sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

section1 v2 initial

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-07-19 17:01:23 +01:00
parent cf4376f1f7
commit 8b58d71e4b
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
47 changed files with 2181 additions and 1707 deletions
Download patch file Download diff file Expand all files Collapse all files

6
templates/etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2 Normal file
View file

@ -0,0 +1,6 @@
# This is a subpolicy dropping the SHA1 hash and signature support
# Carried out as part of CIS Benchmark
hash = -SHA1
sign = -*-SHA1
sha1_in_certs = 0

5
templates/etc/crypto-policies/policies/modules/NO-SSHCBC.pmod.j2 Normal file
View file

@ -0,0 +1,5 @@
# This is a subpolicy to disable all CBC mode ciphers
# for the SSH protocol (libssh and OpenSSH)
# Carried out as part of CIS Benchmark
cipher@SSH = -*-CBC

5
templates/etc/crypto-policies/policies/modules/NO-SSHCHACHA20.pmod.j2 Normal file
View file

@ -0,0 +1,5 @@
# This is a subpolicy to disable the chacha20-poly1305 ciphers
# for the SSH protocol (libssh and OpenSSH)
# Carried out as part of CIS Benchmark
cipher@SSH = -CHACHA20-POLY1305

5
templates/etc/crypto-policies/policies/modules/NO-SSHETM.pmod.j2 Normal file
View file

@ -0,0 +1,5 @@
# This is a subpolicy to disable Encrypt then MAC
# for the SSH protocol (libssh and OpenSSH)
# Carried out as part of CIS Benchmark
etm@SSH = DISABLE_ETM

4
templates/etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod.j2 Normal file
View file

@ -0,0 +1,4 @@
# This is a subpolicy to disable weak macs
# Carried out as part of CIS Benchmark
mac = -*-64