forked from ansible-lockdown/RHEL9-CIS
v1.0.0 updates
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
4e004e7d88
commit
2634fabd41
18 changed files with 288 additions and 329 deletions
|
|
@ -1,26 +1,9 @@
|
|||
---
|
||||
|
||||
- name: "1.1.9 | PATCH | Disable Automounting"
|
||||
service:
|
||||
name: autofs
|
||||
enabled: false
|
||||
when:
|
||||
- not rhel9cis_allow_autofs
|
||||
- "'autofs' in ansible_facts.packages"
|
||||
- rhel9cis_rule_1_1_9
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- automounting
|
||||
- rule_1.1.9
|
||||
|
||||
- name: "1.1.10 | PATCH | Disable USB Storage"
|
||||
- name: "1.1.9 | PATCH | Disable USB Storage"
|
||||
block:
|
||||
- name: "1.1.10 | PATCH | Disable USB Storage | Edit modprobe config"
|
||||
lineinfile:
|
||||
- name: "1.1.9 | PATCH | Disable USB Storage | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install usb-storage(\\s|$)"
|
||||
line: "install usb-storage /bin/true"
|
||||
|
|
@ -29,12 +12,12 @@
|
|||
group: root
|
||||
mode: 0600
|
||||
|
||||
- name: "1.1.10 | PATCH | Disable USB Storage | Edit modprobe config"
|
||||
modprobe:
|
||||
- name: "1.1.9 | PATCH | Disable USB Storage | Edit modprobe config"
|
||||
ansible.builtin.modprobe:
|
||||
name: usb-storage
|
||||
state: absent
|
||||
when:
|
||||
- rhel9cis_rule_1_1_10
|
||||
- rhel9cis_rule_1_1_9
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
|
|
@ -42,4 +25,4 @@
|
|||
- patch
|
||||
- mounts
|
||||
- removable_storage
|
||||
- rule_1.1.10
|
||||
- rule_1.1.9
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue