mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
updated for readthedocs
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
e764ef55d5
commit
acdb56a277
1 changed files with 6 additions and 51 deletions
57
README.md
57
README.md
|
|
@ -21,7 +21,7 @@ On our [Discord Server](https://discord.io/ansible-lockdown) to ask questions, d
|
||||||
|
|
||||||
## Caution(s)
|
## Caution(s)
|
||||||
|
|
||||||
This role **will make changes to the system** which may have unintended concequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.
|
This role **will make changes to the system** which may have unintended concequences.
|
||||||
|
|
||||||
This role was developed against a clean install of the Operating System. If you are implimenting to an existing system please review this role for any site specific changes that are needed.
|
This role was developed against a clean install of the Operating System. If you are implimenting to an existing system please review this role for any site specific changes that are needed.
|
||||||
|
|
||||||
|
|
@ -29,23 +29,11 @@ To use release version please point to main branch
|
||||||
|
|
||||||
## Documentation
|
## Documentation
|
||||||
|
|
||||||
|
- [Readthedocs](https://ansible-lockdown.readthedocs.io/en/latest/)
|
||||||
- [Getting Started](https://www.lockdownenterprise.com/docs/getting-started-with-lockdown)
|
- [Getting Started](https://www.lockdownenterprise.com/docs/getting-started-with-lockdown)
|
||||||
- [Customizing Roles](https://www.lockdownenterprise.com/docs/customizing-lockdown-enterprise)
|
- [Customizing Roles](https://www.lockdownenterprise.com/docs/customizing-lockdown-enterprise)
|
||||||
- [Per-Host Configuration](https://www.lockdownenterprise.com/docs/per-host-lockdown-enterprise-configuration)
|
- [Per-Host Configuration](https://www.lockdownenterprise.com/docs/per-host-lockdown-enterprise-configuration)
|
||||||
- [Getting the Most Out of the Role](https://www.lockdownenterprise.com/docs/get-the-most-out-of-lockdown-enterprise)
|
- [Getting the Most Out of the Role](https://www.lockdownenterprise.com/docs/get-the-most-out-of-lockdown-enterprise)
|
||||||
- [Wiki](https://github.com/ansible-lockdown/RHEL9-CIS/wiki)
|
|
||||||
- [Repo GitHub Page](https://ansible-lockdown.github.io/RHEL9-CIS/)
|
|
||||||
|
|
||||||
## Auditing (new)
|
|
||||||
|
|
||||||
This can be turned on or off within the defaults/main.yml file with the variable rhel9cis_run_audit. The value is false by default, please refer to the wiki for more details.
|
|
||||||
|
|
||||||
This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.
|
|
||||||
|
|
||||||
A new form of auditing has been develeoped, by using a small (12MB) go binary called [goss](https://github.com/aelsabbahy/goss) along with the relevant configurations to check. Without the need for infrastructure or other tooling.
|
|
||||||
This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove [false positives](https://www.mindpointgroup.com/blog/is-compliance-scanning-still-relevant/) in the process.
|
|
||||||
|
|
||||||
Refer to [RHEL9-CIS-Audit](https://github.com/ansible-lockdown/RHEL9-CIS-Audit).
|
|
||||||
|
|
||||||
## Requirements
|
## Requirements
|
||||||
|
|
||||||
|
|
@ -62,8 +50,10 @@ Rocky 9
|
||||||
- [Ansible Getting Started](https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html)
|
- [Ansible Getting Started](https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html)
|
||||||
- [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html)
|
- [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html)
|
||||||
- [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html)
|
- [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html)
|
||||||
|
|
||||||
- Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.
|
- Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.
|
||||||
- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file or the [Main Variables Wiki Page](https://github.com/ansible-lockdown/RHEL9-CIS/wiki/Main-Variables).
|
- Please read through the tasks in this role to gain an understanding of what each control is doing.
|
||||||
|
- Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file
|
||||||
|
|
||||||
## Dependencies
|
## Dependencies
|
||||||
|
|
||||||
|
|
@ -71,6 +61,7 @@ Rocky 9
|
||||||
- Ansible 2.9+
|
- Ansible 2.9+
|
||||||
- python-def (should be included in RHEL 9)
|
- python-def (should be included in RHEL 9)
|
||||||
- libselinux-python
|
- libselinux-python
|
||||||
|
- jmespath
|
||||||
|
|
||||||
## Role Variables
|
## Role Variables
|
||||||
|
|
||||||
|
|
@ -92,39 +83,3 @@ Below is an example of the tag section from a control within this role. Using th
|
||||||
- patch
|
- patch
|
||||||
- rule_2.2.4
|
- rule_2.2.4
|
||||||
```
|
```
|
||||||
|
|
||||||
## Example Audit Summary
|
|
||||||
|
|
||||||
This is based on a vagrant image with selections enabled. e.g. No Gui or firewall.
|
|
||||||
Note: More tests are run during audit as we check config and running state.
|
|
||||||
|
|
||||||
```txt
|
|
||||||
|
|
||||||
ok: [default] => {
|
|
||||||
"msg": [
|
|
||||||
"The pre remediation results are: ['Total Duration: 5.454s', 'Count: 338, Failed: 47, Skipped: 5'].",
|
|
||||||
"The post remediation results are: ['Total Duration: 5.007s', 'Count: 338, Failed: 46, Skipped: 5'].",
|
|
||||||
"Full breakdown can be found in /var/tmp",
|
|
||||||
""
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
PLAY RECAP *******************************************************************************************************************************************
|
|
||||||
default : ok=270 changed=23 unreachable=0 failed=0 skipped=140 rescued=0 ignored=0
|
|
||||||
```
|
|
||||||
|
|
||||||
## Branches
|
|
||||||
|
|
||||||
- devel - This is the default branch and the working development branch. Community pull requests will pull into this branch
|
|
||||||
- main - This is the release branch
|
|
||||||
- reports - This is a protected branch for our scoring reports, no code should ever go here
|
|
||||||
- all other branches** - Individual community member branches
|
|
||||||
|
|
||||||
## Community Contribution
|
|
||||||
|
|
||||||
We encourage you (the community) to contribute to this role. Please read the rules below.
|
|
||||||
|
|
||||||
- Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge.
|
|
||||||
- All community Pull Requests are pulled into the devel branch
|
|
||||||
- Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved
|
|
||||||
- Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue