diff --git a/tasks/section_3/cis_3.1.x.yml b/tasks/section_3/cis_3.1.x.yml index 68da340..9e1e484 100644 --- a/tasks/section_3/cis_3.1.x.yml +++ b/tasks/section_3/cis_3.1.x.yml @@ -5,12 +5,12 @@ - name: "3.1.1 | PATCH | Ensure IPv6 status is identified" block: - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | refresh" - set_fact: + ansible.builtin.set_fact: sysctl_update: true flush_ipv6_route: true - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable" - debug: + ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf" when: - not rhel9cis_ipv6_required @@ -27,21 +27,21 @@ - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled" block: - name: "3.1.2 | AUDIT | Ensure wireless interfaces are disabled | Check if nmcli command is available" - command: rpm -q NetworkManager + ansible.builtin.command: rpm -q NetworkManager changed_when: false failed_when: false check_mode: false register: rhel_08_nmcli_available - name: "3.1.2 | AUDIT | Ensure wireless interfaces are disabled | Check if wifi is enabled" - command: nmcli radio wifi + ansible.builtin.command: nmcli radio wifi register: rhel_08_wifi_enabled changed_when: rhel_08_wifi_enabled.stdout != "disabled" failed_when: false when: rhel_08_nmcli_available.rc == 0 - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Disable wifi if enabled" - command: nmcli radio all off + ansible.builtin.command: nmcli radio all off changed_when: false failed_when: false when: rhel_08_wifi_enabled is changed @@ -54,7 +54,7 @@ - rule_3.1.2 - name: "3.1.3 | PATCH | Ensure TIPC is disabled" - template: + ansible.builtin.template: src: "etc/modprobe.d/modprobe.conf.j2" dest: "/etc/modprobe.d/{{ item }}.conf" mode: "0600" diff --git a/tasks/section_3/cis_3.2.x.yml b/tasks/section_3/cis_3.2.x.yml index 708deb8..56e47f7 100644 --- a/tasks/section_3/cis_3.2.x.yml +++ b/tasks/section_3/cis_3.2.x.yml @@ -3,22 +3,22 @@ - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled" block: - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding | Set Fact" - set_fact: + ansible.builtin.set_fact: sysctl_update: true flush_ipv4_route: true - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding" - debug: + ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf" - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | IPv6" block: - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact" - set_fact: + ansible.builtin.set_fact: flush_ipv6_route: true - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding" - debug: + ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf" when: rhel9cis_ipv6_required @@ -35,11 +35,11 @@ - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled" block: - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled | Set Fact" - set_fact: + ansible.builtin.set_fact: sysctl_update: true flush_ipv4_route: true - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled" - debug: + ansible.builtin.debug: msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf" when: - not rhel9cis_is_router diff --git a/tasks/section_3/cis_3.4.1.x.yml b/tasks/section_3/cis_3.4.1.x.yml index 9498c97..226cd79 100644 --- a/tasks/section_3/cis_3.4.1.x.yml +++ b/tasks/section_3/cis_3.4.1.x.yml @@ -18,22 +18,22 @@ - name: "3.4.1.2 | PATCH | Ensure a single firewall configuration utility is in use" block: - name: "3.4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | nftables" - systemd: + ansible.builtin.systemd: name: "{{ item }}" masked: true with_items: - firewalld - when: + when: - item in ansible_facts.packages - rhel9cis_firewall == 'nftables' - name: "3.4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | firewalld" - systemd: + ansible.builtin.systemd: name: "{{ item }}" masked: true with_items: - nftables - when: + when: - item in ansible_facts.packages - rhel9cis_firewall == 'firewalld' diff --git a/tasks/section_3/cis_3.4.2.x.yml b/tasks/section_3/cis_3.4.2.x.yml index 7fc873e..bbd1ad0 100644 --- a/tasks/section_3/cis_3.4.2.x.yml +++ b/tasks/section_3/cis_3.4.2.x.yml @@ -3,13 +3,13 @@ - name: "3.4.2.1 | PATCH | Ensure firewalld default zone is set" block: - name: "3.4.2.1 | AUDIT | Ensure firewalld default zone is set" - shell: "firewall-cmd --get-default-zone | grep {{ rhel9cis_default_zone }}" + ansible.builtin.shell: "firewall-cmd --get-default-zone | grep {{ rhel9cis_default_zone }}" changed_when: false failed_when: ( firewalld_zone_set.rc not in [ 0, 1 ] ) register: firewalld_zone_set - name: "3.4.2.1 | AUDIT | Ensure firewalld default zone is set" - command: firewall-cmd --set-default-zone="{{ rhel9cis_default_zone }}" + ansible.builtin.command: firewall-cmd --set-default-zone="{{ rhel9cis_default_zone }}" when: - firewalld_zone_set.rc != 0 when: @@ -25,20 +25,20 @@ - name: "3.4.2.2 | AUDIT | Ensure at least one nftables table exists" block: - name: "3.4.2.2 | AUDIT | Ensure a table exists | Check for tables" - command: nft list tables + ansible.builtin.command: nft list tables changed_when: false failed_when: false register: rhel9cis_3_4_2_2_nft_tables - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Show existing tables" - debug: + ansible.builtin.debug: msg: - "Below are the current nft tables, please review" - "{{ rhel9cis_3_4_2_2_nft_tables.stdout_lines }}" when: rhel9cis_3_4_2_2_nft_tables.stdout | length > 0 - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Alert on no tables" - debug: + ansible.builtin.debug: msg: - "Warning!! You currently have no nft tables, please review your setup" - 'Use the command "nft create table inet " to create a new table' @@ -47,7 +47,7 @@ - not rhel9cis_nft_tables_autonewtable - name: "3.4.2.2 | AUDIT | Ensure an nftables table exists | Alert on no tables | warning count" - set_fact: + ansible.builtin.set_fact: control_number: "{{ control_number }} + [ 'rule_3.4.2.2' ]" warn_count: "{{ warn_count | int + 1 }}" when: @@ -55,7 +55,7 @@ - not rhel9cis_nft_tables_autonewtable - name: "3.4.2.2 | PATCH | Ensure a table exists | Create table if needed" - command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}" + ansible.builtin.command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}" failed_when: false when: rhel9cis_nft_tables_autonewtable when: @@ -71,25 +71,25 @@ - name: "3.4.2.3 | PATCH | Ensure nftables base chains exist" block: - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for INPUT" - shell: nft list ruleset | grep 'hook input' + ansible.builtin.shell: nft list ruleset | grep 'hook input' changed_when: false failed_when: false register: rhel9cis_3_4_2_3_input_chains - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for FORWARD" - shell: nft list ruleset | grep 'hook forward' + ansible.builtin.shell: nft list ruleset | grep 'hook forward' changed_when: false failed_when: false register: rhel9cis_3_4_2_3_forward_chains - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Get current chains for OUTPUT" - shell: nft list ruleset | grep 'hook output' + ansible.builtin.shell: nft list ruleset | grep 'hook output' changed_when: false failed_when: false register: rhel9cis_3_4_2_3_output_chains - name: "3.4.2.3 | AUDIT | Ensure nftables base chains exist | Display chains for review" - debug: + ansible.builtin.debug: msg: - "Below are the current INPUT chains" - "{{ rhel9cis_3_4_2_3_input_chains.stdout_lines }}" @@ -100,7 +100,7 @@ when: not rhel9cis_nft_tables_autochaincreate - name: "3.4.2.3 | PATCH | Ensure nftables base chains exist | Create chains if needed" - shell: "{{ item }}" + ansible.builtin.shell: "{{ item }}" failed_when: false with_items: - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; } @@ -120,33 +120,33 @@ - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured" block: - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather iif lo accept existence | nftables" - shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept' + ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept' changed_when: false failed_when: false register: rhel9cis_3_4_2_4_iiflo - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather ip saddr existence | nftables" - shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr' + ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr' changed_when: false failed_when: false register: rhel9cis_3_4_2_4_ipsaddr - name: "3.4.2.4 | AUDIT | Ensure host based firewall loopback traffic is configured | Gather ip6 saddr existence | nftables" - shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr' + ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr' changed_when: false failed_when: false register: rhel9cis_3_4_2_4_ip6saddr - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set iif lo accept rule | nftables" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept when: '"iif \"lo\" accept" not in rhel9cis_3_4_2_4_iiflo.stdout' - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set ip sddr rule | nftables" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_4_ipsaddr.stdout' - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | Set ip6 saddr rule | nftables" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_4_ip6saddr.stdout' when: - rhel9cis_firewall == "nftables" @@ -161,11 +161,11 @@ - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | firewalld" ansible.posix.firewalld: - rich_rule: "{{ item }}" - zone: "{{ rhel9cis_firewall_zone }}" - permanent: yes - immediate: yes - state: enabled + rich_rule: "{{ item }}" + zone: "{{ rhel9cis_default_zone }}" + permanent: true + immediate: true + state: enabled loop: - rule family="ipv4" source address="127.0.0.1" destination not address="127.0.0.1" drop - rule family="ipv6" source address="::1" destination not address="::1" drop @@ -182,14 +182,14 @@ - name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports" block: - name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports | Get list of services and ports" - shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done" + ansible.builtin.shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done" changed_when: false failed_when: false check_mode: false register: rhel9cis_3_4_2_5_servicesport - name: "3.4.2.5 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports" - debug: + ansible.builtin.debug: msg: - "The items below are the services and ports that are accepted, please correct as needed" - "{{ rhel9cis_3_4_2_5_servicesport.stdout_lines }}" @@ -205,39 +205,39 @@ - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured" block: - name: "3.4.2.6 | AUDIT | EEnsure nftables established connections are configured | Gather incoming connection rules" - shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state' + ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state' changed_when: false failed_when: false register: rhel9cis_3_4_2_6_inconnectionrule - name: "3.4.2.6| AUDIT | Ensure nftables established connections are configured | Gather outbound connection rules" - shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state' + ansible.builtin.shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state' changed_when: false failed_when: false register: rhel9cis_3_4_2_6_outconnectionrule - name: "3.4.2.6| PATCH | Ensure nftables established connections are configured | Add input tcp established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept when: '"ip protocol tcp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout' - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add input udp established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept when: '"ip protocol udp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout' - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add input icmp established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept when: '"ip protocol icmp ct state established accept" not in rhel9cis_3_4_2_6_inconnectionrule.stdout' - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output tcp new, related, established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept when: '"ip protocol tcp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout' - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output udp new, related, established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept when: '"ip protocol udp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout' - name: "3.4.2.6 | PATCH | Ensure nftables established connections are configured | Add output icmp new, related, established accept policy" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept when: '"ip protocol icmp ct state established,related,new accept" not in rhel9cis_3_4_2_6_outconnectionrule.stdout' when: - rhel9cis_firewall == "nftables" @@ -252,43 +252,43 @@ - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy" block: - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook input deny policy" - shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input' + ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input' failed_when: false changed_when: false register: rhel9cis_3_4_2_7_inputpolicy - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook forward deny policy" - shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward' + ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward' failed_when: false changed_when: false register: rhel9cis_3_4_2_7_forwardpolicy - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for hook output deny policy" - shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output' + ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output' failed_when: false changed_when: false register: rhel9cis_3_4_2_7_outputpolicy - name: "3.4.2.7 | AUDIT | Ensure nftables default deny firewall policy | Check for SSH allow" - shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh' + ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh' failed_when: false changed_when: false register: rhel9cis_3_4_2_7_sshallowcheck - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic" - command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept + ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept when: '"tcp dport ssh accept" not in rhel9cis_3_4_2_7_sshallowcheck.stdout' - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy" - command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; } + ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; } when: '"type filter hook input priority 0; policy drop;" not in rhel9cis_3_4_2_7_inputpolicy.stdout' - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy" - command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; } + ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; } when: '"type filter hook forward priority 0; policy drop;" not in rhel9cis_3_4_2_7_forwardpolicy.stdout' - name: "3.4.2.7 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy" - command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; } + ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; } when: '"type filter hook output priority 0; policy drop;" not in rhel9cis_3_4_2_7_outputpolicy.stdout' when: - rhel9cis_firewall == "nftables"