Commit graph

373 commits

Author SHA1 Message Date
Mark Bolwell
a36a84c5ea
lint and v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 14:02:05 +01:00
Mark Bolwell
42aa624d50
updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 14:01:40 +01:00
Mark Bolwell
06a1f2997c
section 7 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 14:01:10 +01:00
Mark Bolwell
9755b0fb62
section 5 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 14:00:45 +01:00
Mark Bolwell
f1c4d96412
lint updates
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 14:00:00 +01:00
Mark Bolwell
aa0f4d0f6d
section4 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-24 13:57:29 +01:00
Mark Bolwell
a53569a474
section 2 v2.0.0 update
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-22 12:43:35 +01:00
Mark Bolwell
bad08c0228
section2 v2.0.0 updates
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-22 12:43:08 +01:00
Mark Bolwell
2bf67cde0d
Added Nist values
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-22 12:42:39 +01:00
Mark Bolwell
8b58d71e4b
section1 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-19 17:01:23 +01:00
Mark Bolwell
54e4ee1588
update audit output and remove jmespath
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-11 17:02:38 +01:00
Mark Bolwell
7dcb2cae1c
removed jmespath dependancy
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-11 16:57:45 +01:00
Mark Bolwell
a946ec6534
issue #216 addressed thanks to tedunder237
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-11 16:06:26 +01:00
Mark Bolwell
611b9ce0b9
issue #217 addressed thanks to tedunder237
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-07-11 16:05:40 +01:00
Mark Bolwell
06e96ba769
improvements
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 23:57:18 +01:00
Mark Bolwell
49296c34a2
tidy up spacing
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 17:11:17 +01:00
Mark Bolwell
20e2986406
capture only configuratoin lines from rsyslog
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 17:10:22 +01:00
Mark Bolwell
5595097e78
Allowed force for command 5.4.2
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 09:52:51 +01:00
Mark Bolwell
60a9000dda
Address #191
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 09:46:14 +01:00
Mark Bolwell
bd7c4e3da2
improved tests based upon #190 thanks to @ipruteanu-sie
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 08:01:17 +01:00
Mark Bolwell
b279a9fb80
Added /dev/null to exclude in prelim check shell
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-05 08:00:02 +01:00
Mark Bolwell
21e0bc8387
added PR details #193 thanks to @brakkio86
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-06-04 17:53:12 +01:00
Svennd
2c09971cc2
2.4 : socket vs sockets
This looks for all active sockets, but the command is singular

Signed-off-by: Svennd <svenn.dhert@uantwerpen.be>
2024-05-22 10:28:56 +02:00
uk-bolly
79e36d8736
updated assert statement (#204)
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-04-29 16:40:53 +01:00
uk-bolly
f8fcfe0e78
April_24 updates (#201)
* Issue #170, PR #181 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* issue #182, PR #183 thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PR #180 thanks to @ipruteanu-sie and @raabf

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Addressed PR #165 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PT #184 addressed thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated credits

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* typo and ssh allow_deny comments

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* enable OS check

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PR - #198 addressed thanks to @brakkio86

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Addressed issue #190

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Additional vars for issue #190

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated pre-commit version

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* consistent quotes around mode

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* moved audit added discoveries

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* removed unneeded vars

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* audit moved to prelim

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* tidy up

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* improved new variable usage

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* fixed logic 6.2.10

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* addressed #197 thanks to @mark-tomich

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updates for audit section

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* fixed naming

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* added prelim to includes

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-04-15 14:02:07 +01:00
RoboPickle
6eeae19517
Address issues in 4.1.1.2 and 4.1.1.3 including idempotent status (#188)
* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Signed-off-by: John Foster <robopickle@proton.me>

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Removed debug messages

Signed-off-by: John Foster <robopickle@proton.me>

---------

Signed-off-by: John Foster <robopickle@proton.me>
2024-03-14 17:13:34 +00:00
uk-bolly
7d7b6132f4
March 24 to devel (#186)
* Issue #170, PR #181 thanks to @ipruteanu-sie

* issue #182, PR #183 thansk to @ipruteanu-sie

* PR #180 thanks to @ipruteanu-sie and @raabf

* Addressed PR #165 thanks to @ipruteanu-sie

* PT #184 addressed thansk to @ipruteanu-sie

* updated credits

* typo and ssh allow_deny comments

* enable OS check

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-03-06 16:52:38 +00:00
uk-bolly
0f58436212
Gpg import for rhel servers (#185)
* change logic thanks to @rjacobs1990 see #175

* 1.2.1 force gpg import rhel

* fix missing facts

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-03-06 09:10:06 +00:00
uk-bolly
40bc7aa082
Feb24 updates (#179)
* change logic thanks to @rjacobs1990 see #175

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* thanks to @ipruteani-sie #134

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Thanks to @stwongst #125

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* thanks to @sgomez86 #146

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Added updates from #115

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* removed rp_filter in post added in error

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated yamllint precommit

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated fqcn fo json_query

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* fix typo for virt type query

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
2024-02-20 15:43:43 +00:00
uk-bolly
06ec3de5c4
Merge pull request #175 from rjacobs1990/bugfix/fix-permissions-logfiles
fix: idempotency molecule issue fixed for logfiles #173
2024-02-19 14:16:21 +00:00
uk-bolly
96536cc908
Merge pull request #177 from RoboPickle/bugfix_5_3_4
Bugfix 5 3 4 against issue #176
2024-02-19 12:16:51 +00:00
John Foster
467434a56f
Added blank line between each named task for consistency.
Signed-off-by: John Foster <robopickle@proton.me>
2024-02-19 12:03:08 +00:00
uk-bolly
3313a1f2c3
Merge pull request #131 from siemens/siemens/feat/replacingVarAuditCopyPath
Replacing vars according to Audit needs
2024-02-19 11:53:01 +00:00
uk-bolly
03e2a28653
Merge pull request #174 from bbaassssiiee/bugfix/sshd
oscap scan found 2 issues in sshd configuration override files
2024-02-19 11:44:42 +00:00
uk-bolly
21f24b45a1
Merge pull request #169 from Illibur/patch-1
Update cis_6.1.x.yml
2024-02-19 11:37:29 +00:00
John Foster
e100b02f44
Updated cis_6.1.x.yml to avoid deprecation warning as per Illibur's
findings in issue #168. Changed vars on line 233 to use dictionary.

Signed-off-by: John Foster <robopickle@proton.me>
2024-02-16 15:06:27 +00:00
John Foster
0e89fedfca
Adjusted tasks/main.yml indentation after running precommit checks
Signed-off-by: John Foster <robopickle@proton.me>
2024-02-15 10:17:41 +00:00
John Foster
7fde313f85
Main task was failing when using an AD account to connect to host.
With an AD account there isn't an entry in the /etc/shadow file. This
caused the password length check to treat it as a zero length password.
Now local password check is skipped for AD account.
Also added an additional check for a locked local account for the sudo
user.

Signed-off-by: John Foster <robopickle@proton.me>
2024-02-13 15:37:39 +00:00
rjacobs1990
742165cd72
fix: more readable condition and prevent skipping 0600 #173
Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>
2024-02-12 16:21:31 +01:00
rjacobs1990
8652390beb
fix: idempotency molecule issue fixed for logfiles and prevent skipping 0600 #173
Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>
2024-02-12 15:55:42 +01:00
rjacobs1990
c805ee398b
fix: idempotency molecule issue fixed for logfiles #173
Signed-off-by: rjacobs1990 <ricardojacobs20@gmail.com>
2024-02-12 14:47:12 +01:00
Bas Meijer
cc7f9ccfd0
X11Forwarding found in /etc/ssh/sshd_config.d/50-redhat.conf
Signed-off-by: Bas Meijer <bas.meijer@me.com>
2024-02-10 00:43:17 +01:00
Bas Meijer
baf8987a5f
PermitRootLogin found in /etc/ssh/sshd_config.d/01-permitrootlogin.conf
Signed-off-by: Bas Meijer <bas.meijer@me.com>
2024-02-10 00:43:17 +01:00
Illibur
fcab25c61f
Update cis_6.1.x.yml
Fixed:
[DEPRECATION WARNING]: Specifying a list of dictionaries for vars is deprecated in favor of specifying a dictionary. This feature will be removed in version 2.18.

Signed-off-by: Illibur <72218972+Illibur@users.noreply.github.com>
2024-02-06 18:46:30 +02:00
Ionut Pruteanu
e2738f0a44
Fixing indentation for lines reported by yamllint
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
2024-01-31 21:31:14 +02:00
Ionut Pruteanu
18803420f0
Replacing secure-configuration of 'audit' and 'audit_backlog_limit' from the /etc/default/grub approach to grubby(actually used by CIS)
Signed-off-by: Ionut Pruteanu <ionut.pruteanu@siemens.com>
2024-01-31 21:27:00 +02:00
uk-bolly
b726c2e444
Merge pull request #154 from jLemmings/patch-3
Remove trailing comma to align with other roles
2024-01-26 12:44:07 +00:00
uk-bolly
902956e51d
Merge pull request #151 from sickbock/devel
Corrections to tags and a variable
2024-01-26 12:37:20 +00:00
uk-bolly
df1aef8d31
Merge pull request #148 from siemens/siemens/feat/AuditVarsRefactoring
Siemens/feat/audit vars refactoring
2024-01-26 12:34:30 +00:00
uk-bolly
ac5eee81df
Merge pull request #112 from siemens/siemens/feat/ensure_default_umask_027_5_6_5
Adding new entry in /etc/pam.d/system-auth
2024-01-26 12:32:45 +00:00