tidy up sysctl templates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_3/cis_3.1.x.yml

@@ -4,7 +4,7 @@
 # We are using the rhel9cis_ipv6_required to specify if you have IPv6 in use
 - name: "3.1.1 | PATCH | Verify if IPv6 is enabled on the system"
   debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf"
       notify: 
           - update sysctl
           - sysctl flush ipv6 route table
@@ -21,12 +21,14 @@
       - rule_3.1.1
 
 - name: "3.1.2 | PATCH | Ensure SCTP is disabled"
-  lineinfile:
-      dest: /etc/modprobe.d/CIS.conf
-      regexp: "^(#)?install sctp(\\s|$)"
-      line: "install sctp /bin/true"
-      create: yes
-      mode: 0600
+  template:
+      src: "/etc/modprobe.d/modprobe.conf.j2"
+      dest: "/etc/modprobe.d/{{ item }}.conf"
+      mode: "0600"
+      owner: root
+      group: root
+  with_items:
+      - sctp
   when:
       - rhel9cis_rule_3_1_2
   tags:
@@ -38,12 +40,14 @@
       - rule_3.1.2
 
 - name: "3.1.3 | PATCH | Ensure DCCP is disabled"
-  lineinfile:
-      dest: /etc/modprobe.d/CIS.conf
-      regexp: "^(#)?install dccp(\\s|$)"
-      line: "install dccp /bin/true"
-      create: yes
-      mode: 0600
+  template:
+      src: "/etc/modprobe.d/modprobe.conf.j2"
+      dest: "/etc/modprobe.d/{{ item }}.conf"
+      mode: "0600"
+      owner: root
+      group: root
+  with_items:
+      - dccp
   when:
       - rhel9cis_rule_3_1_3
   tags:

tasks/section_3/cis_3.2.x.yml

@@ -3,22 +3,18 @@
 - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
   block:
       - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
-        sysctl:
-            name: net.ipv4.ip_forward
-            value: '0'
-            state: present
-            reload: yes
-            ignoreerrors: yes
-        notify: sysctl flush ipv4 route table
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
+        notify: 
+            - update sysctl
+            - sysctl flush ipv4 route table
 
       - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
-        sysctl:
-            name: net.ipv6.conf.all.forwarding
-            value: '0'
-            state: present
-            reload: yes
-            ignoreerrors: yes
-        notify: sysctl flush ipv6 route table
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
+        notify:
+            - update sysctl
+            - sysctl flush ipv6 route table
         when: rhel9cis_ipv6_required
   when:
       - not rhel9cis_is_router
@@ -32,17 +28,11 @@
       - rule_3.2.1
 
 - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
-  sysctl:
-      name: '{{ item.name }}'
-      value: '{{ item.value }}'
-      sysctl_set: yes
-      state: present
-      reload: yes
-      ignoreerrors: yes
-  notify: sysctl flush ipv4 route table
-  with_items:
-      - { name: net.ipv4.conf.all.send_redirects, value: 0 }
-      - { name: net.ipv4.conf.default.send_redirects, value: 0 }
+  debug:
+      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
+  notify:
+      - update sysctl
+      - sysctl flush ipv4 route table
   when:
       - not rhel9cis_is_router
       - rhel9cis_rule_3_2_2

tasks/section_3/cis_3.3.x.yml

@@ -4,14 +4,14 @@
   block:
       - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
         notify: 
             - update sysctl
             - sysctl flush ipv4 route table
 
       - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
         notify:
             - sysctl flush ipv6 route table
             - update sysctl
@@ -29,14 +29,14 @@
   block:
       - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
         notify: 
             - update sysctl
             - sysctl flush ipv4 route table
 
       - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
         notify:
             - sysctl flush ipv6 route table
             - update sysctl
@@ -52,7 +52,7 @@
 
 - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_3
@@ -65,7 +65,7 @@
 
 - name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_4
@@ -78,7 +78,7 @@
 
 - name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_5
@@ -91,7 +91,7 @@
 
 - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_6
@@ -104,7 +104,7 @@
 
 - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_7
@@ -117,7 +117,7 @@
 
 - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
   debug:
-    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+    msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   notify: update sysctl
   when:
       - rhel9cis_rule_3_3_8
@@ -132,14 +132,14 @@
   block:
       - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
         notify: 
             - update sysctl
             - sysctl flush ipv4 route table
 
       - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
         debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl"
         notify:
             - sysctl flush ipv6 route table
             - update sysctl

templates/etc/sysctl.d/60-netipv4_sysctl.conf.j2

@@ -1,12 +1,9 @@
 # Setting added via ansible CIS remediation playbook
 
-# Network sysctl
+# IPv4 Network sysctl
 {% if rhel9cis_rule_3_2_1 %}
 # CIS 3.2.1
 net.ipv4.ip_forward = 0
-{% if rhel9cis_rule_3_2_1 and rhel9cis_ipv6_required %}
-net.ipv6.conf.all.forwarding = 0
-{% endif %}
 {% endif %}
 {% if rhel9cis_rule_3_2_2 %}
 # CIS 3.2.2
@@ -17,19 +14,11 @@ net.ipv4.conf.default.send_redirects = 0
 # CIS 3.3.1
 net.ipv4.conf.all.accept_source_route = 0
 net.ipv4.conf.default.accept_source_route = 0
-{% if rhel9cis_rule_3_3_1 and rhel9cis_ipv6_required %}
-net.ipv6.conf.all.accept_source_route = 0
-net.ipv6.conf.default.accept_source_route = 0
-{% endif %}
 {% endif %}
 {% if rhel9cis_rule_3_3_2 %}
 # CIS 3.3.2
 net.ipv4.conf.all.accept_redirects = 0
 net.ipv4.conf.default.accept_redirects = 0
-{% if rhel9cis_rule_3_3_2 and rhel9cis_ipv6_required %}
-net.ipv6.conf.all.accept_redirects = 0
-net.ipv6.conf.default.accept_redirects = 0
-{% endif %}
 {% endif %}
 {% if rhel9cis_rule_3_3_3 %}
 # CIS 3.3.3
@@ -57,8 +46,3 @@ net.ipv4.conf.default.rp_filter = 1
 # CIS 3.3.8
 net.ipv4.tcp_syncookies = 1
 {% endif %}
-{% if rhel9cis_rule_3_3_9 %}
-# CIS 3.3.9
-net.ipv6.conf.all.accept_ra = 0
-net.ipv6.conf.default.accept_ra = 0
-{% endif %}

templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2

@@ -0,0 +1,21 @@
+# Setting added via ansible CIS remediation playbook
+
+# IPv6 Network sysctl
+{% if rhel9cis_ipv6_required %}
+{% if rhel9cis_rule_3_2_1 %}
+net.ipv6.conf.all.forwarding = 0
+{% endif %}
+{% if rhel9cis_rule_3_3_1 %}
+net.ipv6.conf.all.accept_source_route = 0
+net.ipv6.conf.default.accept_source_route = 0
+{% endif %}
+{% if rhel9cis_rule_3_3_2 %}
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+{% endif %}
+{% if rhel9cis_rule_3_3_9 %}
+# CIS 3.3.9
+net.ipv6.conf.all.accept_ra = 0
+net.ipv6.conf.default.accept_ra = 0
+{% endif %}
+{% endif %}