sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Merge branch 'lint_dec24' into alignment

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-12-11 13:36:08 +00:00
commit 82f7b53a67
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
49 changed files with 375 additions and 606 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tasks/section_3/cis_3.1.x.yml
View file

@ -65,8 +65,7 @@
file: warning_facts.yml
- name: "3.1.3 | PATCH | Ensure bluetooth services are not in use"
when:
- rhel9cis_rule_3_1_3
when: rhel9cis_rule_3_1_3
tags:
- level1-server
- level2-workstation

12
tasks/section_3/cis_3.2.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "3.2.1 | PATCH | Ensure dccp kernel module is not available"
when:
- rhel9cis_rule_3_2_1
when: rhel9cis_rule_3_2_1
tags:
- level2-server
- level2-workstation
@ -32,8 +31,7 @@
mode: 'u-x,go-rwx'
- name: "3.2.2 | PATCH | Ensure tipc kernel module is not available"
when:
- rhel9cis_rule_3_2_2
when: rhel9cis_rule_3_2_2
tags:
- level2-server
- level2-workstation
@ -63,8 +61,7 @@
mode: 'u-x,go-rwx'
- name: "3.2.3 | PATCH | Ensure rds kernel module is not available"
when:
- rhel9cis_rule_3_2_3
when: rhel9cis_rule_3_2_3
tags:
- level2-server
- level2-workstation
@ -94,8 +91,7 @@
mode: 'u-x,go-rwx'
- name: "3.2.4 | PATCH | Ensure sctp kernel module is not available"
when:
- rhel9cis_rule_3_2_4
when: rhel9cis_rule_3_2_4
tags:
- level2-server
- level2-workstation

24
tasks/section_3/cis_3.3.x.yml
View file

@ -61,8 +61,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.3 | PATCH | Ensure bogus ICMP responses are ignored"
when:
- rhel9cis_rule_3_3_3
when: rhel9cis_rule_3_3_3
tags:
- level1-server
- level1-workstation
@ -85,8 +84,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.4 | PATCH | Ensure broadcast ICMP requests are ignored"
when:
- rhel9cis_rule_3_3_4
when: rhel9cis_rule_3_3_4
tags:
- level1-server
- level1-workstation
@ -109,8 +107,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.5 | PATCH | Ensure ICMP redirects are not accepted"
when:
- rhel9cis_rule_3_3_5
when: rhel9cis_rule_3_3_5
tags:
- level1-server
- level1-workstation
@ -144,8 +141,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.6 | PATCH | Ensure secure ICMP redirects are not accepted"
when:
- rhel9cis_rule_3_3_6
when: rhel9cis_rule_3_3_6
tags:
- level1-server
- level1-workstation
@ -179,8 +175,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
when:
- rhel9cis_rule_3_3_7
when: rhel9cis_rule_3_3_7
tags:
- level1-server
- level1-workstation
@ -203,8 +198,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.8 | PATCH | Ensure source routed packets are not accepted"
when:
- rhel9cis_rule_3_3_8
when: rhel9cis_rule_3_3_8
tags:
- level1-server
- level1-workstation
@ -237,8 +231,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
- name: "3.3.9 | PATCH | Ensure suspicious packets are logged"
when:
- rhel9cis_rule_3_3_9
when: rhel9cis_rule_3_3_9
tags:
- level1-server
- level1-workstation
@ -257,8 +250,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
- name: "3.3.10 | PATCH | Ensure TCP SYN Cookies is enabled"
when:
- rhel9cis_rule_3_3_10
when: rhel9cis_rule_3_3_10
tags:
- level1-server
- level1-workstation