sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Linting

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-03-20 15:16:15 +00:00
parent 2f5709df70
commit 42b9dc9e89
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
5 changed files with 0 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

10
defaults/main.yml
View file

@ -343,7 +343,6 @@ rhel9cis_rule_6_2_14: true
rhel9cis_rule_6_2_15: true rhel9cis_rule_6_2_15: true
rhel9cis_rule_6_2_16: true rhel9cis_rule_6_2_16: true
## Section 1 vars ## Section 1 vars
#### 1.1.2 #### 1.1.2
@ -413,7 +412,6 @@ rhel9cis_selinux_enforce: enforcing
## 2. Services ## 2. Services
### 2.1 Time Synchronization ### 2.1 Time Synchronization
#### 2.1.2 Time Synchronization servers - used in template file chrony.conf.j2 #### 2.1.2 Time Synchronization servers - used in template file chrony.conf.j2
rhel9cis_time_synchronization_servers: rhel9cis_time_synchronization_servers:
@ -461,7 +459,6 @@ rhel9cis_openldap_clients_required: false
rhel9cis_tftp_client: false rhel9cis_tftp_client: false
rhel9cis_ftp_client: false rhel9cis_ftp_client: false
## Section3 vars ## Section3 vars
## Sysctl ## Sysctl
rhel9cis_sysctl_update: false rhel9cis_sysctl_update: false
@ -478,7 +475,6 @@ rhel9cis_firewall: firewalld
##### firewalld ##### firewalld
rhel9cis_default_zone: public rhel9cis_default_zone: public
# These are added to demonstrate how this can be done # These are added to demonstrate how this can be done
rhel9cis_firewalld_ports: rhel9cis_firewalld_ports:
- number: 80 - number: 80
@ -514,7 +510,6 @@ update_audit_template: false
## Advanced option found in auditd post ## Advanced option found in auditd post
rhel9cis_allow_auditd_uid_user_exclusions: false rhel9cis_allow_auditd_uid_user_exclusions: false
# This can be used to configure other keys in auditd.conf # This can be used to configure other keys in auditd.conf
rhel9cis_auditd_extra_conf: {} rhel9cis_auditd_extra_conf: {}
# Example: # Example:
@ -535,7 +530,6 @@ rhel9cis_remote_log_protocol: tcp
rhel9cis_remote_log_retrycount: 100 rhel9cis_remote_log_retrycount: 100
rhel9cis_remote_log_queuesize: 1000 rhel9cis_remote_log_queuesize: 1000
#### 4.2.1.7 #### 4.2.1.7
rhel9cis_system_is_log_server: false rhel9cis_system_is_log_server: false
@ -584,7 +578,6 @@ rhel9cis_ssh_maxsessions: 4
rhel9cis_inactivelock: rhel9cis_inactivelock:
lock_days: 30 lock_days: 30
rhel9cis_use_authconfig: false rhel9cis_use_authconfig: false
# 5.3.1/5.3.2 Custom authselect profile settings. Settings in place now will fail, they are place holders from the control example # 5.3.1/5.3.2 Custom authselect profile settings. Settings in place now will fail, they are place holders from the control example
# Due to the way many multiple options and ways to configure this control needs to be enabled and settings adjusted to minimise risk # Due to the way many multiple options and ways to configure this control needs to be enabled and settings adjusted to minimise risk
@ -599,7 +592,6 @@ rhel9cis_authselect_custom_profile_create: false
# 5.3.2 Enable automation to select custom profile options, using the settings above # 5.3.2 Enable automation to select custom profile options, using the settings above
rhel9cis_authselect_custom_profile_select: false rhel9cis_authselect_custom_profile_select: false
rhel9cis_pass: rhel9cis_pass:
max_days: 365 max_days: 365
min_days: 7 min_days: 7
@ -648,7 +640,6 @@ rhel9cis_futurepwchgdate_autofix: true
# 5.3.7 # 5.3.7
rhel9cis_sugroup: nosugroup rhel9cis_sugroup: nosugroup
## Section6 vars ## Section6 vars
# RHEL-09_6.1.1 # RHEL-09_6.1.1
@ -669,7 +660,6 @@ audit_run_script_environment:
AUDIT_FILE: 'goss.yml' AUDIT_FILE: 'goss.yml'
AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}" AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
### Goss binary settings ### ### Goss binary settings ###
goss_version: goss_version:
release: v0.3.21 release: v0.3.21

1
tasks/main.yml
View file

@ -102,7 +102,6 @@
tags: tags:
- always - always
- name: Gather the package facts - name: Gather the package facts
ansible.builtin.package_facts: ansible.builtin.package_facts:
manager: auto manager: auto

1
tasks/section_2/cis_2.2.x.yml
View file

@ -1,6 +1,5 @@
--- ---
- name: "2.2.1 | PATCH | Ensure xorg-x11-server-common is not installed" - name: "2.2.1 | PATCH | Ensure xorg-x11-server-common is not installed"
ansible.builtin.package: ansible.builtin.package:
name: xorg-x11-server-common name: xorg-x11-server-common

1
tasks/section_3/cis_3.4.2.x.yml
View file

@ -157,7 +157,6 @@
- nftables - nftables
- rule_3.4.2.4 - rule_3.4.2.4
- name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | firewalld" - name: "3.4.2.4 | PATCH | Ensure host based firewall loopback traffic is configured | firewalld"
ansible.posix.firewalld: ansible.posix.firewalld:
rich_rule: "{{ item }}" rich_rule: "{{ item }}"

4
vars/is_container.yml
View file

@ -6,14 +6,12 @@
## controls ## controls
# Firewall # Firewall
rhel9cis_firewall: None rhel9cis_firewall: None
# SElinux # SElinux
rhel9cis_selinux_disable: true rhel9cis_selinux_disable: true
## Related individual rules ## Related individual rules
# Aide # Aide
rhel9cis_rule_1_4_1: false rhel9cis_rule_1_4_1: false
@ -42,7 +40,6 @@ rhel9cis_rule_5_1_8: false
# crypto # crypto
rhel9cis_rule_1_10: false rhel9cis_rule_1_10: false
# grub # grub
rhel9cis_rule_1_5_1: false rhel9cis_rule_1_5_1: false
rhel9cis_rule_1_5_2: false rhel9cis_rule_1_5_2: false
@ -88,6 +85,5 @@ rhel9cis_rule_4_2_2_3: false
# systemd # systemd
# Users/passwords/accounts # Users/passwords/accounts
rhel9cis_rule_5_5_2: false rhel9cis_rule_5_5_2: false