From 4c41656a3b642c3ba620b4df5eaafd7f3f382f7b Mon Sep 17 00:00:00 2001 From: Frederick Witty Date: Thu, 23 Oct 2025 08:28:06 -0400 Subject: [PATCH 01/13] .github standardization Signed-off-by: Frederick Witty --- .../add_repo_issue_to_gh_project.yml | 2 +- .github/workflows/update_galaxy.yml | 19 ------------------- 2 files changed, 1 insertion(+), 20 deletions(-) delete mode 100644 .github/workflows/update_galaxy.yml diff --git a/.github/workflows/add_repo_issue_to_gh_project.yml b/.github/workflows/add_repo_issue_to_gh_project.yml index 4a056eb..80d7344 100644 --- a/.github/workflows/add_repo_issue_to_gh_project.yml +++ b/.github/workflows/add_repo_issue_to_gh_project.yml @@ -14,4 +14,4 @@ jobs: - uses: actions/add-to-project@main with: project-url: https://github.com/orgs/ansible-lockdown/projects/1 - github-token: ${{ secrets.GITHUB_TOKEN }} + github-token: ${{ secrets.ALD_GH_PROJECT }} diff --git a/.github/workflows/update_galaxy.yml b/.github/workflows/update_galaxy.yml deleted file mode 100644 index b6ee6a1..0000000 --- a/.github/workflows/update_galaxy.yml +++ /dev/null @@ -1,19 +0,0 @@ ---- - - name: update galaxy - - on: - push: - branches: - - main - jobs: - update_role: - runs-on: ubuntu-latest - steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Action Ansible Galaxy Release ${{ github.ref_name }} - uses: ansible-actions/ansible-galaxy-action@main - with: - galaxy_api_key: ${{ secrets.GALAXY_API_KEY }} From 0ec943073cad7d805b08cdbc11bf8c925e2611ae Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 10 Nov 2025 17:45:49 +0000 Subject: [PATCH 02/13] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/gitleaks/gitleaks: v8.28.0 → v8.29.0](https://github.com/gitleaks/gitleaks/compare/v8.28.0...v8.29.0) - [github.com/ansible-community/ansible-lint: v25.9.2 → v25.11.0](https://github.com/ansible-community/ansible-lint/compare/v25.9.2...v25.11.0) --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0091b2a..4aa6519 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -41,12 +41,12 @@ repos: - id: detect-secrets - repo: https://github.com/gitleaks/gitleaks - rev: v8.28.0 + rev: v8.29.0 hooks: - id: gitleaks - repo: https://github.com/ansible-community/ansible-lint - rev: v25.9.2 + rev: v25.11.0 hooks: - id: ansible-lint name: Ansible-lint From 539ac4f5cc6b1646ed18343d6915dbef60c894d8 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 17:42:03 +0000 Subject: [PATCH 03/13] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/gitleaks/gitleaks: v8.29.0 → v8.29.1](https://github.com/gitleaks/gitleaks/compare/v8.29.0...v8.29.1) --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 4aa6519..9d80577 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -41,7 +41,7 @@ repos: - id: detect-secrets - repo: https://github.com/gitleaks/gitleaks - rev: v8.29.0 + rev: v8.29.1 hooks: - id: gitleaks From 72602c63fade97c61e2845f3beae665d98580f1e Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Tue, 25 Nov 2025 09:28:00 +0000 Subject: [PATCH 04/13] add fix provided by @kpi-nourman via discord community Signed-off-by: Mark Bolwell --- templates/etc/dconf/db/gdm.d/01-banner-message.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/etc/dconf/db/gdm.d/01-banner-message.j2 b/templates/etc/dconf/db/gdm.d/01-banner-message.j2 index 901e9e0..ec42bfc 100644 --- a/templates/etc/dconf/db/gdm.d/01-banner-message.j2 +++ b/templates/etc/dconf/db/gdm.d/01-banner-message.j2 @@ -4,4 +4,4 @@ [org/gnome/login-screen] banner-message-enable=true -banner-message-text="{{ rhel9cis_warning_banner }}" +banner-message-text="{{ rhel9cis_warning_banner | trim | replace("\n", "\\n") }}" From 52452b1e3c71d6fbb427edbc477234174420df16 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Fri, 28 Nov 2025 14:51:43 +0000 Subject: [PATCH 05/13] issues 413 addressed thansk to @bbaassssiiee Signed-off-by: Mark Bolwell --- Changelog.md | 4 +++- tasks/main.yml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Changelog.md b/Changelog.md index 737f860..ac9c3b6 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,6 +1,5 @@ # Changes to rhel9CIS - ## 2.0.4 - Based on CIS v2.0.0 - addressed issue #393 thank you to @fragglexarmy @@ -11,6 +10,9 @@ - work flow updates - audit logic improvements - auditd template 2.19 compatible +- pre-commit updates +- #410 thanks to @kpi-nourman +- #413 thanks to @bbaassssiiee ## 2.0.3 - Based on CIS v2.0.0 - addressed issue #387, thank you @fragglexarmy diff --git a/tasks/main.yml b/tasks/main.yml index 760ee1b..6f97141 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -134,7 +134,7 @@ - rule_5.4.2.4 block: - name: "Ensure root password is set" - ansible.builtin.shell: LC_ALL=C passwd -S root | grep -E "(Password set|Password locked)" + ansible.builtin.shell: LC_ALL=C passwd -S root | grep -E "(\*LOCK\*|Password set|Password locked)" changed_when: false failed_when: prelim_root_passwd_set.rc not in [ 0, 1 ] register: prelim_root_passwd_set From 571711f11e0d8a988fee79a2f24eaf918768add4 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Mon, 1 Dec 2025 10:23:25 +0000 Subject: [PATCH 06/13] updated with correct fix thanks to @bbaassssiiee Signed-off-by: Mark Bolwell --- tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/main.yml b/tasks/main.yml index 6f97141..4d1887d 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -134,7 +134,7 @@ - rule_5.4.2.4 block: - name: "Ensure root password is set" - ansible.builtin.shell: LC_ALL=C passwd -S root | grep -E "(\*LOCK\*|Password set|Password locked)" + ansible.builtin.shell: LC_ALL=C passwd -S root | grep -E "(Alternate authentication|Password set|Password locked)" changed_when: false failed_when: prelim_root_passwd_set.rc not in [ 0, 1 ] register: prelim_root_passwd_set From 322404a6921f2709b4066e3745c7dc5d181314e3 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 15 Dec 2025 17:41:29 +0000 Subject: [PATCH 07/13] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/gitleaks/gitleaks: v8.29.1 → v8.30.0](https://github.com/gitleaks/gitleaks/compare/v8.29.1...v8.30.0) - [github.com/ansible-community/ansible-lint: v25.11.0 → v25.12.1](https://github.com/ansible-community/ansible-lint/compare/v25.11.0...v25.12.1) --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9d80577..255180a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -41,12 +41,12 @@ repos: - id: detect-secrets - repo: https://github.com/gitleaks/gitleaks - rev: v8.29.1 + rev: v8.30.0 hooks: - id: gitleaks - repo: https://github.com/ansible-community/ansible-lint - rev: v25.11.0 + rev: v25.12.1 hooks: - id: ansible-lint name: Ansible-lint From 62989d258b5af00fd190299d002b95635e9b8284 Mon Sep 17 00:00:00 2001 From: George Nalen Date: Fri, 19 Dec 2025 16:31:37 -0500 Subject: [PATCH 08/13] added fix to issue #416 Signed-off-by: George Nalen --- templates/etc/sysctl.d/60-disable_ipv6.conf.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 b/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 index bdded40..b4b5318 100644 --- a/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 +++ b/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 @@ -4,4 +4,7 @@ {% if rhel9cis_rule_3_1_1 and not rhel9cis_ipv6_required %} net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 +{% for interface in ansible_interfaces %} +net.ipv6.conf.{{ interface }}.disable_ipv6 = 1 +{% endfor %} {% endif %} From 96474159ab282aad770e038870fad2d5cfacec69 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 22 Dec 2025 17:33:38 +0000 Subject: [PATCH 09/13] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/ansible-community/ansible-lint: v25.12.1 → v25.12.2](https://github.com/ansible-community/ansible-lint/compare/v25.12.1...v25.12.2) --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 255180a..dbc1d7e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -46,7 +46,7 @@ repos: - id: gitleaks - repo: https://github.com/ansible-community/ansible-lint - rev: v25.12.1 + rev: v25.12.2 hooks: - id: ansible-lint name: Ansible-lint From beb3bfdc94ea94903bb82a3cba0d89d84c7ce60f Mon Sep 17 00:00:00 2001 From: George Nalen Date: Mon, 22 Dec 2025 16:35:08 -0500 Subject: [PATCH 10/13] added option for sysctl or kernel for disabling IPv6 Signed-off-by: George Nalen --- defaults/main.yml | 2 ++ tasks/section_3/cis_3.1.x.yml | 19 +++++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index fbe81eb..2ad3eb2 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -802,6 +802,8 @@ rhel9cis_tftp_client: false ## Control 3.1.1 - Ensure IPv6 status is identified # This variable governs whether ipv6 is enabled or disabled. rhel9cis_ipv6_required: true +# rhel9cis_ipv6_disable defines the method of disabling IPv6, sysctl vs kernel +rhel9cis_ipv6_disable: "sysctl" ## Control 3.1.2 - Ensure wireless interfaces are disabled # if wireless adapter found allow network manager to be installed diff --git a/tasks/section_3/cis_3.1.x.yml b/tasks/section_3/cis_3.1.x.yml index a20c0e9..6cd73f3 100644 --- a/tasks/section_3/cis_3.1.x.yml +++ b/tasks/section_3/cis_3.1.x.yml @@ -16,14 +16,29 @@ - rule_3.1.1 - NIST800-53R5_CM-7 block: - - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | refresh" + - name: "3.1.1 | AUDIT | Ensure IPv6 status is identified | Set vars for sysctl template" + when: "'sysctl' in rhel9cis_ipv6_disable_method" ansible.builtin.set_fact: rhel9cis_sysctl_update: true rhel9cis_flush_ipv6_route: true - - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable" + - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable via sysctl template" + when: "'sysctl' in rhel9cis_ipv6_disable_method" ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf" + + - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | Find IPv6 status" + when: "'kernel' in rhel9cis_ipv6_disable_method" + ansible.builtin.command: grubby --info=ALL + changed_when: false + failed_when: false + register: discovered_rhel9cis_3_1_1_ipv6_status + + - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | Disable IPV6 via Kernel" + when: + - "'kernel' in rhel9cis_ipv6_disable_method" + - "'ipv6.disable=1' not in discovered_rhel9cis_3_1_1_ipv6_status.stdout" + ansible.builtin.shell: grubby --update-kernel=ALL --args="ipv6.disable=1" - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled" when: From 2b7c8293b83667c853b44df0bd2bf38217695401 Mon Sep 17 00:00:00 2001 From: George Nalen Date: Mon, 22 Dec 2025 16:56:24 -0500 Subject: [PATCH 11/13] fixed linting issue Signed-off-by: George Nalen --- tasks/section_3/cis_3.1.x.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/section_3/cis_3.1.x.yml b/tasks/section_3/cis_3.1.x.yml index 6cd73f3..0c9c374 100644 --- a/tasks/section_3/cis_3.1.x.yml +++ b/tasks/section_3/cis_3.1.x.yml @@ -26,7 +26,7 @@ when: "'sysctl' in rhel9cis_ipv6_disable_method" ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf" - + - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | Find IPv6 status" when: "'kernel' in rhel9cis_ipv6_disable_method" ansible.builtin.command: grubby --info=ALL From d9927f005bc09bd172c94d51096cfe2a68e386af Mon Sep 17 00:00:00 2001 From: George Nalen Date: Tue, 23 Dec 2025 08:42:28 -0500 Subject: [PATCH 12/13] fixed typo in disable method var Signed-off-by: George Nalen --- defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defaults/main.yml b/defaults/main.yml index 2ad3eb2..f620a72 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -803,7 +803,7 @@ rhel9cis_tftp_client: false # This variable governs whether ipv6 is enabled or disabled. rhel9cis_ipv6_required: true # rhel9cis_ipv6_disable defines the method of disabling IPv6, sysctl vs kernel -rhel9cis_ipv6_disable: "sysctl" +rhel9cis_ipv6_disable_method: "sysctl" ## Control 3.1.2 - Ensure wireless interfaces are disabled # if wireless adapter found allow network manager to be installed From 29a48f7f4cc0c794760a0f1b4a8da2c92ac7d35d Mon Sep 17 00:00:00 2001 From: George Nalen Date: Tue, 23 Dec 2025 09:04:42 -0500 Subject: [PATCH 13/13] updated name info for tasks related to 3.1.1 Signed-off-by: George Nalen --- tasks/section_3/cis_3.1.x.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tasks/section_3/cis_3.1.x.yml b/tasks/section_3/cis_3.1.x.yml index 0c9c374..ff9ec46 100644 --- a/tasks/section_3/cis_3.1.x.yml +++ b/tasks/section_3/cis_3.1.x.yml @@ -16,18 +16,18 @@ - rule_3.1.1 - NIST800-53R5_CM-7 block: - - name: "3.1.1 | AUDIT | Ensure IPv6 status is identified | Set vars for sysctl template" + - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | Set vars for sysctl template" when: "'sysctl' in rhel9cis_ipv6_disable_method" ansible.builtin.set_fact: rhel9cis_sysctl_update: true rhel9cis_flush_ipv6_route: true - - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable via sysctl template" + - name: "3.1.1 | AUDIT | Ensure IPv6 status is identified | Message out implementation info" when: "'sysctl' in rhel9cis_ipv6_disable_method" ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf" - - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | Find IPv6 status" + - name: "3.1.1 | AUDIT | Ensure IPv6 status is identified | Find IPv6 status" when: "'kernel' in rhel9cis_ipv6_disable_method" ansible.builtin.command: grubby --info=ALL changed_when: false