ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

updated controls

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-04-01 15:26:13 +01:00
parent 19a218390d
commit f0c4701dbd
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
23 changed files with 238 additions and 364 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tasks/section_3/cis_3.2.x.yml
View file

@ -17,7 +17,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.2.1
- rhel9cis_rule_3_2_1
tags:
- level1-server
- level1-workstation
@ -42,7 +42,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.2.2
- rhel9cis_rule_3_2_2
tags:
- level1-server
- level1-workstation

18
tasks/section_3/cis_3.3.x.yml
View file

@ -17,7 +17,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.3.1
- rhel9cis_rule_3_3_1
tags:
- level1-server
- level1-workstation
@ -42,7 +42,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.3.2
- rhel9cis_rule_3_3_2
tags:
- level1-server
- level1-workstation
@ -55,7 +55,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.3
- rhel9cis_rule_3_3_3
tags:
- level1-server
- level1-workstation
@ -68,7 +68,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.4
- rhel9cis_rule_3_3_4
tags:
- level1-server
- level1-workstation
@ -81,7 +81,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.5
- rhel9cis_rule_3_3_5
tags:
- level1-server
- level1-workstation
@ -94,7 +94,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.6
- rhel9cis_rule_3_3_6
tags:
- level1-server
- level1-workstation
@ -107,7 +107,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.7
- rhel9cis_rule_3_3_7
tags:
- level1-server
- level1-workstation
@ -120,7 +120,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.8
- rhel9cis_rule_3_3_8
tags:
- level1-server
- level1-workstation
@ -146,7 +146,7 @@
when: rhel9cis_ipv6_required
when:
- rhel9cis_ipv6_required
- rhel9cis_rule_3.3.9
- rhel9cis_rule_3_3_9
tags:
- level2-server
- level2-workstation

1
tasks/section_3/cis_3.4.1.x.yml
View file

@ -22,7 +22,6 @@
- name: "3.4.1.2 | PATCH | Ensure iptables-services not installed with firewalld | Stop running services"
systemd:
name: "{{ item }}"
enabled: false
masked: true
with_items:
- iptables

36
tasks/section_3/main.yml
View file

@ -1,41 +1,35 @@
---
- name: "SECTION | 3.1.x | Packet and IP redirection"
- name: "SECTION | 3.1.x | Disable unused network protocols and devices"
import_tasks: cis_3.1.x.yml
- name: "SECTION | 3.2.x | Network Parameters (Host Only)"
import_tasks: cis_3.2.x.yml
- name: "SECTION | 3.3.x | Uncommon Network Protocols"
- name: "SECTION | 3.3.x | Network Parameters (host and Router)"
import_tasks: cis_3.3.x.yml
- name: "SECTION | 3.4.1.x | firewall defined"
import_tasks: cis_3.4.1.1.yml
- name: "SECTION | 3.4.2.x | firewalld firewall"
include_tasks: cis_3.4.2.x.yml
- name: "SECTION | 3.4.1.x | Configure firewalld"
import_tasks: cis_3.4.1.x.yml
when:
- rhel9cis_firewall == "firewalld"
- name: "SECTION | 3.4.3.x | Configure nftables firewall"
include_tasks: cis_3.4.3.x.yml
- name: "SECTION | 3.4.2.x | Configure nftables"
include_tasks: cis_3.4.2.x.yml
when:
- rhel9cis_firewall == "nftables"
- name: "SECTION | 3.4.4.1.x | Configure iptables IPv4"
include_tasks: cis_3.4.4.1.x.yml
- name: "SECTION | 3.4.3.1.x | Configure iptables"
include_tasks: cis_3.4.3.1.x.yml
when:
- rhel9cis_firewall == "iptables"
- name: "SECTION | 3.4.4.2.x | Configure iptables IPv6"
include_tasks: cis_3.4.4.2.x.yml
- name: "SECTION | 3.4.3.2.x | Configure iptables IPv4"
include_tasks: cis_3.4.3.2.x.yml
when:
- rhel9cis_firewall == "iptables"
- name: "SECTION | 3.4.3.3.x | Configure iptables IPv6"
include_tasks: cis_3.4.3.3.x.yml
when:
- ( rhel9cis_firewall == "iptables" and rhel9cis_ipv6_required )
- name: "SECTION | 3.5 | Configure wireless"
import_tasks: cis_3.5.yml
- name: "SECTION | 3.5 | disable IPv6"
include_tasks: cis_3.5.yml
when:
- not rhel9cis_ipv6_required