ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2026-03-25 22:37:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #60 from ansible-lockdown/Feb26_updates

Browse source 
Enhance documents for password hash
This commit is contained in:
Frederick Witty 2026-02-06 10:24:39 -05:00 • committed by GitHub
commit a6aa5895d5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 22 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

27
defaults/main.yml
View file

@ -569,15 +569,30 @@ rhel9cis_selinux_enforce: enforcing
# This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file. # This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file.
rhel9cis_set_boot_pass: false rhel9cis_set_boot_pass: false
# Either set rhel9cis_bootloader_password_hash or rhel9cis_bootloader_password and rhel9cis_bootloader_salt ################### bootloader password #####################################
# If you are not using the bootloader hash filter you can set it here if the encrypted format e.g. grub.pbkdf2.sha512.hashstring #
rhel9cis_bootloader_password_hash: 'grub.pbkdf2.sha512.changethispassword' # pragma: allowlist secret # Two options for for setting the bootloader password
#
# Option 1: Set the bootloader password and salt – requires the passlib Python module
# to be available on the Ansible controller.
# Set this value to something secure to have predictable hashes,
# which will prevent unnecessary changes.
rhel9cis_bootloader_salt: ''
# This variable stores the GRUB bootloader password to be written
# to the '/boot/grub2/user.cfg' file. The default value must be changed.
# This variable will store the GRUB bootloader password to be stored in '/boot/grub2/user.cfg' file. The default value must be changed.
rhel9cis_bootloader_password: 'password' # pragma: allowlist secret rhel9cis_bootloader_password: 'password' # pragma: allowlist secret
# Set this value to anything secure to have predictable hashes, which will prevent unnecessary changes # Option 2: Set the bootloader password hash – if the salt value is empty,
rhel9cis_bootloader_salt: '' # the password will be set using the variable below.
# If you are not using the bootloader hash filter, you can set it here
# in encrypted format, e.g. grub.pbkdf2.sha512.hashstring
rhel9cis_bootloader_password_hash: 'grub.pbkdf2.sha512.changethispassword' # pragma: allowlist secret
####################################################
## Controls 1.6.x and Controls 5.1.x ## Controls 1.6.x and Controls 5.1.x
# This variable governs if current Ansible role should manage system-wide crypto policy. # This variable governs if current Ansible role should manage system-wide crypto policy.

2
vars/main.yml
View file

@ -24,7 +24,7 @@ rhel9cis_allowed_crypto_policies_modules:
- 'NO-SSHWEAKMAC' - 'NO-SSHWEAKMAC'
- 'NO-WEAKMAC' - 'NO-WEAKMAC'
rhel9_compiled_bootloader_password: "{% if rhel9cis_bootloader_salt != '' %}(rhel9cis_bootloader_password | grub_hash(salt=rhel9cis_bootloader_salt)) }}{% else %}{{ rhel9cis_bootloader_password_hash }}{% endif %}" # noqa template-instead-of-copy rhel9_compiled_bootloader_password: "{% if rhel9cis_bootloader_salt != '' %}{{ (rhel9cis_bootloader_password | grub_hash(salt=rhel9cis_bootloader_salt)) }}{% else %}{{ rhel9cis_bootloader_password_hash }}{% endif %}" # noqa template-instead-of-copy
# Used to control warning summary # Used to control warning summary
warn_control_list: "" warn_control_list: ""