forked from ansible-lockdown/RHEL9-CIS
initial v2
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
6ea105374a
commit
3b346f7fe1
11 changed files with 1415 additions and 814 deletions
162
tasks/section_6/cis_6.2.2.1.x.yml
Normal file
162
tasks/section_6/cis_6.2.2.1.x.yml
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
---
|
||||
|
||||
- name: "6.2.2.1.1 | PATCH | Ensure systemd-journal-remote is installed"
|
||||
when:
|
||||
- ubtu22cis_rule_6_2_2_1_1
|
||||
- not ubtu22cis_system_is_log_server
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.1.1
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
ansible.builtin.package:
|
||||
name: systemd-journal-remote
|
||||
state: present
|
||||
|
||||
- name: "6.2.2.1.2 | PATCH | Ensure systemd-journal-remote authentication is configured"
|
||||
when:
|
||||
- ubtu22cis_rule_6_2_2_1_2
|
||||
- not ubtu22cis_system_is_log_server
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.1.2
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/systemd/journal-upload.conf
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
loop:
|
||||
- { regexp: 'URL=', line: 'URL={{ ubtu22cis_remote_log_server }}'}
|
||||
- { regexp: 'ServerKeyFile=', line: 'ServerKeyFile={{ ubtu22cis_journal_upload_serverkeyfile }}'}
|
||||
- { regexp: 'ServerCertificateFile=', line: 'ServerCertificateFile={{ ubtu22cis_journal_servercertificatefile }}'}
|
||||
- { regexp: 'TrustedCertificateFile=', line: 'TrustedCertificateFile={{ ubtu22cis_journal_trustedcertificatefile }}'}
|
||||
|
||||
- name: "6.2.2.1.3 | PATCH | Ensure systemd-journal-remote is enabled and active"
|
||||
when:
|
||||
- not ubtu22cis_system_is_log_server
|
||||
- ubtu22cis_rule_6_2_2_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.1.3
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-12
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-journal-upload
|
||||
masked: false
|
||||
enabled: true
|
||||
|
||||
- name: "6.2.2.1.4 | PATCH | Ensure systemd-journal-remote service is not in use"
|
||||
when:
|
||||
- not ubtu22cis_system_is_log_server
|
||||
- ubtu22cis_rule_6_2_2_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.1.4
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
state: stopped
|
||||
enabled: false
|
||||
masked: true
|
||||
loop:
|
||||
- systemd-journal-remote.socket
|
||||
- systemd-journal-remote.service
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled"
|
||||
when:
|
||||
- ubtu22cis_rule_6_2_2_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.2
|
||||
- NIST800-53R5_AU-2
|
||||
- NIST800-53R5_AU-6
|
||||
- NIST800-53R5_AU-7
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/forwardtosyslog.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/forwardtosyslog.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.2 | PATCH | Ensure journald ForwardToSyslog is disabled | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(\s*ForwardToSyslog)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured"
|
||||
when:
|
||||
- ubtu22cis_rule_6_2_2_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.3
|
||||
- NIST800-53R5_AU-4
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2 # Added to the same file as 6.2.1.1.4
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.3 | PATCH | Ensure journald Compress is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*compress=)
|
||||
replace: '#\1'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured"
|
||||
when:
|
||||
- ubtu22cis_rule_6_2_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- journald
|
||||
- rule_6.2.2.4
|
||||
- NIST800-53R5_AU-3
|
||||
- NIST800-53R5_AU-12
|
||||
notify: Restart journald
|
||||
block:
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | Add file"
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.d/storage.conf.j2
|
||||
dest: /etc/systemd/journald.conf.d/storage.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
|
||||
- name: "6.2.2.4 | PATCH | Ensure journald Storage is configured | comment out current entries"
|
||||
ansible.builtin.replace:
|
||||
path: /etc/systemd/journald.conf
|
||||
regexp: ^(?i)(\s*storage=)
|
||||
replace: '#\1'
|
||||
Loading…
Add table
Add a link
Reference in a new issue