ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

update tags and issue #311 thanks to @rilatu

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2025-04-15 12:51:42 +01:00
parent 4aeac7e662
commit ce43c573ee
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
1 changed files with 27 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

46
tasks/section_5/cis_5.1.x.yml
View file

@ -6,7 +6,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- permissions - permissions
- rule_5.1.1 - rule_5.1.1
- NIST800-53R5_AC-3 - NIST800-53R5_AC-3
@ -23,7 +23,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- permissions - permissions
- rule_5.1.2 - rule_5.1.2
- NIST800-53R5_AC-3 - NIST800-53R5_AC-3
@ -53,7 +53,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.3 - rule_5.1.3
- NIST800-53R5_AC-3 - NIST800-53R5_AC-3
- NIST800-53R5_MP-2 - NIST800-53R5_MP-2
@ -166,7 +166,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.7 - rule_5.1.7
- NIST800-53R5_AC-3 - NIST800-53R5_AC-3
- NIST800-53R5_MP-2 - NIST800-53R5_MP-2
@ -195,6 +195,8 @@
path: "{{ rhel9cis_sshd_config_file }}" path: "{{ rhel9cis_sshd_config_file }}"
regexp: "^DenyUsers" regexp: "^DenyUsers"
line: "DenyUsers {{ rhel9cis_sshd_denyusers }}" line: "DenyUsers {{ rhel9cis_sshd_denyusers }}"
insertbefore: "^Match"
firstmatch: true
validate: sshd -t -f %s validate: sshd -t -f %s
notify: Restart sshd notify: Restart sshd
@ -213,7 +215,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.8 - rule_5.1.8
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -231,7 +233,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.9 - rule_5.1.9
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -261,7 +263,7 @@
- level2-server - level2-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.10 - rule_5.1.10
- NIST800-53R5_CM-7 - NIST800-53R5_CM-7
block: block:
@ -287,7 +289,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- sshs - sshd
- rule_5.1.11 - rule_5.1.11
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -317,7 +319,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.12 - rule_5.1.12
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -337,7 +339,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.13 - rule_5.1.13
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -348,6 +350,8 @@
path: "{{ rhel9cis_sshd_config_file }}" path: "{{ rhel9cis_sshd_config_file }}"
regexp: ^(?i)(#|)\s*IgnoreRhosts regexp: ^(?i)(#|)\s*IgnoreRhosts
line: 'IgnoreRhosts yes' line: 'IgnoreRhosts yes'
insertbefore: "^Match"
firstmatch: true
validate: sshd -t -f %s validate: sshd -t -f %s
notify: Restart sshd notify: Restart sshd
@ -357,13 +361,15 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.14 - rule_5.1.14
- NIST800-53R5_CM-6 - NIST800-53R5_CM-6
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: "{{ rhel9cis_sshd_config_file }}" path: "{{ rhel9cis_sshd_config_file }}"
regexp: ^(?i)(#|)\s*LoginGraceTime regexp: ^(?i)(#|)\s*LoginGraceTime
line: "LoginGraceTime {{ rhel9cis_sshd_logingracetime }}" line: "LoginGraceTime {{ rhel9cis_sshd_logingracetime }}"
insertbefore: "^Match"
firstmatch: true
validate: sshd -t -f %s validate: sshd -t -f %s
notify: Restart sshd notify: Restart sshd
@ -373,7 +379,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- sshs - sshd
- rule_5.1.15 - rule_5.1.15
- NIST800-53R5_AU-3 - NIST800-53R5_AU-3
- NIST800-53R5_AU-12 - NIST800-53R5_AU-12
@ -382,6 +388,8 @@
path: "{{ rhel9cis_sshd_config_file }}" path: "{{ rhel9cis_sshd_config_file }}"
regexp: ^(?i)(#|)\s*LogLevel regexp: ^(?i)(#|)\s*LogLevel
line: 'LogLevel {{ rhel9cis_ssh_loglevel }}' line: 'LogLevel {{ rhel9cis_ssh_loglevel }}'
insertbefore: "^Match"
firstmatch: true
validate: sshd -t -f %s validate: sshd -t -f %s
notify: Restart sshd notify: Restart sshd
@ -391,7 +399,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.16 - rule_5.1.16
- NIST800-53R5_AU-3 - NIST800-53R5_AU-3
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
@ -407,7 +415,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.17 - rule_5.1.17
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -427,7 +435,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.18 - rule_5.1.18
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -447,7 +455,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.19 - rule_5.1.19
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -467,7 +475,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.20 - rule_5.1.20
- NIST800-53R5_AC-6 - NIST800-53R5_AC-6
block: block:
@ -491,7 +499,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.21 - rule_5.1.21
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2
@ -511,7 +519,7 @@
- level1-server - level1-server
- level1-workstation - level1-workstation
- patch - patch
- ssh - sshd
- rule_5.1.22 - rule_5.1.22
- NIST800-53R5_CM-1 - NIST800-53R5_CM-1
- NIST800-53R5_CM-2 - NIST800-53R5_CM-2