From acdb56a2770b3d464759b4bfc195db0f444a69c1 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Fri, 14 Oct 2022 12:20:05 +0100 Subject: [PATCH] updated for readthedocs Signed-off-by: Mark Bolwell --- README.md | 57 ++++++------------------------------------------------- 1 file changed, 6 insertions(+), 51 deletions(-) diff --git a/README.md b/README.md index 4c7324b..00d5a39 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,7 @@ On our [Discord Server](https://discord.io/ansible-lockdown) to ask questions, d ## Caution(s) -This role **will make changes to the system** which may have unintended concequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted. +This role **will make changes to the system** which may have unintended concequences. This role was developed against a clean install of the Operating System. If you are implimenting to an existing system please review this role for any site specific changes that are needed. @@ -29,23 +29,11 @@ To use release version please point to main branch ## Documentation +- [Readthedocs](https://ansible-lockdown.readthedocs.io/en/latest/) - [Getting Started](https://www.lockdownenterprise.com/docs/getting-started-with-lockdown) - [Customizing Roles](https://www.lockdownenterprise.com/docs/customizing-lockdown-enterprise) - [Per-Host Configuration](https://www.lockdownenterprise.com/docs/per-host-lockdown-enterprise-configuration) - [Getting the Most Out of the Role](https://www.lockdownenterprise.com/docs/get-the-most-out-of-lockdown-enterprise) -- [Wiki](https://github.com/ansible-lockdown/RHEL9-CIS/wiki) -- [Repo GitHub Page](https://ansible-lockdown.github.io/RHEL9-CIS/) - -## Auditing (new) - -This can be turned on or off within the defaults/main.yml file with the variable rhel9cis_run_audit. The value is false by default, please refer to the wiki for more details. - -This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings. - -A new form of auditing has been develeoped, by using a small (12MB) go binary called [goss](https://github.com/aelsabbahy/goss) along with the relevant configurations to check. Without the need for infrastructure or other tooling. -This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove [false positives](https://www.mindpointgroup.com/blog/is-compliance-scanning-still-relevant/) in the process. - -Refer to [RHEL9-CIS-Audit](https://github.com/ansible-lockdown/RHEL9-CIS-Audit). ## Requirements @@ -62,8 +50,10 @@ Rocky 9 - [Ansible Getting Started](https://docs.ansible.com/ansible/latest/user_guide/intro_getting_started.html) - [Tower User Guide](https://docs.ansible.com/ansible-tower/latest/html/userguide/index.html) - [Ansible Community Info](https://docs.ansible.com/ansible/latest/community/index.html) + - Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup. -- Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file or the [Main Variables Wiki Page](https://github.com/ansible-lockdown/RHEL9-CIS/wiki/Main-Variables). +- Please read through the tasks in this role to gain an understanding of what each control is doing. + - Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file ## Dependencies @@ -71,6 +61,7 @@ Rocky 9 - Ansible 2.9+ - python-def (should be included in RHEL 9) - libselinux-python +- jmespath ## Role Variables @@ -92,39 +83,3 @@ Below is an example of the tag section from a control within this role. Using th - patch - rule_2.2.4 ``` - -## Example Audit Summary - -This is based on a vagrant image with selections enabled. e.g. No Gui or firewall. -Note: More tests are run during audit as we check config and running state. - -```txt - -ok: [default] => { - "msg": [ - "The pre remediation results are: ['Total Duration: 5.454s', 'Count: 338, Failed: 47, Skipped: 5'].", - "The post remediation results are: ['Total Duration: 5.007s', 'Count: 338, Failed: 46, Skipped: 5'].", - "Full breakdown can be found in /var/tmp", - "" - ] -} - -PLAY RECAP ******************************************************************************************************************************************* -default : ok=270 changed=23 unreachable=0 failed=0 skipped=140 rescued=0 ignored=0 -``` - -## Branches - -- devel - This is the default branch and the working development branch. Community pull requests will pull into this branch -- main - This is the release branch -- reports - This is a protected branch for our scoring reports, no code should ever go here -- all other branches** - Individual community member branches - -## Community Contribution - -We encourage you (the community) to contribute to this role. Please read the rules below. - -- Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge. -- All community Pull Requests are pulled into the devel branch -- Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved -- Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release