RHEL9-CIS/tasks/section_3/cis_3.4.2.x.yml

---

- name: "3.4.2.1 | PATCH | Ensure firewalld default zone is set"
  block:
      - name: "3.4.2.1 | AUDIT | Ensure firewalld default zone is set"
        ansible.builtin.shell: "firewall-cmd --get-default-zone | grep {{ rhel9cis_default_zone }}"
        changed_when: false
        failed_when: ( firewalld_zone_set.rc not in [ 0, 1 ] )
        register: firewalld_zone_set

      - name: "3.4.2.1 | AUDIT | Ensure firewalld default zone is set"
        ansible.builtin.command: firewall-cmd --set-default-zone="{{ rhel9cis_default_zone }}"
        when: firewalld_zone_set.rc != 0
  when:
      - rhel9cis_firewall == "firewalld"
      - rhel9cis_rule_3_4_2_1
  tags:
      - level1-server
      - level1-workstation
      - patch
      - firewalld
      - rule_3.4.2.1

- name: "3.4.2.2 | AUDIT | Ensure at least one nftables table exists"
  block:
      - name: "3.4.2.2 | AUDIT | Ensure a table exists | Check for tables"
        ansible.builtin.command: nft list tables
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_2_nft_tables

      - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Show existing tables"
        ansible.builtin.debug:
            msg:
                - "Below are the current nft tables, please review"
                - "{{ rhel9cis_3_4_2_2_nft_tables.stdout_lines }}"
        when: rhel9cis_3_4_2_2_nft_tables.stdout | length > 0

      - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Alert on no tables"
        ansible.builtin.debug:
            msg:
                - "Warning!! You currently have no nft tables, please review your setup"
                - 'Use the command "nft create table inet <table name>" to create a new table'
        when:
            - rhel9cis_3_4_2_2_nft_tables.stdout | length == 0
            - not rhel9cis_nft_tables_autonewtable

      - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Alert on no tables | warning count"
        ansible.builtin.import_tasks:
            file: warning_facts.yamlfacts.yml
        when:
            - rhel9cis_3_4_2_2_nft_tables.stdout | length == 0
            - not rhel9cis_nft_tables_autonewtable

      - name: "3.4.2.2 | PATCH | Ensure a table exists | Create table if needed"
        ansible.builtin.command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}"
        failed_when: false
        when: rhel9cis_nft_tables_autonewtable
  vars:
      warn_control_id: '3.4.2.2'
  when:
      - rhel9cis_firewall == "nftables"
      - rhel9cis_rule_3_4_2_2
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.2

- name: "3.4.2.3 | PATCH | Ensure nftables base chains exist"
  block:
      - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for INPUT"
        ansible.builtin.shell: nft list ruleset | grep 'hook input'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_3_input_chains

      - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for FORWARD"
        ansible.builtin.shell: nft list ruleset | grep 'hook forward'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_3_forward_chains

      - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for OUTPUT"
        ansible.builtin.shell: nft list ruleset | grep 'hook output'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_3_output_chains

      - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Display chains for review"
        ansible.builtin.debug:
            msg:
                - "Below are the current INPUT chains"
                - "{{ rhel9cis_3_4_2_3_input_chains.stdout_lines }}"
                - "Below are the current FORWARD chains"
                - "{{ rhel9cis_3_4_2_3_forward_chains.stdout_lines }}"
                - "Below are teh current OUTPUT chains"
                - "{{ rhel9cis_3_4_2_3_output_chains.stdout_lines }}"
        when: not rhel9cis_nft_tables_autochaincreate

      - name: "3.4.2.3 | PATCH | Ensure nftables base chains exist | Create chains if needed"
        ansible.builtin.shell: "{{ item }}"
        failed_when: false
        loop:
            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { type filter hook forward priority 0 \; }
            - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" output { type filter hook output priority 0 \; }
        when: rhel9cis_nft_tables_autochaincreate
  when:
      - rhel9cis_firewall == "nftables"
      - rhel9cis_rule_3_4_2_3
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.3

- name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured"
  block:
      - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather iif lo accept existence | nftables"
        ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_4_iiflo

      - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather ip saddr existence | nftables"
        ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_4_ipsaddr

      - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather ip6 saddr existence | nftables"
        ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_4_ip6saddr

      - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set iif lo accept rule | nftables"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept
        when: '"iif \"lo\" accept" not in rhel9cis_3_4_2_4_iiflo.stdout'

      - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set ip sddr rule | nftables"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop
        when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_4_ipsaddr.stdout'

      - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set ip6 saddr rule | nftables"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop
        when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_4_ip6saddr.stdout'
  when:
      - rhel9cis_firewall == "nftables"
      - rhel9cis_rule_3_4_2_4
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.4

- name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | firewalld"
  ansible.posix.firewalld:
      rich_rule: "{{ item }}"
      zone: "{{ rhel9cis_default_zone }}"
      permanent: true
      immediate: true
      state: enabled
  loop:
      - rule family="ipv4" source address="127.0.0.1" destination not address="127.0.0.1" drop
      - rule family="ipv6" source address="::1" destination not address="::1" drop
  when:
      - rhel9cis_firewall == "firewalld"
      - rhel9cis_rule_3_4_2_4
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.4

- name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports"
  block:
      - name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports | Get list of services and ports"
        ansible.builtin.shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done"
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel9cis_3_4_2_5_servicesport

      - name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports"
        ansible.builtin.debug:
            msg:
                - "The items below are the services and ports that are accepted, please correct as needed"
                - "{{ rhel9cis_3_4_2_5_servicesport.stdout_lines }}"
  when:
      - rhel9cis_rule_3_4_2_5
  tags:
      - level1-server
      - level1-workstation
      - manual
      - audit
      - rule_3.4.2.5

- name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured"
  block:
      - name: "3.4.2.6 | AUDIT | Ensure nftables established connections are configured | Gather incoming connection rules"
        ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_6_inconnectionrule

      - name: "3.4.2.6| AUDIT | Ensure nftables established connections are configured | Gather outbound connection rules"
        ansible.builtin.shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
        changed_when: false
        failed_when: false
        register: rhel9cis_3_4_2_6_outconnectionrule

      - name: "3.4.2.6| PATCH | Ensure nftables established connections are configured | Add input tcp established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
        when: '"ip protocol tcp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout'

      - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add input udp established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept
        when: '"ip protocol udp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout'

      - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add input icmp established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept
        when: '"ip protocol icmp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout'

      - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output tcp new, related, established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept
        when: '"ip protocol tcp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout'

      - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output udp new, related, established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept
        when: '"ip protocol udp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout'

      - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output icmp new, related, established accept policy"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept
        when: '"ip protocol icmp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout'
  when:
      - rhel9cis_firewall == "nftables"
      - rhel9cis_rule_3_4_2_6
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.6

- name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy"
  block:
      - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook input deny policy"
        ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input'
        failed_when: false
        changed_when: false
        register: rhel9cis_3_4_2_7_inputpolicy

      - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook forward deny policy"
        ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward'
        failed_when: false
        changed_when: false
        register: rhel9cis_3_4_2_7_forwardpolicy

      - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook output deny policy"
        ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output'
        failed_when: false
        changed_when: false
        register: rhel9cis_3_4_2_7_outputpolicy

      - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for SSH allow"
        ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh'
        failed_when: false
        changed_when: false
        register: rhel9cis_3_4_2_7_sshallowcheck

      - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic"
        ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept
        when: '"tcp dport ssh accept" not in rhel9cis_3_4_2_7_sshallowcheck.stdout'

      - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy"
        ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; }
        when: '"type filter hook input priority 0; policy drop;" not in rhel9cis_3_4_2_7_inputpolicy.stdout'

      - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy"
        ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; }
        when: '"type filter hook forward priority 0; policy drop;" not in rhel9cis_3_4_2_7_forwardpolicy.stdout'

      - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy"
        ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; }
        when: '"type filter hook output priority 0; policy drop;" not in rhel9cis_3_4_2_7_outputpolicy.stdout'
  when:
      - rhel9cis_firewall == "nftables"
      - rhel9cis_rule_3_4_2_7
  tags:
      - level1-server
      - level1-workstation
      - patch
      - nftables
      - rule_3.4.2.7