mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
6eeae19517
* Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Signed-off-by: John Foster <robopickle@proton.me> * Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Removed debug messages Signed-off-by: John Foster <robopickle@proton.me> --------- Signed-off-by: John Foster <robopickle@proton.me>
101 lines
3.6 KiB
YAML
101 lines
3.6 KiB
YAML
---
|
|
|
|
- name: "4.1.1.1 | PATCH | Ensure auditd is installed"
|
|
block:
|
|
- name: "4.1.1.1 | PATCH | Ensure auditd is installed | Install auditd packages"
|
|
ansible.builtin.package:
|
|
name: audit
|
|
state: present
|
|
when: '"auditd" not in ansible_facts.packages'
|
|
|
|
- name: "4.1.1.1 | PATCH | Ensure auditd is installed | Install auditd-lib packages"
|
|
ansible.builtin.package:
|
|
name: audit-libs
|
|
state: present
|
|
when: '"auditd-lib" not in ansible_facts.packages'
|
|
when:
|
|
- rhel9cis_rule_4_1_1_1
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.1.1
|
|
|
|
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled"
|
|
block:
|
|
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby existence of current value"
|
|
ansible.builtin.shell: grubby --info=ALL | grep args | sed -n 's/.*audit=\([[:alnum:]]\+\).*/\1/p'
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: rhel9cis_4_1_1_2_grubby_curr_value_audit_linux
|
|
|
|
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby update, if needed"
|
|
ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1"
|
|
when:
|
|
- rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout == '' or
|
|
'0' in rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout or
|
|
'off' in rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout|lower
|
|
when:
|
|
- rhel9cis_rule_4_1_1_2
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- grub
|
|
- rule_4.1.1.2
|
|
|
|
- name: "4.1.1.3 | PATCH | Ensure audit_backlog_limit is sufficient"
|
|
block:
|
|
- name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby existence of current value"
|
|
ansible.builtin.shell:
|
|
cmd: 'grubby --info=ALL | grep args | grep -o -E "audit_backlog_limit=([[:digit:]])+" | grep -o -E "([[:digit:]])+"'
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux
|
|
|
|
- name: "4.1.1.3 | AUDIT | Check to see if limits are set"
|
|
ansible.builtin.set_fact:
|
|
rhel9cis_4_1_1_3_reset_backlog_limits: true
|
|
when:
|
|
- rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux is not defined or
|
|
rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux.stdout_lines == []
|
|
|
|
- name: "4.1.1.3 | AUDIT | Check to see if any limits are too low"
|
|
ansible.builtin.set_fact:
|
|
rhel9cis_4_1_1_3_reset_backlog_limits: true
|
|
when:
|
|
- (item | int < rhel9cis_audit_back_log_limit)
|
|
loop: "{{ rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux.stdout_lines }}"
|
|
|
|
- name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update applied"
|
|
ansible.builtin.shell:
|
|
cmd: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'
|
|
when:
|
|
- rhel9cis_4_1_1_3_reset_backlog_limits is defined
|
|
when:
|
|
- rhel9cis_rule_4_1_1_3
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- grub
|
|
- rule_4.1.1.3
|
|
|
|
- name: "4.1.1.4 | PATCH | Ensure auditd service is enabled"
|
|
ansible.builtin.systemd:
|
|
name: auditd
|
|
state: started
|
|
enabled: true
|
|
when:
|
|
- rhel9cis_rule_4_1_1_4
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.1.4
|