode: 0700
+  when:
+      - rhel9cis_rule_5_1_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.6
+
+- name: "5.1.7 | L1 | PATCH | Ensure permissions on /etc/cron.d are configured"
+  file:
+      dest: /etc/cron.d
+      state: directory
+      owner: root
+      group: root
+      mode: 0700
+  when:
+      - rhel9cis_rule_5_1_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.7
+
+- name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users"
+  block:
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Remove at.deny"
+        file:
+            dest: /etc/at.deny
+            state: absent
+
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Check if at.allow exists"
+        stat:
+            path: "/etc/at.allow"
+        register: p
+
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Ensure at.allow is restricted to authorized users"
+        file:
+            dest: /etc/at.allow
+            state: '{{ "file" if  p.stat.exists else "touch" }}'
+            owner: root
+            group: root
+            mode: 0600
+
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Remove cron.deny"
+        file:
+            dest: /etc/cron.deny
+            state: absent
+
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Check if cron.allow exists"
+        stat:
+            path: "/etc/cron.allow"
+        register: p
+
+      - name: "5.1.8 | L1 | PATCH | Ensure at/cron is restricted to authorized users | Ensure cron.allow is restricted to authorized users"
+        file:
+            dest: /etc/cron.allow
+            state: '{{ "file" if  p.stat.exists else "touch" }}'
+            owner: root
+            group: root
+            mode: 0600
+  when:
+      - rhel9cis_rule_5_1_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.1.8

tasks/section_5/cis_5.2.x.yml

@@ -0,0 +1,345 @@
+---
+
+- name: "5.2.1 | L1 | PATCH | Ensure permissions on /etc/ssh/sshd_config are configured"
+  file:
+      dest: /etc/ssh/sshd_config
+      state: file
+      owner: root
+      group: root
+      mode: 0600
+  when:
+      - rhel9cis_rule_5_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.1
+
+- name: "5.2.2 | L1 | PATCH | Ensure SSH access is limited"
+  block:
+      - name: "5.2.2 | L1 | PATCH | Ensure SSH access is limited | Add line to sshd_config for allowusers"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: "^AllowUsers"
+            line: AllowUsers {{ rhel9cis_sshd['allowusers'] }}
+        notify: restart sshd
+        when: "rhel9cis_sshd['allowusers']|default('') | length > 0"
+
+      - name: "5.2.2 | L1 | PATCH | Ensure SSH access is limited | Add line to sshd_config for allowgroups"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: "^AllowGroups"
+            line: AllowGroups {{ rhel9cis_sshd['allowgroups'] }}
+        notify: restart sshd
+        when: "rhel9cis_sshd['allowgroups']|default('') | length > 0"
+
+      - name: "5.2.2 | L1 | PATCH | Ensure SSH access is limited | Add line to sshd_config for denyusers"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: "^DenyUsers"
+            line: DenyUsers {{ rhel9cis_sshd['denyusers'] }}
+        notify: restart sshd
+        when: "rhel9cis_sshd['denyusers']|default('') | length > 0"
+
+      - name: "5.2.2 | L1 | PATCH | Ensure SSH access is limited | Add line to sshd_config for denygroups"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: "^DenyGroups"
+            line: DenyGroups {{ rhel9cis_sshd['denygroups'] }}
+        notify: restart sshd
+        when: "rhel9cis_sshd['denygroups']|default('') | length > 0"
+  when:
+      - rhel9cis_rule_5_2_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.2
+
+- name: "5.2.3 | L1 | PATCH | Ensure permissions on SSH private host key files are configured"
+  block:
+      - name: "5.2.3 | L1 | AUDIT | Ensure permissions on SSH private host key files are configured | Find the SSH private host keys"
+        find:
+            paths: /etc/ssh
+            patterns: 'ssh_host_*_key'
+            recurse: true
+            file_type: any
+        register: rhel9cis_5_2_3_ssh_private_host_key
+
+      - name: "5.2.3 | L1 | PATCH | Ensure permissions on SSH private host key files are configured | Set permissions on SSH private host keys"
+        file:
+            path: "{{ item.path }}"
+            owner: root
+            group: root
+            mode: 0600
+        with_items:
+            - "{{ rhel9cis_5_2_3_ssh_private_host_key.files }}"
+  when:
+      - rhel9cis_rule_5_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.3
+
+- name: "5.2.4 | L1 | PATCH | Ensure permissions on SSH public host key files are configured"
+  block:
+      - name: "5.2.4 | L1 | AUDIT | Ensure permissions on SSH public host key files are configured | Find the SSH public host keys"
+        find:
+            paths: /etc/ssh
+            patterns: 'ssh_host_*_key.pub'
+            recurse: true
+            file_type: any
+        register: rhel9cis_5_2_4_ssh_public_host_key
+
+      - name: "5.2.4 | L1 | PATCH | Ensure permissions on SSH public host key files are configured | Set permissions on SSH public host keys"
+        file:
+            path: "{{ item.path }}"
+            owner: root
+            group: root
+            mode: 0644
+        with_items:
+            - "{{ rhel9cis_5_2_4_ssh_public_host_key.files }}"
+  when:
+      - rhel9cis_rule_5_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.4
+
+- name: "5.2.5 | L1 | PATCH | Ensure SSH LogLevel is appropriate"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#LogLevel|^LogLevel"
+      line: 'LogLevel {{ rhel9cis_ssh_loglevel }}'
+  when:
+      - rhel9cis_rule_5_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.5
+
+- name: "5.2.6 | L2 | PATCH | Ensure SSH X11 forwarding is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#X11Forwarding|^X11Forwarding"
+      line: 'X11Forwarding no'
+  when:
+      - rhel9cis_rule_5_2_6
+  tags:
+      - level2-server
+      - level1-workstation
+      - patch
+      - rule_5.2.6
+
+- name: "5.2.7 | L1 | PATCH | Ensure SSH MaxAuthTries is set to 4 or less"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: '^(#)?MaxAuthTries \d'
+      line: 'MaxAuthTries 4'
+  when:
+      - rhel9cis_rule_5_2_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.7
+
+- name: "5.2.8 | L1 | PATCH | Ensure SSH IgnoreRhosts is enabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#IgnoreRhosts|^IgnoreRhosts"
+      line: 'IgnoreRhosts yes'
+  when:
+      - rhel9cis_rule_5_2_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.8
+
+- name: "5.2.9 | L1 | PATCH | Ensure SSH HostbasedAuthentication is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: ^#HostbasedAuthentication|^HostbasedAuthentication"
+      line: 'HostbasedAuthentication no'
+  when:
+      - rhel9cis_rule_5_2_9
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.9
+
+- name: "5.2.10 | L1 | PATCH | Ensure SSH root login is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#PermitRootLogin|^PermitRootLogin"
+      line: 'PermitRootLogin no'
+  when:
+      - rhel9cis_rule_5_2_10
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.10
+
+- name: "5.2.11 | L1 | PATCH | Ensure SSH PermitEmptyPasswords is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#PermitEmptyPasswords|^PermitEmptyPasswords"
+      line: 'PermitEmptyPasswords no'
+  when:
+      - rhel9cis_rule_5_2_11
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.11
+
+- name: "5.2.12 | L1 | PATCH | Ensure SSH PermitUserEnvironment is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#PermitUserEnvironment|^PermitUserEnvironment"
+      line: 'PermitUserEnvironment no'
+  when:
+      - rhel9cis_rule_5_2_12
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.12
+
+- name: "5.2.13 | L1 | PATCH | Ensure SSH Idle Timeout Interval is configured"
+  block:
+      - name: "5.2.13 | L1 | PATCH | Ensure SSH Idle Timeout Interval is configured | Add line in sshd_config for ClientAliveInterval"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: '^ClientAliveInterval'
+            line: "ClientAliveInterval {{ rhel9cis_sshd['clientaliveinterval'] }}"
+
+      - name: "5.2.13 | L1 | PATCH | Ensure SSH Idle Timeout Interval is configured | Ensure SSH ClientAliveCountMax set to <= 3"
+        lineinfile:
+            state: present
+            dest: /etc/ssh/sshd_config
+            regexp: '^ClientAliveCountMax'
+            line: "ClientAliveCountMax {{ rhel9cis_sshd['clientalivecountmax'] }}"
+  when:
+      - rhel9cis_rule_5_2_13
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.13
+
+- name: "5.2.14 | L1 | PATCH | Ensure SSH LoginGraceTime is set to one minute or less"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#LoginGraceTime|^LoginGraceTime"
+      line: "LoginGraceTime {{ rhel9cis_sshd['logingracetime'] }}"
+  when:
+      - rhel9cis_rule_5_2_14
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.14
+
+- name: "5.2.15 | L1 | PATCH | Ensure SSH warning banner is configured"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: '^Banner'
+      line: 'Banner /etc/issue.net'
+  when:
+      - rhel9cis_rule_5_2_15
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.15
+
+- name: "5.2.16 | L1 | PATCH | Ensure SSH PAM is enabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#UsePAM|^UsePAM"
+      line: 'UsePAM yes'
+  when:
+      - rhel9cis_rule_5_2_16
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.16
+
+- name: "5.2.17 | L2 | PATCH | Ensure SSH AllowTcpForwarding is disabled"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#AllowTcpForwarding|^AllowTcpForwarding"
+      line: 'AllowTcpForwarding no'
+  when:
+      - rhel9cis_rule_5_2_17
+  tags:
+      - level2-server
+      - level2-workstation
+      - patch
+      - rule_5.2.17
+
+- name: "5.2.18 | L1 | PATCH | Ensure SSH MaxStartups is configured"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#MaxStartups|^MaxStartups"
+      line: 'MaxStartups 10:30:60'
+  when:
+      - rhel9cis_rule_5_2_18
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.18
+
+- name: "5.2.19 | L1 | PATCH | Ensure SSH MaxSessions is set to 4 or less"
+  lineinfile:
+      state: present
+      dest: /etc/ssh/sshd_config
+      regexp: "^#MaxSessions|^MaxSessions"
+      line: 'MaxSessions {{ rhel9cis_ssh_maxsessions }}'
+  when:
+      - rhel9cis_rule_5_2_19
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.19
+
+- name: "5.2.20 | L1 | PATCH | Ensure system-wide crypto policy is not over-ridden"
+  shell: sed -ri "s/^\s*(CRYPTO_POLICY\s*=.*)$/# \1/" /etc/sysconfig/sshd
+  args:
+      warn: no
+  notify: restart sshd
+  when:
+      - rhel9cis_rule_5_2_20
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.2.20

tasks/section_5/cis_5.3.x.yml

@@ -0,0 +1,90 @@
+---
+
+- name: "5.3.1 | L1 | PATCH | Create custom authselect profile"
+  block:
+      - name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Gather profiles"
+        shell: 'authselect current | grep "Profile ID: custom/"'
+        failed_when: false
+        changed_when: false
+        check_mode: no
+        register: rhel9cis_5_3_1_profiles
+
+      - name: "5.3.1 | L1 | AUDIT | Create custom authselect profile | Show profiles"
+        debug:
+            msg:
+                - "Below are the current custom profiles"
+                - "{{ rhel9cis_5_3_1_profiles.stdout_lines }}"
+
+      - name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Create custom profiles"
+        shell: authselect create-profile {{ rhel9cis_authselect['custom_profile_name'] }} -b {{ rhel9cis_authselect['default_file_to_copy'] }}
+        args:
+            warn: no
+        when: rhel9cis_authselect_custom_profile_create
+  when:
+      - rhel9cis_rule_5_3_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - authselect
+      - rule_5.3.1
+
+- name: "5.3.2 | L1 | PATCH | Select authselect profile"
+  block:
+      - name: "5.3.2 | L1 | AUDIT | Select authselect profile | Gather profiles and enabled features"
+        shell: "authselect current"
+        args:
+            warn: no
+        failed_when: false
+        changed_when: false
+        check_mode: no
+        register: rhel9cis_5_3_2_profiles
+
+      - name: "5.3.2 | L1 | AUDIT | Select authselect profile | Show profiles"
+        debug:
+            msg:
+                - "Below are the current custom profiles"
+                - "{{ rhel9cis_5_3_2_profiles.stdout_lines }}"
+
+      - name: "5.3.2 | L1 | PATCH | Select authselect profile | Create custom profiles"
+        shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} {{ rhel9cis_authselect['options'] }}"
+        args:
+            warn: no
+        when: rhel9cis_authselect_custom_profile_select
+  when:
+      - rhel9cis_rule_5_3_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - authselect
+      - rule_5.3.2
+
+- name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock"
+  block:
+      - name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock | Gather profiles and enabled features"
+        shell: "authselect current | grep with-faillock"
+        failed_when: false
+        changed_when: false
+        check_mode: no
+        register: rhel9cis_5_3_3_profiles_faillock
+
+      - name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock| Show profiles"
+        debug:
+            msg:
+                - "Below are the current custom profiles"
+                - "{{ rhel9cis_5_3_3_profiles_faillock.stdout_lines }}"
+
+      - name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock | Create custom profiles"
+        shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} with-faillock"
+        args:
+            warn: no
+        when: rhel9cis_authselect_custom_profile_select
+  when:
+      - rhel9cis_rule_5_3_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - authselect
+      - rule_5.3.3

tasks/section_5/cis_5.4.x.yml

@@ -0,0 +1,131 @@
+---
+
+- name: |
+    "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
+     5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
+     5.4.3 | L1 | PATCH | Ensure password reuse is limited
+     5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
+  block:
+      - name: "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set pwquality config settings"
+        lineinfile:
+            state: present
+            dest: /etc/security/pwquality.conf
+            regexp: ^{{ item.name }}
+            line: "{{ item.name }} = {{ item.value }}"
+        with_items:
+            - { name: minlen, value: "{{ rhel9cis_pam_password.minlen }}" }
+            - { name: minclass, value: "{{ rhel9cis_pam_password.minclass }}" }
+        when: rhel9cis_rule_5_4_1
+
+      - name: |
+          "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings
+           5.4.3| L1 | PATCH | Ensure password reuse is limited | Set system-auth remember settings"
+        lineinfile:
+            dest: /etc/pam.d/system-auth
+            state: present
+            regexp: '^password    requisite                                    pam_pwquality.so'
+            line: "password    requisite                                    pam_pwquality.so try_first_pass local_users_only enforce-for-root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
+            insertbefore: '^#?password ?'
+        when:
+            - rhel9cis_rule_5_4_1 or
+              rhel9cis_rule_5_4_3
+
+      - name: "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings"
+        lineinfile:
+            dest: /etc/pam.d/password-auth
+            state: present
+            regexp: '^password    requisite                                    pam_pwquality.so'
+            line: "password    requisite                                    pam_pwquality.so try_first_pass local_users_only enforce-for-root retry=3"
+            insertbefore: '^#?password ?'
+        when: rhel9cis_rule_5_4_1
+
+      - name: "5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured | Add deny count and unlock time for preauth"
+        lineinfile:
+            dest: /etc/pam.d/{{ item }}
+            state: present
+            regexp: '^auth        required                                     pam_faillock.so preauth'
+            line: "auth        required                                     pam_faillock.so preauth silent deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
+            insertafter: '^#?auth ?'
+        with_items:
+            - "system-auth"
+            - "password-auth"
+        when: rhel9cis_rule_5_4_2
+
+      - name: "5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured | Add deny count and unlock times for authfail"
+        lineinfile:
+            dest: /etc/pam.d/{{ item }}
+            state: present
+            regexp: '^auth        required                                     pam_faillock.so authfail'
+            line: "auth        required                                     pam_faillock.so authfail deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
+            insertafter: '^#?auth ?'
+        with_items:
+            - "system-auth"
+            - "password-auth"
+        when: rhel9cis_rule_5_4_2
+
+      - name: |
+           "5.4.3 | L1 | PATCH | Ensure password reuse is limited | Set system-auth remember remember settings
+            5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512 | Set system-auth pwhash settings"
+        lineinfile:
+            dest: /etc/pam.d/system-auth
+            state: present
+            regexp: '^password    sufficient                                   pam_unix.so'
+            line: "password    sufficient                                   pam_unix.so {{ rhel9cis_pam_faillock.pwhash }} shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}"
+            insertafter: '^#?password ?'
+        when:
+            - rhel9cis_rule_5_4_3 or
+              rhel9cis_rule_5_4_4
+
+      - name: "5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512 | Set system-auth pwhash settings"
+        lineinfile:
+            dest: /etc/pam.d/password-auth
+            state: present
+            regexp: '^password    sufficient                                   pam_unix.so'
+            line: "password    sufficient                                   pam_unix.so {{ rhel9cis_pam_faillock.pwhash }} shadow try_first_pass use_authtok"
+            insertafter: '^#?password ?'
+        when: rhel9cis_rule_5_4_4
+
+      # The two steps below were added to keep authconfig from overwritting the above configs. This follows steps from here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services
+      # With the steps below you will score five (5) points lower due to false positive results
+      - name: |
+           "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
+            5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
+            5.4.3 | L1 | PATCH | Ensure password reuse is limited
+            5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
+        copy:
+            src: /etc/pam.d/{{ item }}
+            dest: /etc/pam.d/{{ item }}-local
+            remote_src: yes
+            owner: root
+            group: root
+            mode: '0644'
+        with_items:
+            - "system-auth"
+            - "password-auth"
+
+      - name: |
+           "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
+            5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
+            5.4.3 | L1 | PATCH | Ensure password reuse is limited
+            5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
+        file:
+            src: /etc/pam.d/{{ item }}-local
+            dest: /etc/pam.d/{{ item }}
+            state: link
+            force: yes
+        with_items:
+            - "system-auth"
+            - "password-auth"
+  when:
+      - rhel9cis_rule_5_4_1 or
+        rhel9cis_rule_5_4_2 or
+        rhel9cis_rule_5_4_3 or
+        rhel9cis_rule_5_4_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.4.1
+      - rule_5.4.2
+      - rule_5.4.3
+      - rule_5.4.4

tasks/section_5/cis_5.5.1.x.yml

@@ -0,0 +1,117 @@
+---
+
+- name: "5.5.1.1 | L1 | PATCH | Ensure password expiration is 365 days or less"
+  lineinfile:
+      state: present
+      dest: /etc/login.defs
+      regexp: '^PASS_MAX_DAYS'
+      line: "PASS_MAX_DAYS {{ rhel9cis_pass['max_days'] }}"
+  when:
+      - rhel9cis_rule_5_5_1_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.1.1
+
+- name: "5.5.1.2 | L1 | PATCH | Ensure minimum days between password changes is 7 or more"
+  lineinfile:
+      state: present
+      dest: /etc/login.defs
+      regexp: '^PASS_MIN_DAYS'
+      line: "PASS_MIN_DAYS {{ rhel9cis_pass['min_days'] }}"
+  when:
+      - rhel9cis_rule_5_5_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.1.2
+
+- name: "5.5.1.3 | L1 | PATCH | Ensure password expiration warning days is 7 or more"
+  lineinfile:
+      state: present
+      dest: /etc/login.defs
+      regexp: '^PASS_WARN_AGE'
+      line: "PASS_WARN_AGE {{ rhel9cis_pass['warn_age'] }}"
+  when:
+      - rhel9cis_rule_5_5_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.1.3
+
+- name: "5.5.1.4 | L1 | PATCH | Ensure inactive password lock is 30 days or less"
+  block:
+      - name: "5.5.1.4 | L1 | AUDIT | Ensure inactive password lock is 30 days or less | Check current settings"
+        shell: useradd -D | grep INACTIVE={{ rhel9cis_inactivelock.lock_days }} | cut -f2 -d=
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_5_5_1_4_inactive_settings
+
+      - name: "5.5.1.4 | L1 | PATCH | Ensure inactive password lock is 30 days or less | Set default inactive setting"
+        command: useradd -D -f {{ rhel9cis_inactivelock.lock_days }}
+        when: rhel9cis_5_5_1_4_inactive_settings.stdout | length == 0
+
+      - name: "5.5.1.4 | L1 | AUDIT | Ensure inactive password lock is 30 days or less | Getting user list"
+        shell: 'egrep ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1'
+        check_mode: no
+        register: rhel_09_5_5_1_4_audit
+        changed_when: false
+
+      - name: "5.5.1.4 | L1 | PATCH | Ensure inactive password lock is 30 days or less | Apply Inactive setting to existing accounts"
+        command: chage --inactive {{ rhel9cis_inactivelock.lock_days }} "{{ item }}"
+        with_items:
+            - "{{ rhel_09_5_5_1_4_audit.stdout_lines }}"
+  when:
+      - rhel9cis_rule_5_5_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.1.4
+
+- name: "5.5.1.5 | L1 |  PATCH | Ensure all users last password change date is in the past"
+  block:
+      - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Get current date in Unix Time"
+        shell: echo $(($(date --utc --date "$1" +%s)/86400))
+        failed_when: false
+        changed_when: false
+        check_mode: no
+        register: rhel9cis_5_5_1_5_currentut
+
+      - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Get list of users with last changed pw date in the future"
+        shell: "cat /etc/shadow | awk -F: '{if($3>{{ rhel9cis_5_5_1_5_currentut.stdout }})print$1}'"
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_5_5_1_5_user_list
+
+      - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Alert no pw change in the future exist"
+        debug:
+            msg: "Good News! All accounts have PW change dates that are in the past"
+        when: rhel9cis_5_5_1_5_user_list.stdout | length == 0
+
+      - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Alert on accounts with pw change in the future"
+        debug:
+            msg: "Warning! The following accounts have the last PW change date in the future: {{ rhel9cis_5_5_1_5_user_list.stdout_lines }}"
+        when:
+            - rhel9cis_5_5_1_5_user_list.stdout | length > 0
+            - not rhel9cis_futurepwchgdate_autofix
+
+      - name: "5.5.1.5 | L1 | PATCH | Ensure all users last password change date is in the past | Fix accounts with pw change in the future"
+        command: passwd --expire {{ item }}
+        when:
+            - rhel9cis_5_5_1_5_user_list | length > 0
+            - rhel9cis_futurepwchgdate_autofix
+        with_items:
+            - "{{ rhel9cis_5_5_1_5_user_list.stdout_lines }}"
+  when:
+      - rhel9cis_rule_5_5_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.1.5

tasks/section_5/cis_5.5.x.yml

@@ -0,0 +1,96 @@
+---
+
+- name: "5.5.2 | L1 | PATCH | Ensure system accounts are secured"
+  block:
+      - name: "5.5.2 | L1 | Ensure system accounts are secured | Set nologin"
+        user:
+            name: "{{ item.id }}"
+            shell: /usr/sbin/nologin
+        with_items:
+            - "{{ rhel9cis_passwd }}"
+        when:
+            - item.id != "root"
+            - item.id != "sync"
+            - item.id != "shutdown"
+            - item.id != "halt"
+            - item.gid < rhel9cis_int_gid
+            - item.shell != "      /bin/false"
+            - item.shell != "      /usr/sbin/nologin"
+
+      - name: "5.5.2 | L1 | PATCH | Ensure system accounts are secured | Lock accounts"
+        user:
+            name: "{{ item.id }}"
+            password_lock: true
+        with_items:
+            - "{{ rhel9cis_passwd }}"
+        when:
+            - item.id != "halt"
+            - item.id != "shutdown"
+            - item.id != "sync"
+            - item.id != "root"
+            - item.gid < rhel9cis_int_gid
+            - item.shell != "      /bin/false"
+            - item.shell != "      /usr/sbin/nologin"
+  when:
+      - rhel9cis_rule_5_5_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.2
+
+- name: "5.5.3 | L1 | PATCH | Ensure default user shell timeout is 900 seconds or less"
+  blockinfile:
+      create: yes
+      mode: 0644
+      dest: "{{ item.dest }}"
+      state: "{{ item.state }}"
+      marker: "# {mark} ANSIBLE MANAGED"
+      block: |
+        # Set session timeout - CIS ID RHEL-09-5.4.5
+        TMOUT={{ rhel9cis_shell_session_timeout.timeout }}
+        export TMOUT
+        readonly TMOUT
+  with_items:
+      - { dest: "{{ rhel9cis_shell_session_timeout.file }}", state: present }
+      - { dest: /etc/profile, state: "{{ (rhel9cis_shell_session_timeout.file == '/etc/profile') | ternary('present', 'absent') }}" }
+  when:
+      - rhel9cis_rule_5_5_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.3
+
+- name: "5.5.4 | L1 | PATCH | Ensure default group for the root account is GID 0"
+  command: usermod -g 0 root
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_5_5_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.4
+
+- name: "5.5.5 | L1 | PATCH | Ensure default user umask is 027 or more restrictive"
+  block:
+      - name: "5.5.5 | L1 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/bashrc"
+        replace:
+            path: /etc/bashrc
+            regexp: '(^\s+umask) 0[012][0-6]'
+            replace: '\1 027'
+
+      - name: "5.5.5 | L1 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/profile"
+        replace:
+            path: /etc/profile
+            regexp: '(^\s+umask) 0[012][0-6]'
+            replace: '\1 027'
+  when:
+      - rhel9cis_rule_5_5_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.5.5

tasks/section_5/cis_5.6.yml

@@ -0,0 +1,35 @@
+---
+
+# this will just display the list of consoles. The site will need to confirm the allowed consoles are correct and change manually if needed.
+- name: "5.6 | L1 | AUDIT | Ensure root login is restricted to system console"
+  block:
+      - name: "5.6 | L1 | AUDIT | Ensure root login is restricted to system console | Check if securetty file exists"
+        stat:
+            path: /etc/securetty
+        register: rhel9cis_securetty_check
+
+      - name: "5.6 | L1 | AUDIT | Ensure root login is restricted to system console | Capture consoles"
+        command: cat /etc/securetty
+        changed_when: false
+        register: rhel_09_5_6_audit
+        when: rhel9cis_securetty_check.stat.exists
+
+      - name: "5.6 | L1 | AUDIT |Ensure root login is restricted to system console | Display Console"
+        debug:
+            msg:
+                - "These are the consoles with root login access, please review:"
+                - "{{ rhel_09_5_6_audit.stdout_lines }}"
+        when: rhel9cis_securetty_check.stat.exists
+
+      - name: "5.6 | L1 | AUDIT | Ensure root login is restricted to system console | Display that no securetty file exists"
+        debug:
+            msg:
+                - "There is no /etc/securetty file, this has been removed by default in RHEL9"
+        when: not rhel9cis_securetty_check.stat.exists
+  when:
+      - rhel9cis_rule_5_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_5.6

tasks/section_5/cis_5.7.yml

@@ -0,0 +1,22 @@
+---
+
+- name: "5.7 | L1 | PATCH | Ensure access to the su command is restricted"
+  block:
+      - name: "5.7 | L1 | PATCH | Ensure access to the su command is restricted | Setting pam_wheel to use_uid"
+        lineinfile:
+            state: present
+            dest: /etc/pam.d/su
+            regexp: '^(#)?auth\s+required\s+pam_wheel\.so'
+            line: 'auth           required        pam_wheel.so use_uid {% if rhel9cis_sugroup is defined %}group={{ rhel9cis_sugroup }}{% endif %}'
+
+      - name: "5.7 | L1 | PATCH | Ensure access to the su command is restricted | wheel group contains root"
+        user:
+            name: "{{ rhel9cis_sugroup_users }}"
+            groups: "{{ rhel9cis_sugroup | default('wheel') }}"
+  when:
+      - rhel9cis_rule_5_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_5.7

tasks/section_5/main.yml

@@ -0,0 +1,27 @@
+---
+
+- name: "SECTION | 5.1 | Configure time-based job schedulers"
+  include: cis_5.1.x.yml
+
+- name: "SECTION | 5.2 | Configure SSH Server"
+  include: cis_5.2.x.yml
+
+- name: "SECTION | 5.3 | Configure Profiles"
+  include: cis_5.3.x.yml
+  when:
+  - rhel9cis_use_authconfig
+
+- name: "SECTION | 5.4 | Configure PAM "
+  include: cis_5.4.x.yml
+
+- name: "SECTION | 5.5.1.x | Passwords and Accounts"
+  include: cis_5.5.1.x.yml
+
+- name: "SECTION | 5.5.x | System Accounts and User Settings"
+  include: cis_5.5.x.yml
+
+- name: "SECTION | 5.6 | Root Login"
+  include: cis_5.6.yml
+
+- name: Section | 5.7 | su Command Restriction
+  include: cis_5.7.yml

tasks/section_6/cis_6.1.x.yml

@@ -0,0 +1,294 @@
+---
+
+- name: "6.1.1 | L2 | AUDIT | Audit system file permissions"
+  block:
+      - name: "6.1.1 | L2 | AUDIT | Audit system file permissions | Audit the packages"
+        shell: rpm -Va --nomtime --nosize --nomd5 --nolinkto
+        args:
+            warn: no
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_6_1_1_packages_rpm
+
+      - name: "6.1.1 | L2 | AUDIT | Audit system file permissions | Create list and warning"
+        block:
+            - name: "6.1.1 | L2 | Audit system file permissions | Add file discrepancy list to system"
+              copy:
+                  dest: "{{ rhel9cis_rpm_audit_file }}"
+                  content: "{{ rhel9cis_6_1_1_packages_rpm.stdout }}"
+
+            - name: "6.1.1 | L2 | AUDIT | Audit system file permissions | Message out alert for package descrepancies"
+              debug:
+                  msg: |
+                     "Warning! You have some package descrepancies issues.
+                      The file list can be found in {{ rhel9cis_rpm_audit_file }}"
+        when: rhel9cis_6_1_1_packages_rpm.stdout|length > 0
+
+      - name: "6.1.1 | L2 | AUDIT | Audit system file permissions | Message out no package descrepancies"
+        debug:
+            msg: "Good News! There are no package descrepancies"
+        when: rhel9cis_6_1_1_packages_rpm.stdout|length == 0
+  when:
+      - rhel9cis_rule_6_1_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - audit
+      - rule_6.1.1
+
+- name: "6.1.2 | L1 | PATCH | Ensure permissions on /etc/passwd are configured"
+  file:
+      dest: /etc/passwd
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_6_1_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.2
+
+- name: "6.1.3 | L1 | PATCH | Ensure permissions on /etc/passwd- are configured"
+  file:
+      dest: /etc/passwd-
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_6_1_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.3
+
+- name: "6.1.4 | L1 | PATCH | Ensure permissions on /etc/shadow are configured"
+  file:
+      dest: /etc/shadow
+      owner: root
+      group: root
+      mode: 0000
+  when:
+      - rhel9cis_rule_6_1_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.4
+
+- name: "6.1.5 | L1 | PATCH | Ensure permissions on /etc/shadow- are configured"
+  file:
+      dest: /etc/shadow-
+      owner: root
+      group: root
+      mode: 0000
+  when:
+      - rhel9cis_rule_6_1_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.5
+
+- name: "6.1.6 | L1 | PATCH | Ensure permissions on /etc/gshadow are configured"
+  file:
+      dest: /etc/gshadow
+      owner: root
+      group: root
+      mode: 0000
+  when:
+      - rhel9cis_rule_6_1_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.6
+
+- name: "6.1.7 | L1 | PATCH | Ensure permissions on /etc/gshadow- are configured"
+  file:
+      dest: /etc/gshadow-
+      owner: root
+      group: root
+      mode: 0000
+  when:
+      - rhel9cis_rule_6_1_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.7
+
+- name: "6.1.8 | L1 | PATCH |  Ensure permissions on /etc/group are configured"
+  file:
+      dest: /etc/group-
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_6_1_8
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.8
+
+- name: "6.1.9 | L1 | PATCH | Ensure permissions on /etc/group- are configured"
+  file:
+      dest: /etc/group-
+      owner: root
+      group: root
+      mode: 0644
+  when:
+      - rhel9cis_rule_6_1_9
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.9
+
+- name: "6.1.10 | L1 | PATCH | Ensure no world writable files exist"
+  block:
+      - name: "6.1.10 | L1 | AUDIT | Ensure no world writable files exist | Get list of world-writable files"
+        shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002
+        failed_when: false
+        changed_when: false
+        register: rhel_09_6_1_10_perms_results
+
+      - name: "6.1.10 | L1 | AUDIT | Ensure no world writable files exist | Alert no world-writable files exist"
+        debug:
+            msg: "Good news! We have not found any world-writable files on your system"
+        when:
+            - rhel_09_6_1_10_perms_results.stdout is not defined
+
+      - name: "6.1.10 | L1 | PATCH | Ensure no world writable files exist | Adjust world-writable files if they exist (Configurable)"
+        file:
+            path: '{{ item }}'
+            mode: o-w
+            state: touch
+        with_items: "{{ rhel_09_6_1_10_perms_results.stdout_lines }}"
+        when:
+            - rhel_09_6_1_10_perms_results.stdout_lines is defined
+            - rhel9cis_no_world_write_adjust
+  when:
+      - rhel9cis_rule_6_1_10
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.10
+
+- name: "6.1.11 | L1 | AUDIT | Ensure no unowned files or directories exist"
+  block:
+      - name: "6.1.11 | L1 | AUDIT | Ensure no unowned files or directories exist | Finding all unowned files or directories"
+        command: find "{{ item.mount }}" -xdev -nouser
+        check_mode: false
+        failed_when: false
+        changed_when: false
+        with_items: "{{ ansible_mounts }}"
+        register: rhel_09_6_1_11_audit
+        when: item['device'].startswith('/dev') and not 'bind' in item['options']
+
+      - name: "6.1.11 | L1 | AUDIT | Ensure no unowned files or directories exist | Displaying any unowned files or directories"
+        debug:
+            msg: "Manual intervention is required -- missing owner on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
+        with_items: "{{ rhel_09_6_1_11_audit.results }}"
+        when:
+            - item.stdout_lines is defined
+            - item.stdout_lines | length > 0
+  when:
+      - rhel9cis_rule_6_1_11
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.1.11
+
+- name: "6.1.12 | L1 | AUDIT | Ensure no ungrouped files or directories exist"
+  block:
+      - name: "6.1.12 | L1 | AUDIT | Ensure no ungrouped files or directories exist | Finding all ungrouped files or directories"
+        command: find "{{ item.mount }}" -xdev -nogroup
+        check_mode: false
+        failed_when: false
+        changed_when: false
+        register: rhel_09_6_1_12_audit
+        with_items: "{{ ansible_mounts }}"
+        when: item['device'].startswith('/dev') and not 'bind' in item['options']
+
+      - name: "6.1.12 | L1 | AUDIT | Ensure no ungrouped files or directories exist | Displaying all ungrouped files or directories"
+        debug:
+            msg: "Manual intervention is required -- missing group on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
+        with_items: "{{ rhel_09_6_1_12_audit.results }}"
+        when:
+            - item.stdout_lines is defined
+            - item.stdout_lines | length > 0
+  when:
+      - rhel9cis_rule_6_1_12
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.12
+
+- name: "6.1.13 | L1 | AUDIT | Audit SUID executables"
+  block:
+      - name: "6.1.13 | L1 | AUDIT | Audit SUID executables | Find all SUID executables"
+        shell: df {{ item.mount }} -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -4000
+        failed_when: false
+        changed_when: false
+        register: rhel_09_6_1_13_perms_results
+        with_items: "{{ ansible_mounts }}"
+
+      - name: "6.1.13 | L1 | AUDIT | Audit SUID executables |  Alert no SUID executables exist"
+        debug:
+            msg: "Good news! We have not found any SUID executable files on your system"
+        failed_when: false
+        changed_when: false
+        when:
+            - rhel_09_6_1_13_perms_results.stdout is not defined
+
+      - name: "6.1.13 | L1 | AUDIT | Audit SUID executables |  Alert SUID executables exist"
+        debug:
+            msg: "Manual intervention is required -- SUID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
+        with_items: "{{ rhel_09_6_1_13_perms_results.stdout_lines }}"
+        when:
+            - rhel_09_6_1_13_perms_results.stdout is defined
+  when:
+      - rhel9cis_rule_6_1_13
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.1.13
+
+- name: "6.1.14 | L1 | AUDIT | Audit SGID executables"
+  block:
+      - name: "6.1.14 | L1 | AUDIT | Audit SGID executables | Find all SGID executables"
+        shell: df {{ item.mount }} -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -2000
+        failed_when: false
+        changed_when: false
+        register: rhel_09_6_1_14_perms_results
+        with_items: "{{ ansible_mounts }}"
+
+      - name: "6.1.14 | L1 | AUDIT | Audit SGID executables |  Alert no SGID executables exist"
+        debug:
+            msg: "Good news! We have not found any SGID executable files on your system"
+        failed_when: false
+        changed_when: false
+        when:
+            - rhel_09_6_1_14_perms_results.stdout is not defined
+
+      - name: "6.1.14 | L1 | AUDIT | Audit SGID executables |  Alert SGID executables exist"
+        debug:
+            msg: "Manual intervention is required -- SGID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
+        with_items: "{{ rhel_09_6_1_14_perms_results.stdout_lines }}"
+        when:
+            - rhel_09_6_1_14_perms_results.stdout is defined
+  when:
+      - rhel9cis_rule_6_1_14
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.1.14

tasks/section_6/cis_6.2.x.yml

@@ -0,0 +1,519 @@
+---
+
+- name: "6.2.1 | L1 | AUDIT | Ensure password fields are not empty"
+  command: passwd -l {{ item }}
+  changed_when: false
+  failed_when: false
+  with_items: "{{ empty_password_accounts.stdout_lines }}"
+  when:
+      - empty_password_accounts.rc
+      - rhel9cis_rule_6_2_1
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.1
+
+- name: "6.2.2 | L1 | PATCH | Ensure no legacy '+' entries exist in /etc/passwd"
+  command: sed -i '/^+/ d' /etc/passwd
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_6_2_2
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.2
+      - skip_ansible_lint
+
+- name: "6.2.3 | L1 | PATCH | Ensure root PATH Integrity"
+  block:
+      - name: "6.2.3 | L1 | AUDIT | Ensure root PATH Integrity | Determine empty value"
+        shell: 'echo $PATH | grep ::'
+        check_mode: no
+        register: path_colon
+        changed_when: False
+        failed_when: path_colon.rc == 0
+
+      - name: "6.2.3 | L1 | AUDIT | Ensure root PATH Integrity | Determin colon end"
+        shell: 'echo $PATH | grep :$'
+        check_mode: no
+        register: path_colon_end
+        changed_when: False
+        failed_when: path_colon_end.rc == 0
+
+      - name: "6.2.3 | L1 | AUDIT | Ensure root PATH Integrity | Determine dot in path"
+        shell: "/bin/bash --login -c 'env | grep ^PATH=' | sed -e 's/PATH=//' -e 's/::/:/' -e 's/:$//' -e 's/:/\\n/g'"
+        check_mode: no
+        register: dot_in_path
+        changed_when: False
+        failed_when: '"." in dot_in_path.stdout_lines'
+
+      - name: "6.2.3 | L1 | AUDIT | Ensure root PATH Integrity | Alert on empty value, colon end, and dot in path"
+        debug:
+            msg:
+                - "The following paths have an empty value: {{ path_colon.stdout_lines }}"
+                - "The following paths have colon end: {{ path_colon_end.stdout_lines }}"
+                - "The following paths have a dot in the path: {{ dot_in_path.stdout_lines }}"
+
+      - name: "6.2.3 | L1 | PATCH | Ensure root PATH Integrity (Scored) | Determine rights and owner"
+        file: >
+          path='{{ item }}'
+          follow=yes
+          state=directory
+          owner=root
+          mode='o-w,g-w'
+        with_items: "{{ dot_in_path.stdout_lines }}"
+  when:
+      - rhel9cis_rule_6_2_3
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.3
+
+- name: "6.2.4 | L1 | PATCH | Ensure no legacy '+' entries exist in /etc/shadow"
+  command: sed -i '/^+/ d' /etc/shadow
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_6_2_4
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.4
+      - skip_ansible_lint
+
+- name: "6.2.5 | L1 | PATCH | Ensure no legacy '+' entries exist in /etc/group"
+  command: sed -i '/^+/ d' /etc/group
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_6_2_5
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.5
+      - skip_ansible_lint
+
+- name: "6.2.6 | L1 | PATCH | Ensure root is the only UID 0 account"
+  command: passwd -l {{ item }}
+  changed_when: false
+  failed_when: false
+  with_items: "{{ uid_zero_accounts_except_root.stdout_lines }}"
+  when:
+      - uid_zero_accounts_except_root.rc
+      - rhel9cis_rule_6_2_6
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.6
+
+- name: "6.2.7 | L1 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+  block:
+      - name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
+        stat:
+            path: "{{ item }}"
+        with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
+        register: rhel_09_6_2_7_audit
+
+      - name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
+        command: find -H {{ item.0 | quote }} -not -type l -perm /027
+        check_mode: false
+        changed_when: rhel_09_6_2_7_patch_audit.stdout | length > 0
+        register: rhel_09_6_2_7_patch_audit
+        when:
+            - ansible_check_mode
+            - item.1.exists
+        with_together:
+            - "{{ rhel_09_6_2_7_audit.results | map(attribute='item') | list }}"
+            - "{{ rhel_09_6_2_7_audit.results | map(attribute='stat') | list }}"
+        loop_control:
+            label: "{{ item.0 }}"
+
+      - name: "6.2.7 | L1 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+        file:
+            path: "{{ item.0 }}"
+            recurse: yes
+            mode: a-st,g-w,o-rwx
+        register: rhel_09_6_2_7_patch
+        when:
+            - not ansible_check_mode
+            - item.1.exists
+        with_together:
+            - "{{ rhel_09_6_2_7_audit.results | map(attribute='item') | list }}"
+            - "{{ rhel_09_6_2_7_audit.results | map(attribute='stat') | list }}"
+        loop_control:
+            label: "{{ item.0 }}"
+
+      # set default ACLs so the homedir has an effective umask of 0027
+      - name: "6.2.7 | L1 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
+        acl:
+            path: "{{ item.0 }}"
+            default: yes
+            state: present
+            recursive: yes
+            etype: "{{ item.1.etype }}"
+            permissions: "{{ item.1.mode }}"
+        when: not rhel9cis_system_is_container
+        with_nested:
+            - "{{ (ansible_check_mode | ternary(rhel_09_6_2_7_patch_audit, rhel_09_6_2_7_patch)).results |
+              rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"
+            -
+                - etype: group
+                  mode: rx
+                - etype: other
+                  mode: '0'
+  when:
+      - rhel9cis_rule_6_2_7
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.7
+
+- name: "6.2.8 | L1 | PATCH | Ensure users own their home directories"
+  file:
+      path: "{{ item.dir }}"
+      owner: "{{ item.id }}"
+      state: directory
+  with_items: "{{ rhel9cis_passwd }}"
+  loop_control:
+      label: "{{ rhel9cis_passwd_label }}"
+  when:
+      - item.uid >= rhel9cis_int_gid
+      - rhel9cis_rule_6_2_8
+  tags:
+      - skip_ansible_lint  # settings found on 6_2_7
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.8
+
+- name: "6.2.9 | L1 | PATCH | Ensure users' dot files are not group or world-writable"
+  block:
+      - name: "6.2.9 | L1 | AUDIT | Ensure users' dot files are not group or world-writable | Check for files"
+        shell: find /home/ -name "\.*" -perm /g+w,o+w
+        changed_when: false
+        failed_when: false
+        register: rhel9cis_6_2_9_audit
+
+      - name: "6.2.9 | L1 | AUDIT | Ensure users' dot files are not group or world-writable | Alert on files found"
+        debug:
+            msg: "Good news! We have not found any group or world-writable dot files on your sytem"
+        when:
+            - rhel9cis_6_2_9_audit.stdout is not defined
+
+      - name: "6.2.9 | L1 | PATCH | Ensure users' dot files are not group or world-writable | Changes files if configured"
+        file:
+            path: '{{ item }}'
+            mode: go-w
+        with_items: "{{ rhel9cis_6_2_9_audit.stdout_lines }}"
+        when:
+            - rhel9cis_6_2_9_audit.stdout is defined
+            - rhel9cis_dotperm_ansiblemanaged
+  when:
+      - rhel9cis_rule_6_2_9
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.9
+
+- name: "6.2.10 | L1 | PATCH | Ensure no users have .forward files"
+  file:
+      state: absent
+      dest: "~{{ item }}/.forward"
+  with_items: "{{ users.stdout_lines }}"
+  when:
+      - rhel9cis_rule_6_2_10
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.10
+
+- name: "6.2.11 | L1 | PATCH | Ensure no users have .netrc files"
+  file:
+      state: absent
+      dest: "~{{ item }}/.netrc"
+  with_items: "{{ users.stdout_lines }}"
+  when:
+      - rhel9cis_rule_6_2_11
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.11
+
+- name: "6.2.12 | L1 | PATCH | Ensure users' .netrc Files are not group or world accessible"
+  command: /bin/true
+  changed_when: false
+  failed_when: false
+  when:
+      - rhel9cis_rule_6_2_12
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.12
+
+- name: "6.2.13 | L1 | PATCH | Ensure no users have .rhosts files"
+  file:
+      state: absent
+      dest: "~{{ item }}/.rhosts"
+  with_items: "{{ users.stdout_lines }}"
+  when:
+      - rhel9cis_rule_6_2_13
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.13
+
+- name: "6.2.14 | L1 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group"
+  block:
+      - name: "6.2.14 | L1 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Check /etc/passwd entries"
+        shell: pwck -r | grep 'no group' | awk '{ gsub("[:\47]",""); print $2}'
+        changed_when: false
+        failed_when: false
+        check_mode: false
+        register: passwd_gid_check
+
+      - name: "6.2.14 | L1 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Print message that all groups match between passwd and group files"
+        debug:
+            msg: "Good News! There are no users that have non-existent GUIDs (Groups)"
+        when: passwd_gid_check.stdout is not defined
+
+      - name: "6.2.14 | L1 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Print warning about users with invalid GIDs missing GID entries in /etc/group"
+        debug:
+            msg: "WARNING: The following users have non-existent GIDs (Groups): {{ passwd_gid_check.stdout_lines | join (', ') }}"
+        when: passwd_gid_check.stdout is defined
+  when:
+      - rhel9cis_rule_6_2_14
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.2.14
+
+- name: "6.2.15 | L1 | AUDIT Ensure no duplicate UIDs exist"
+  block:
+      - name: "6.2.15 | L1 | AUDIT | Ensure no duplicate UIDs exist | Check for duplicate UIDs"
+        shell: "pwck -r | awk -F: '{if ($3 in uid) print $1 ; else uid[$3]}' /etc/passwd"
+        changed_when: false
+        failed_when: false
+        register: user_uid_check
+
+      - name: "6.2.15 | L1 | AUDIT | Ensure no duplicate UIDs exist | Print message that no duplicate UIDs exist"
+        debug:
+            msg: "Good News! There are no duplicate UID's in the system"
+        when: user_uid_check.stdout is not defined
+
+      - name: "6.2.15 | L1 | AUDIT| Ensure no duplicate UIDs exist | Print warning about users with duplicate UIDs"
+        debug:
+            msg: "Warning: The following users have UIDs that are duplicates: {{ user_uid_check.stdout_lines }}"
+        when: user_uid_check.stdout is defined
+  when:
+      - rhel9cis_rule_6_2_15
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.15
+
+- name: "6.2.16 | L1 | AUDIT | Ensure no duplicate GIDs exist"
+  block:
+      - name: "6.2.16 | L1 | AUDIT | Ensure no duplicate GIDs exist | Check for duplicate GIDs"
+        shell: "pwck -r | awk -F: '{if ($3 in users) print $1 ; else users[$3]}' /etc/group"
+        changed_when: false
+        failed_when: false
+        register: user_user_check
+
+      - name: "6.2.16 | L1 | AUDIT | Ensure no duplicate GIDs exist | Print message that no duplicate GID's exist"
+        debug:
+            msg: "Good News! There are no duplicate GIDs in the system"
+        when: user_user_check.stdout is not defined
+
+      - name: "6.2.16 | L1 | AUDIT | Ensure no duplicate GIDs exist | Print warning about users with duplicate GIDs"
+        debug:
+            msg: "Warning: The following groups have duplicate GIDs: {{ user_user_check.stdout_lines }}"
+        when: user_user_check.stdout is defined
+  when:
+      - rhel9cis_rule_6_2_16
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.2.16
+
+- name: "6.2.17 | L1 | AUDIT | Ensure no duplicate user names exist"
+  block:
+      - name: "6.2.17 | L1 | AUDIT | Ensure no duplicate user names exist | Check for duplicate User Names"
+        shell: "pwck -r | awk -F: '{if ($1 in users) print $1 ; else users[$1]}' /etc/passwd"
+        changed_when: false
+        failed_when: false
+        register: user_username_check
+
+      - name: "6.2.17 | L1 | AUDIT | Ensure no duplicate user names exist | Print message that no duplicate user names exist"
+        debug:
+            msg: "Good News! There are no duplicate user names in the system"
+        when: user_username_check.stdout is not defined
+
+      - name: "6.2.17 | L1 | AUDIT | Ensure no duplicate user names exist | Print warning about users with duplicate User Names"
+        debug:
+            msg: "Warning: The following user names are duplicates: {{ user_username_check.stdout_lines }}"
+        when: user_username_check.stdout is defined
+  when:
+      - rhel9cis_rule_6_2_17
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.2.17
+
+- name: "6.2.18 | L1 | AUDIT |Ensure no duplicate group names exist"
+  block:
+      - name: "6.2.18 | L1 | AUDIT | Ensure no duplicate group names exist | Check for duplicate group names"
+        shell: 'getent passwd | cut -d: -f1 | sort -n | uniq -d'
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: group_group_check
+
+      - name: "6.2.18 | L1 | AUDIT | Ensure no duplicate group names exist | Print message that no duplicate groups exist"
+        debug:
+            msg: "Good News! There are no duplicate group names in the system"
+        when: group_group_check.stdout is defined
+
+      - name: "6.2.18 | L1 | AUDIT | Ensure no duplicate group names exist | Print warning about users with duplicate group names"
+        debug:
+            msg: "Warning: The following group names are duplicates: {{ group_group_check.stdout_lines }}"
+        when: group_group_check.stdout is not defined
+  when:
+      - rhel9cis_rule_6_2_18
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.2.18
+
+- name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty"
+  block:
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Check for shadow group and pull group id"
+        shell: "getent group shadow | cut -d: -f3"
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_shadow_gid
+
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Check /etc/group for empty shadow group"
+        shell: grep ^shadow:[^:]*:[^:]*:[^:]+ /etc/group
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_empty_shadow
+
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Check for users assigned to shadow"
+        shell: "getent passwd | awk -F: '$4 == '{{ rhel9cis_shadow_gid.stdout }}' {print $1}'"
+        changed_when: false
+        failed_when: false
+        check_mode: no
+        register: rhel9cis_shadow_passwd
+
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Alert shadow group is empty and no users assigned"
+        debug:
+            msg:
+                - " Good News! The shadow group is empty and there are no users assigned to shadow"
+        when:
+            - rhel9cis_empty_shadow.stdout | length == 0
+            - rhel9cis_shadow_passwd.stdout | length == 0
+
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Alert shadow group is not empty"
+        debug:
+            msg:
+                - "Alert! The shadow group is not empty"
+        when:
+            - rhel9cis_empty_shadow.stdout | length > 0
+
+      - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Alert users are using shadow group"
+        debug:
+            msg:
+                - "Alert! The following users are assigned to the shadow group, please assing them to the appropriate group"
+                - "{{ rhel9cis_shadow_passwd.stdout_lines }}"
+        when:
+            - rhel9cis_shadow_passwd.stdout | length > 0
+  when:
+      - rhel9cis_rule_6_2_19
+  tags:
+      - level1-server
+      - level1-workstation
+      - audit
+      - rule_6.2.19
+
+- name: "6.2.20 | L1 | PATCH | Ensure all users' home directories exist"
+  block:
+      - name: "6.2.20 | L1 | AUDIT | Ensure all users' home directories exist"
+        stat:
+            path: "{{ item }}"
+        register: rhel_09_6_2_20_audit
+        with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
+
+      - name: "6.2.20 | L1 | AUDIT | Ensure all users' home directories exist"
+        command: find -H {{ item.0 | quote }} -not -type l -perm /027
+        check_mode: false
+        changed_when: rhel_09_6_2_20_patch_audit.stdout | length > 0
+        register: rhel_09_6_2_20_patch_audit
+        when:
+            - ansible_check_mode
+            - item.1.exists
+        with_together:
+            - "{{ rhel_09_6_2_20_audit.results | map(attribute='item') | list }}"
+            - "{{ rhel_09_6_2_20_audit.results | map(attribute='stat') | list }}"
+        loop_control:
+            label: "{{ item.0 }}"
+
+      - name: "6.2.20 | L1 | PATCH | Ensure all users' home directories exist"
+        file:
+            path: "{{ item.0 }}"
+            recurse: yes
+            mode: a-st,g-w,o-rwx
+        register: rhel_09_6_2_20_patch
+        when:
+            - not ansible_check_mode
+            - item.1.exists
+        with_together:
+            - "{{ rhel_09_6_2_20_audit.results | map(attribute='item') | list }}"
+            - "{{ rhel_09_6_2_20_audit.results | map(attribute='stat') | list }}"
+        loop_control:
+            label: "{{ item.0 }}"
+
+      # set default ACLs so the homedir has an effective umask of 0027
+      - name: "6.2.20 | L1 | PATCH | Ensure all users' home directories exist"
+        acl:
+            path: "{{ item.0 }}"
+            default: yes
+            state: present
+            recursive: yes
+            etype: "{{ item.1.etype }}"
+            permissions: "{{ item.1.mode }}"
+        when: not rhel9cis_system_is_container
+        with_nested:
+            - "{{ (ansible_check_mode | ternary(rhel_09_6_2_20_patch_audit, rhel_09_6_2_20_patch)).results |
+              rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"
+            -
+                - etype: group
+                  mode: rx
+                - etype: other
+                  mode: '0'
+  when:
+      - rhel9cis_rule_6_2_20
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - rule_6.2.20

tasks/section_6/main.yml

@@ -0,0 +1,7 @@
+---
+
+- name: "SECTION | 6.1 | System File Permissions"
+  include: cis_6.1.x.yml
+
+- name: "SECTION | 6.2 | User and Group Settings"
+  include: cis_6.2.x.yml