sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

merge_updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-12-19 16:34:04 +00:00
commit 6a29760c61
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
12 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.pre-commit-config.yaml
View file

@ -46,7 +46,7 @@ repos:
- id: gitleaks - id: gitleaks
- repo: https://github.com/ansible-community/ansible-lint - repo: https://github.com/ansible-community/ansible-lint
rev: v24.10.0 rev: v24.12.2
hooks: hooks:
- id: ansible-lint - id: ansible-lint
name: Ansible-lint name: Ansible-lint

2
README.md
View file

@ -75,7 +75,7 @@ The control found in defaults main also need to reflect this as this control the
CIS release always contains changes, it is highly recommended to review the new references and available variables. This have changed significantly since ansible-lockdown initial release. CIS release always contains changes, it is highly recommended to review the new references and available variables. This have changed significantly since ansible-lockdown initial release.
This is now compatible with python3 if it is found to be the default interpreter. This does come with pre-requisites which it configures the system accordingly. This is now compatible with python3 if it is found to be the default interpreter. This does come with pre-requisites which it configures the system accordingly.
Further details can be seen in the [Changelog](./ChangeLog.md) Further details can be seen in the [Changelog](./Changelog.md)
## Auditing (new) ## Auditing (new)

2
templates/audit/98_auditd_exception.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# This file contains users whose actions are not logged by auditd # This file contains users whose actions are not logged by auditd

2
templates/audit/99_auditd.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# This template will set all of the auditd configurations via a handler in the role in one task instead of individually # This template will set all of the auditd configurations via a handler in the role in one task instead of individually

2
templates/etc/cron.d/aide.cron.j2
View file

@ -1,7 +1,7 @@
# Run AIDE integrity check # Run AIDE integrity check
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# CIS 1.3.2 # CIS 1.3.2

2
templates/etc/dconf/db/00-automount_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling automount setting # Lock desktop media-handling automount setting
/org/gnome/desktop/media-handling/automount /org/gnome/desktop/media-handling/automount

2
templates/etc/dconf/db/00-autorun_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling settings # Lock desktop media-handling settings
/org/gnome/desktop/media-handling/autorun-never /org/gnome/desktop/media-handling/autorun-never

2
templates/etc/dconf/db/00-media-automount.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling] [org/gnome/desktop/media-handling]
automount=false automount=false

2
templates/etc/dconf/db/00-media-autorun.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling] [org/gnome/desktop/media-handling]
autorun-never=true autorun-never=true

2
templates/etc/dconf/db/00-screensaver.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
# Specify the dconf path # Specify the dconf path
[org/gnome/desktop/session] [org/gnome/desktop/session]

2
templates/etc/dconf/db/00-screensaver_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop screensaver idle-delay setting # Lock desktop screensaver idle-delay setting
/org/gnome/desktop/session/idle-delay /org/gnome/desktop/session/idle-delay

2
templates/etc/dconf/db/gdm.d/01-banner-message.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by Mindpoint Group - A Tyto Athene Company / Ansible Lockdown # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/login-screen] [org/gnome/login-screen]
banner-message-enable=true banner-message-enable=true