mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
updated for readthedocs
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
e764ef55d5
commit
acdb56a277
1 changed files with 6 additions and 51 deletions
57
README.md
57
README.md
|
|
@ -21,7 +21,7 @@ On our [Discord Server](https://discord.io/ansible-lockdown) to ask questions, d
|
|||
|
||||
## Caution(s)
|
||||
|
||||
This role **will make changes to the system** which may have unintended concequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.
|
||||
This role **will make changes to the system** which may have unintended concequences.
|
||||
|
||||
This role was developed against a clean install of the Operating System. If you are implimenting to an existing system please review this role for any site specific changes that are needed.
|
||||
|
||||
|
|
@ -29,23 +29,11 @@ To use release version please point to main branch
|
|||
|
||||
## Documentation
|
||||
|
||||
- [Readthedocs](https://ansible-lockdown.readthedocs.io/en/latest/)
|
||||
- [Getting Started](https://www.lockdownenterprise.com/docs/getting-started-with-lockdown)
|
||||
- [Customizing Roles](https://www.lockdownenterprise.com/docs/customizing-lockdown-enterprise)
|
||||
- [Per-Host Configuration](https://www.lockdownenterprise.com/docs/per-host-lockdown-enterprise-configuration)
|
||||
- [Getting the Most Out of the Role](https://www.lockdownenterprise.com/docs/get-the-most-out-of-lockdown-enterprise)
|
||||
- [Wiki](https://github.com/ansible-lockdown/RHEL9-CIS/wiki)
|
||||
- [Repo GitHub Page](https://ansible-lockdown.github.io/RHEL9-CIS/)
|
||||
|
||||
## Auditing (new)
|
||||
|
||||
This can be turned on or off within the defaults/main.yml file with the variable rhel9cis_run_audit. The value is false by default, please refer to the wiki for more details.
|
||||
|
||||
This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.
|
||||
|
||||
A new form of auditing has been develeoped, by using a small (12MB) go binary called [goss](https://github.com/aelsabbahy/goss) along with the relevant configurations to check. Without the need for infrastructure or other tooling.
|
||||
This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove [false positives](https://www.mindpointgroup.com/blog/is-compliance-scanning-still-relevant/) in the process.
|
||||
|
||||
Refer to [RHEL9-CIS-Audit](https://github.com/ansible-lockdown/RHEL9-CIS-Audit).
|
||||
|
||||
## Requirements
|
||||
|
||||
|
|
@ -62,8 +50,10 @@ Rocky 9
|
|||
- [Ansible Getting Started](https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html)
|
||||
- [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html)
|
||||
- [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html)
|
||||
|
||||
- Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.
|
||||
- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file or the [Main Variables Wiki Page](https://github.com/ansible-lockdown/RHEL9-CIS/wiki/Main-Variables).
|
||||
- Please read through the tasks in this role to gain an understanding of what each control is doing.
|
||||
- Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file
|
||||
|
||||
## Dependencies
|
||||
|
||||
|
|
@ -71,6 +61,7 @@ Rocky 9
|
|||
- Ansible 2.9+
|
||||
- python-def (should be included in RHEL 9)
|
||||
- libselinux-python
|
||||
- jmespath
|
||||
|
||||
## Role Variables
|
||||
|
||||
|
|
@ -92,39 +83,3 @@ Below is an example of the tag section from a control within this role. Using th
|
|||
- patch
|
||||
- rule_2.2.4
|
||||
```
|
||||
|
||||
## Example Audit Summary
|
||||
|
||||
This is based on a vagrant image with selections enabled. e.g. No Gui or firewall.
|
||||
Note: More tests are run during audit as we check config and running state.
|
||||
|
||||
```txt
|
||||
|
||||
ok: [default] => {
|
||||
"msg": [
|
||||
"The pre remediation results are: ['Total Duration: 5.454s', 'Count: 338, Failed: 47, Skipped: 5'].",
|
||||
"The post remediation results are: ['Total Duration: 5.007s', 'Count: 338, Failed: 46, Skipped: 5'].",
|
||||
"Full breakdown can be found in /var/tmp",
|
||||
""
|
||||
]
|
||||
}
|
||||
|
||||
PLAY RECAP *******************************************************************************************************************************************
|
||||
default : ok=270 changed=23 unreachable=0 failed=0 skipped=140 rescued=0 ignored=0
|
||||
```
|
||||
|
||||
## Branches
|
||||
|
||||
- devel - This is the default branch and the working development branch. Community pull requests will pull into this branch
|
||||
- main - This is the release branch
|
||||
- reports - This is a protected branch for our scoring reports, no code should ever go here
|
||||
- all other branches** - Individual community member branches
|
||||
|
||||
## Community Contribution
|
||||
|
||||
We encourage you (the community) to contribute to this role. Please read the rules below.
|
||||
|
||||
- Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge.
|
||||
- All community Pull Requests are pulled into the devel branch
|
||||
- Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved
|
||||
- Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue