mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
7d7b6132f4
* Issue #170, PR #181 thanks to @ipruteanu-sie * issue #182, PR #183 thansk to @ipruteanu-sie * PR #180 thanks to @ipruteanu-sie and @raabf * Addressed PR #165 thanks to @ipruteanu-sie * PT #184 addressed thansk to @ipruteanu-sie * updated credits * typo and ssh allow_deny comments * enable OS check --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
292 lines
8.5 KiB
YAML
292 lines
8.5 KiB
YAML
---
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.1 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_1
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.1
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.2 | PATCH | Ensure actions as another user are always logged"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_2
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.2
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.3 | PATCH | Ensure events that modify the sudo log file are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_3
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.3
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.4 | PATCH | Ensure events that modify date and time information are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_4
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.4
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.5 | PATCH | Ensure events that modify the system's network environment are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_5
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.5
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
|
|
block:
|
|
- name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
|
|
ansible.builtin.shell: for i in $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm /6000 2>/dev/null; done
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
register: priv_procs
|
|
|
|
- name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
notify: update auditd
|
|
when:
|
|
- rhel9cis_rule_4_1_3_6
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.6
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.7 | PATCH | Ensure unsuccessful unauthorized file access attempts are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_7
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.7
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.8 | PATCH | Ensure events that modify user/group information are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_8
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.8
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.9 | PATCH | Ensure discretionary access control permission modification events are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_9
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.9
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.10 | PATCH | Ensure successful file system mounts are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_10
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.10
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.11 | PATCH | Ensure session initiation information is collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_11
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.11
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.12 | PATCH | Ensure login and logout events are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_12
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.12
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.13 | PATCH | Ensure file deletion events by users are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_13
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- auditd
|
|
- patch
|
|
- rule_4.1.3.13
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.14 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_14
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.14
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.15 | PATCH | Ensure successful and unsuccessful attempts to use the chcon command are recorded"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_15
|
|
tags:
|
|
- level2-server
|
|
- level2- workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.15
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.16 | PATCH | Ensure successful and unsuccessful attempts to use the setfacl command are recorded"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_16
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.16
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.17 | PATCH | Ensure successful and unsuccessful attempts to use the chacl command are recorded"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_17
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.17
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.18 | PATCH | Ensure successful and unsuccessful attempts to use the usermod command are recorded"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_18
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.18
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.19 | PATCH | Ensure kernel module loading and unloading is collected"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_19
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.19
|
|
|
|
# All changes selected are managed by the POST audit and handlers to update
|
|
- name: "4.1.3.20 | PATCH | Ensure the audit configuration is immutable"
|
|
ansible.builtin.set_fact:
|
|
update_audit_template: true
|
|
when:
|
|
- rhel9cis_rule_4_1_3_20
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.20
|
|
|
|
- name: "4.1.3.21 | AUDIT | Ensure the running and on disk configuration is the same"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "Please run augenrules --load if you suspect there is a configuration that is not active"
|
|
when:
|
|
- rhel9cis_rule_4_1_3_21
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- manual
|
|
- patch
|
|
- auditd
|
|
- rule_4.1.3.21
|
|
|
|
- name: Auditd | 4.1.3 | Auditd controls updated
|
|
ansible.builtin.debug:
|
|
msg: "Auditd Controls handled in POST using template - updating /etc/auditd/rules.d/99_auditd.rules"
|
|
changed_when: false
|
|
when:
|
|
- update_audit_template
|