forked from ansible-lockdown/RHEL9-CIS
section1 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
cf4376f1f7
commit
8b58d71e4b
47 changed files with 2181 additions and 1707 deletions
|
|
@ -1,66 +1,303 @@
|
|||
---
|
||||
|
||||
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled"
|
||||
block:
|
||||
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install squashfs(\\s|$)"
|
||||
line: "install squashfs /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist squashfs(\\s|$)"
|
||||
line: "blacklist squashfs"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
|
||||
community.general.modprobe:
|
||||
name: squashfs
|
||||
state: absent
|
||||
when: not system_is_container
|
||||
|
||||
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_1
|
||||
- rhel9cis_rule_1_1_1_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- rule_1.1.1.1
|
||||
- squashfs
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disabled"
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.1
|
||||
- cramfs
|
||||
block:
|
||||
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disable | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install udf(\\s|$)"
|
||||
line: "install udf /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install cramfs(\\s|$)"
|
||||
line: "install cramfs /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disabled | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist udf(\\s|$)"
|
||||
line: "blacklist udf"
|
||||
create: true
|
||||
mode: '0600'
|
||||
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist cramfs(\\s|$)"
|
||||
line: "blacklist cramfs"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"
|
||||
community.general.modprobe:
|
||||
name: udf
|
||||
state: absent
|
||||
when: not system_is_container
|
||||
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Disable cramfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: cramfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_2
|
||||
- rhel9cis_rule_1_1_1_2
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- rule_1.1.1.2
|
||||
- udf
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.2
|
||||
- freevxfs
|
||||
block:
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install freevxfs(\\s|$)"
|
||||
line: "install freevxfs /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist freevxfs(\\s|$)"
|
||||
line: "blacklist freevxfs"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: freevxfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.3
|
||||
- hfs
|
||||
block:
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install hfs(\\s|$)"
|
||||
line: "install hfs /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist hfs(\\s|$)"
|
||||
line: "blacklist hfs"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: hfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.4
|
||||
- hfsplus
|
||||
block:
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install hfsplus(\\s|$)"
|
||||
line: "install hfsplus /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist hfsplus(\\s|$)"
|
||||
line: "blacklist hfsplus"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: hfsplus
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.5
|
||||
- jffs2
|
||||
block:
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install jffs2(\\s|$)"
|
||||
line: "install jffs2 /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist jffs2(\\s|$)"
|
||||
line: "blacklist jffs2"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: jffs2
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_6
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- rule_1.1.1.6
|
||||
- squashfs
|
||||
block:
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install squashfs(\\s|$)"
|
||||
line: "install squashfs /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist squashfs(\\s|$)"
|
||||
line: "blacklist squashfs"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: squashfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_7
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- rule_1.1.1.7
|
||||
- udf
|
||||
block:
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install udf(\\s|$)"
|
||||
line: "install udf /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist udf(\\s|$)"
|
||||
line: "blacklist udf"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Disable udf"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: udf
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_8
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- patch
|
||||
- rule_1.1.1.8
|
||||
- usb
|
||||
block:
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Edit modprobe config"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/CIS.conf
|
||||
regexp: "^(#)?install usb-storage(\\s|$)"
|
||||
line: "install usb-storage /bin/true"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | blacklist"
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/modprobe.d/blacklist.conf
|
||||
regexp: "^(#)?blacklist usb-storage(\\s|$)"
|
||||
line: "blacklist usb-storage"
|
||||
create: true
|
||||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
|
||||
when:
|
||||
- not system_is_container
|
||||
community.general.modprobe:
|
||||
name: usb-storage
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.9 | PATCH | Ensure unused filesystems kernel modules are not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_9
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_1.1.1.9
|
||||
- usb
|
||||
vars:
|
||||
warn_control_id: '1.1.1.9'
|
||||
block:
|
||||
- name: "1.1.1.9 | PATCH | Ensure unused filesystems kernel modules are not available | Add discovery script"
|
||||
ansible.builtin.template:
|
||||
src: fs_with_cves.sh
|
||||
dest: /var/fs_with_cves.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0744'
|
||||
|
||||
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Run discovery script"
|
||||
ansible.builtin.shell: /var/fs_with_cves.sh
|
||||
changed_when: false
|
||||
failed_when: discovered_fs_modules_loaded.rc not in [ 0, 99 ]
|
||||
register: discovered_fs_modules_loaded
|
||||
|
||||
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Output Warning"
|
||||
when: discovered_fs_modules_loaded.stdout | length > 0
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
"Warning!! Discovered loaded Filesystem modules that need attention. This is a manual task
|
||||
{{ discovered_fs_modules_loaded.stdout_lines}}"
|
||||
|
||||
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Capture Warning"
|
||||
when: discovered_fs_modules_loaded.stdout | length > 0
|
||||
ansible.builtin.import_tasks:
|
||||
file: warning_facts.yml
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue