sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Update cryto policy var to standard

Browse source 
Signed-off-by: Frederick Witty <frederickw@mindpointgroup.com>
This commit is contained in:
Frederick Witty 2025-09-08 11:54:57 -04:00
parent 413ccb96b7
commit 2dfa9266a8
No known key found for this signature in database
GPG key ID: D29987C25A47D813
4 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
defaults/main.yml
View file

@ -586,7 +586,9 @@ rhel9cis_bootloader_password_hash: 'grub.pbkdf2.sha512.changethispassword' # pr
# This variable governs whether a bootloader password should be set in '/boot/grub2/user.cfg' file.
rhel9cis_set_boot_pass: true
## Controls 1.6.x
## Controls 1.6.x and Controls 5.1.x
# This variable governs if current Ansible role should manage system-wide crypto policy.
rhel9cis_crypto_policy_ansiblemanaged: true
# This variable contains the value to be set as the system-wide crypto policy. Current rule enforces NOT USING
# 'LEGACY' value(as it is less secure, it just ensures compatibility with legacy systems), therefore
# possible values for this variable are, as explained by RedHat docs:
@ -594,8 +596,6 @@ rhel9cis_set_boot_pass: true
# -'FUTURE': conservative security level that is believed to withstand any near-term future attacks
# -'FIPS': A level that conforms to the FIPS140-2 requirements
rhel9cis_crypto_policy: 'DEFAULT'
## Controls 1.6.x and Controls 5.1.x
rhel9cis_crypto_policy_ansible_managed: true
# This variable contains the value of the crypto policy module(combinations of policies and
# sub-policies) to be allowed as default setting. Allowed options are defined in 'vars/main.yml' file,
# using 'rhel9cis_allowed_crypto_policies_modules' variable, which currently are: