sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

v1.0.0 updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-01-09 16:29:47 +00:00
parent 4e004e7d88
commit 2634fabd41
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
18 changed files with 288 additions and 329 deletions
Download patch file Download diff file Expand all files Collapse all files

84
tasks/section_1/cis_1.6.1.x.yml
View file

@ -1,7 +1,7 @@
---
- name: "1.6.1.1 | PATCH | Ensure SELinux is installed"
package:
ansible.builtin.package:
name: libselinux
state: present
when:
@ -14,10 +14,13 @@
- rule_1.6.1.1
- name: "1.6.1.2 | PATCH | Ensure SELinux is not disabled in bootloader configuration"
replace:
ansible.builtin.replace:
dest: /etc/default/grub
regexp: 'selinux=0'
regexp: '{{ item }}'
replace: ''
loop:
- selinux=0
- enforcing=0
register: selinux_grub_patch
ignore_errors: true # noqa ignore-errors
notify: grub2cfg
@ -32,10 +35,10 @@
# State set to enforcing because control 1.6.1.5 requires enforcing to be set
- name: "1.6.1.3 | PATCH | Ensure SELinux policy is configured"
selinux:
ansible.posix.selinux:
conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}"
state: enforcing
state: "{{ rhel9cis_selinux_enforce }}"
when:
- not rhel9cis_selinux_disable
- rhel9cis_rule_1_6_1_3
@ -47,78 +50,95 @@
- patch
- rule_1.6.1.3
- name: "1.6.1.4 | PATCH | Ensure the SELinux state is enforcing"
selinux:
- name: "1.6.1.4 | PATCH | Ensure the SELinux state is not disabled"
ansible.posix.selinux:
conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}"
state: "{{ rhel9cis_selinux_enforce }}"
when:
- not rhel9cis_selinux_disable
- rhel9cis_rule_1_6_1_4
tags:
- level1-server
- level1-workstation
- automated
- selinux
- patch
- rule_1.6.1.4
- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
ansible.posix.selinux:
conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}"
state: enforcing
when:
- not rhel9cis_selinux_disable
- rhel9cis_rule_1_6_1_4
- rhel9cis_selinux_enforce == 'enforcing'
- rhel9cis_rule_1_6_1_5
tags:
- level2-server
- level2-workstation
- automated
- selinux
- patch
- rule_1.6.1.4
- rule_1.6.1.5
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist"
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist"
block:
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
register: rhelcis_1_6_1_5_unconf_services
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
ansible.builtin.shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
register: rhelcis_1_6_1_6_unconf_services
failed_when: false
changed_when: false
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Message on no unconfined services"
debug:
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on no unconfined services"
ansible.builtin.debug:
msg: "Good News! There are no services found on your system"
when: rhelcis_1_6_1_5_unconf_services.stdout | length == 0
when: rhelcis_1_6_1_6_unconf_services.stdout | length == 0
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
debug:
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
ansible.builtin.debug:
msg: "Warning!! You have unconfined services: {{ rhelcis_1_6_1_5_unconf_services.stdout_lines }}"
when: rhelcis_1_6_1_5_unconf_services.stdout | length > 0
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | warning count"
set_fact:
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | warning count"
ansible.builtin.set_fact:
control_number: "{{ control_number }} + [ 'rule_1.6.1.5' ]"
warn_count: "{{ warn_count | int + 1 }}"
when: rhelcis_1_6_1_5_unconf_services.stdout | length > 0
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
when:
- rhel9cis_rule_1_6_1_5
- rhel9cis_rule_1_6_1_6
tags:
- level1-server
- level1-workstation
- automated
- audit
- services
- rule_1.6.1.5
- rule_1.6.1.6
- name: "1.6.1.6 | PATCH | Ensure SETroubleshoot is not installed"
package:
- name: "1.6.1.7 | PATCH | Ensure SETroubleshoot is not installed"
ansible.builtin.package:
name: setroubleshoot
state: absent
when:
- rhel9cis_rule_1_6_1_6
- rhel9cis_rule_1_6_1_7
- "'setroubleshoot' in ansible_facts.packages"
tags:
- level1-server
- automated
- selinux
- patch
- rule_1.6.1.6
- rule_1.6.1.7
- name: "1.6.1.7 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
package:
- name: "1.6.1.8 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
ansible.builtin.package:
name: mcstrans
state: absent
when:
- rhel9cis_rule_1_6_1_7
- rhel9cis_rule_1_6_1_8
tags:
- level1-server
- level1-workstation
- automated
- patch
- rule_1.6.1.7
- rule_1.6.1.8