ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
692 commits 5 branches 14 tags 2.6 MiB
Commit graph

327 commits

Author SHA1 Message Date
John Foster
7fde313f85
Main task was failing when using an AD account to connect to host. 
With an AD account there isn't an entry in the /etc/shadow file. This
caused the password length check to treat it as a zero length password.
Now local password check is skipped for AD account.
Also added an additional check for a locked local account for the sudo
user.

Signed-off-by: John Foster <robopickle@proton.me>
 2024-02-13 15:37:39 +00:00
uk-bolly
b726c2e444
Merge pull request #154 from jLemmings/patch-3 
Remove trailing comma to align with other roles
 2024-01-26 12:44:07 +00:00
uk-bolly
902956e51d
Merge pull request #151 from sickbock/devel 
Corrections to tags and a variable
 2024-01-26 12:37:20 +00:00
uk-bolly
df1aef8d31
Merge pull request #148 from siemens/siemens/feat/AuditVarsRefactoring 
Siemens/feat/audit vars refactoring
 2024-01-26 12:34:30 +00:00
uk-bolly
ac5eee81df
Merge pull request #112 from siemens/siemens/feat/ensure_default_umask_027_5_6_5 
Adding new entry in /etc/pam.d/system-auth
 2024-01-26 12:32:45 +00:00
uk-bolly
068c45f509
Merge pull request #105 from siemens/siemens/feat/reverse_path_filtering_3_3_7 
Adding missing lines to usr: sysctl.d/50-default.conf
 2024-01-18 13:15:28 +00:00
Joshua Hemmings
87d2685f4e
Update cis_1.1.7.x.yml 
Signed-off-by: Joshua Hemmings <josh@hemmings.ch>
 2024-01-10 16:11:27 +01:00
Joshua Hemmings
d73f26a7ab
Remove trailing comma to align with other roles 
Signed-off-by: Joshua Hemmings <josh@hemmings.ch>
 2024-01-09 09:17:00 +01:00
Joachim la Poutré
e0491ccb8f
Update cis_6.2.x.yml 
Corrected tag: rule_6.2.3

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:20:08 +01:00
Joachim la Poutré
d6b44aac70
Update cis_6.1.x.yml 
Corrected tags: rule_6.1.8 & rule_6.1.12

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:18:52 +01:00
Joachim la Poutré
3b256ff831
Update cis_5.6.1.x.yml 
Corrected tag: rule_5.6.1.5

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:16:20 +01:00
Joachim la Poutré
712b8b6ecd
Update cis_5.6.1.x.yml 
Corrected tag: rule_5.6.1.1

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:15:11 +01:00
Joachim la Poutré
4d749d988d
Update cis_1.8.x.yml 
Corrected tag rule_1.8.10

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:13:32 +01:00
Joachim la Poutré
1e55d86001
Update cis_1.3.x.yml 
Correction to "when":  1_3_3

Signed-off-by: Joachim la Poutré <14360383+sickbock@users.noreply.github.com>
 2024-01-03 11:12:06 +01:00
uk-bolly
6f8a95c73a
Merge pull request #143 from siemens/siemens/feat/4.2.1.3conditionalAndSectionHeader 
Siemens/feat/4.2.1.3conditional and section header
 2023-12-21 08:40:41 +00:00
uk-bolly
e545b89c7b
Merge pull request #145 from siemens/siemens/feat/5.4.2_addVarUsage 
Using rhel9cis_authselect['options'], otherwise not used at all
 2023-12-21 08:39:48 +00:00
Ionut Pruteanu
ca41b128cd
Defining some threshold for (audit_)space_left vars, as well as a bool which governs if extra params will be configured 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-20 22:21:14 +02:00
Ionut Pruteanu
88ffe32137
Storing max_log_file under rhel9cis_auditd dict variable. 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-20 21:58:49 +02:00
Corey Reid
8d85f178e2
find hidden files in /var/log for 4.3.2 
Signed-off-by: Corey Reid <corey.nathan.reid@gmail.com>
 2023-12-17 17:36:34 +00:00
uk-bolly
c56ea1ac9a
Merge pull request #140 from siemens/siemens/feat/3.4.2.5_fixConditional 
3.4.2.5 conditional fix
 2023-12-13 08:44:08 +00:00
uk-bolly
82d1c2bdfb
Merge pull request #138 from siemens/siemens/feat/2.3.4_fixConditional 
Using correct conditional for ftpd
 2023-12-13 08:43:07 +00:00
uk-bolly
779c90ea0e
Merge pull request #136 from siemens/siemens/feat/2.2.16_fixingNFSLogicBetweenMaskingServiceVsRemovingPackage 
Masking service when server package is needed
 2023-12-13 08:42:33 +00:00
uk-bolly
ecbd514df1
Merge pull request #129 from siemens/siemens/feat/removingRedundantConditionals 
Removing redundant conditional statements
 2023-12-13 08:27:49 +00:00
Ionut Pruteanu
c19e350b7d
Using rhel9cis_authselect['options'], otherwise not used at all 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-08 16:44:30 +02:00
Ionut Pruteanu
e0de491263
whole section defined in cis_4.2.1.x.yml gets executed only when: rhel9cis_syslog == 'rsyslog', having same condition is redundant and may confuse users. 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-08 12:03:00 +02:00
Ionut Pruteanu
d79bba53c6
Rsyslog subsection corrected header(was using 4.2 logging name, instead of 4.2.1. rsyslog name) 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-08 12:01:10 +02:00
Ionut Pruteanu
81fd98e2c6
Using correct conditional for Task relying on 'firewall-cmd --get-active-zones' cmd 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-07 20:38:20 +02:00
Ionut Pruteanu
cd04537bf1
Using correct conditional for ftpd 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-07 18:58:02 +02:00
Ionut Pruteanu
9d988b483f
Masking service when server package is needed 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-07 18:10:09 +02:00
Ionut Pruteanu
72b503bf46
Removing redundant conditional statements 
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
 2023-12-05 14:42:51 +02:00
Senih
cce2b25d80
Update cis_5.6.1.x.yml 
Typo fixed from:
- rule_5.5.1.3
to:
- rule_5.6.1.3

Signed-off-by: Senih <40578755+senihucar@users.noreply.github.com>
 2023-11-23 12:02:37 -08:00
Mark Bolwell
23a4386e95
addition of audit_only config 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-11-21 09:49:36 +00:00
Mark Bolwell
8784941179
audit variables seperated 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-11-21 09:48:49 +00:00
root@DERVISHx
c6a51ad38a
Adding new entry in /etc/pam.d/system-auth 
Signed-off-by: root@DERVISHx <nuno.carvalho@siemens.com>
 2023-11-10 15:28:12 +00:00
Bernd Grobauer
646b4decc1
Adding missing lines to sysctl.d/50-default.conf 
Signed-off-by: Bernd Grobauer <bernd.grobauer@siemens.com>
 2023-10-12 12:56:20 +02:00
Mark Bolwell
729fac3580
updated 5.6.5 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-22 08:44:43 +01:00
Mark Bolwell
e82b2cefac
quoted file mode 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 16:25:59 +01:00
Mark Bolwell
11071a66ab
added pragma allowed 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 15:36:05 +01:00
Mark Bolwell
580ee762ee
fix filename 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 15:35:35 +01:00
Mark Bolwell
e5d17f74ca
import_tasks file added 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 15:08:37 +01:00
Mark Bolwell
c5ed197e03
import_tasks file added 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 15:07:52 +01:00
Mark Bolwell
af20f70f24
updated test 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 14:57:25 +01:00
Mark Bolwell
a67a484971
import_tasks file added 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 14:55:55 +01:00
Mark Bolwell
e202d4bd68
lint updates 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-21 14:55:00 +01:00
Mark Bolwell
d64414ce9b
updated test and control 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-18 09:51:56 +01:00
Mark Bolwell
43a339c74f
new var rhel9cis_rhel_default_repo 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-07 14:23:12 +01:00
Mark Bolwell
04cb2e0f1d
#54 merged into new layout 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-09-06 08:44:23 +01:00
Mark Bolwell
73cf599e48
removed quotes not required 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-08-10 08:28:43 +01:00
Mark Bolwell
dadeeab2c7
updated comment on rule 1.2.1 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-08-09 11:47:54 +01:00
Mark Bolwell
009c9fc498
updated audit vars naming, AMD & ARM binaries 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
 2023-07-28 15:16:50 +01:00