sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

quoted file mode

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-09-21 16:25:59 +01:00
parent 35dfa8770a
commit e82b2cefac
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
20 changed files with 63 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tasks/section_1/cis_1.1.1.x.yml
View file

@ -8,7 +8,7 @@
regexp: "^(#)?install squashfs(\\s|$)"
line: "install squashfs /bin/true"
create: true
mode: 0600
mode: '0600'
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | blacklist"
ansible.builtin.lineinfile:
@ -16,7 +16,7 @@
regexp: "^(#)?blacklist squashfs(\\s|$)"
line: "blacklist squashfs"
create: true
mode: 0600
mode: '0600'
- name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
community.general.modprobe:
@ -41,7 +41,7 @@
regexp: "^(#)?install udf(\\s|$)"
line: "install udf /bin/true"
create: true
mode: 0600
mode: '0600'
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disabled | blacklist"
ansible.builtin.lineinfile:
@ -49,7 +49,7 @@
regexp: "^(#)?blacklist udf(\\s|$)"
line: "blacklist udf"
create: true
mode: 0600
mode: '0600'
- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"
community.general.modprobe:

2
tasks/section_1/cis_1.1.2.x.yml
View file

@ -63,7 +63,7 @@
dest: /etc/systemd/system/tmp.mount
owner: root
group: root
mode: 0644
mode: '0644'
notify: Systemd restart tmp.mount
when:
- rhel9cis_tmp_svc

4
tasks/section_1/cis_1.1.x.yml
View file

@ -10,7 +10,7 @@
create: true
owner: root
group: root
mode: 0600
mode: '0600'
- name: "1.1.9 | PATCH | Disable USB Storage | Edit modprobe config"
community.general.modprobe:
@ -24,7 +24,7 @@
regexp: "^(#)?blacklist usb-storage(\\s|$)"
line: "blacklist usb-storage"
create: true
mode: 0600
mode: '0600'
when:
- rhel9cis_rule_1_1_9
tags:

2
tasks/section_1/cis_1.4.x.yml
View file

@ -6,7 +6,7 @@
content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}" # noqa template-instead-of-copy
owner: root
group: root
mode: 0600
mode: '0600'
notify: Grub2cfg
when:
- rhel9cis_set_boot_pass

12
tasks/section_1/cis_1.7.x.yml
View file

@ -6,7 +6,7 @@
dest: /etc/motd
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_1
tags:
@ -22,7 +22,7 @@
dest: /etc/issue
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_2
tags:
@ -37,7 +37,7 @@
dest: /etc/issue.net
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_3
tags:
@ -52,7 +52,7 @@
path: /etc/motd
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_4
tags:
@ -67,7 +67,7 @@
path: /etc/issue
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_5
tags:
@ -82,7 +82,7 @@
path: /etc/issue.net
owner: root
group: root
mode: 0644
mode: '0644'
when:
- rhel9cis_rule_1_7_6
tags:

24
tasks/section_1/cis_1.8.x.yml
View file

@ -25,7 +25,7 @@
create: true
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
loop:
- { regexp: 'user-db', line: 'user-db:user' }
@ -38,7 +38,7 @@
dest: /etc/dconf/db/gdm.d/01-banner-message
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
when:
- rhel9cis_rule_1_8_2
@ -59,7 +59,7 @@
create: true
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
loop:
- { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
@ -87,7 +87,7 @@
create: true
owner: root
group: root
mode: 0644
mode: '0644'
loop:
- { regexp: '^user-db', line: 'user-db: user' }
- { regexp: '^system-db', line: 'system-db: local' }
@ -97,7 +97,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d"
owner: root
group: root
mode: 0755
mode: '0755'
state: directory
- name: "1.8.4 | PATCH | Ensure GDM screen locks when the user is idle | Make conf file"
@ -125,7 +125,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: 0755
mode: '0755'
state: directory
- name: "1.8.5 | PATCH | Ensure GDM screen locks cannot be overridden | Make lock file"
@ -134,7 +134,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-screensaver"
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
when:
- rhel9cis_rule_1_8_5
@ -171,7 +171,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: 0755
mode: '0755'
state: directory
- name: "1.8.7 | PATCH | Ensure GDM disabling automatic mounting of removable media is not overridden | Make lock file"
@ -180,7 +180,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-automount_lock"
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
when:
- rhel9cis_rule_1_8_7
@ -199,7 +199,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d"
owner: root
group: root
mode: 0755
mode: '0755'
state: directory
- name: "1.8.8 | PATCH | Ensure GDM autorun-never is enabled | Make conf file"
@ -227,7 +227,7 @@
path: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks"
owner: root
group: root
mode: 0755
mode: '0755'
state: directory
- name: "1.8.9 | PATCH | Ensure GDM autorun-never is not overridden | Make lockfile"
@ -236,7 +236,7 @@
dest: "/etc/dconf/db/{{ rhel9cis_dconf_db_name }}.d/locks/00-autorun_lock"
owner: root
group: root
mode: 0644
mode: '0644'
notify: Reload dconf
when:
- rhel9cis_rule_1_8_9