From 8cc3738fda2c745b73bd1f7c36342084479d5fda Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 08:23:24 +0000 Subject: [PATCH 01/13] added pre-commit badge Signed-off-by: Mark Bolwell --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index a16287d..d3bf75a 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,7 @@ ![Issues Open](https://img.shields.io/github/issues-raw/ansible-lockdown/RHEL9-CIS?label=Open%20Issues) ![Issues Closed](https://img.shields.io/github/issues-closed-raw/ansible-lockdown/RHEL9-CIS?label=Closed%20Issues&&color=success) ![Pull Requests](https://img.shields.io/github/issues-pr/ansible-lockdown/RHEL9-CIS?label=Pull%20Requests) +[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit)](https://github.com/pre-commit/pre-commit) ![License](https://img.shields.io/github/license/ansible-lockdown/RHEL9-CIS?label=License) From 48a471a037ccb4cc67658f1e50ede9d22d1d3f93 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 08:23:46 +0000 Subject: [PATCH 02/13] issue #296 thanks to @dbsanders Signed-off-by: Mark Bolwell --- tasks/section_5/cis_5.4.2.x.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/section_5/cis_5.4.2.x.yml b/tasks/section_5/cis_5.4.2.x.yml index ef15f1a..12390b3 100644 --- a/tasks/section_5/cis_5.4.2.x.yml +++ b/tasks/section_5/cis_5.4.2.x.yml @@ -190,7 +190,7 @@ regexp: \s*umask line: "umask {{ rhel9cis_root_umask }}" create: true - mode: 'u+x,go-rwx' + mode: 'u-x,go-rwx' - name: "5.4.2.7 | PATCH | Ensure system accounts do not have a valid login shell" when: From 5c919fb19da8e7216e690dca9ade67b1d523d412 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 08:27:12 +0000 Subject: [PATCH 03/13] added #298 & #299 thanks to @brent-bean Signed-off-by: Mark Bolwell --- tasks/section_6/cis_6.2.2.1.x.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/section_6/cis_6.2.2.1.x.yml b/tasks/section_6/cis_6.2.2.1.x.yml index 00e949b..945c2e4 100644 --- a/tasks/section_6/cis_6.2.2.1.x.yml +++ b/tasks/section_6/cis_6.2.2.1.x.yml @@ -17,7 +17,7 @@ name: systemd-journal-remote state: present -- name: "6.2.2.1.2 | PATCH | Ensure systemd-journal-remote authentication is configured" +- name: "6.2.2.1.2 | PATCH | Ensure systemd-journal-upload authentication is configured" when: - rhel9cis_rule_6_2_2_1_2 - not rhel9cis_system_is_log_server @@ -40,7 +40,7 @@ - { regexp: 'ServerCertificateFile=', line: 'ServerCertificateFile={{ rhel9cis_journal_servercertificatefile }}'} - { regexp: 'TrustedCertificateFile=', line: 'TrustedCertificateFile={{ rhel9cis_journal_trustedcertificatefile }}'} -- name: "6.2.2.1.3 | PATCH | Ensure systemd-journal-remote is enabled and active" +- name: "6.2.2.1.3 | PATCH | Ensure systemd-journal-upload is enabled and active" when: - not rhel9cis_system_is_log_server - rhel9cis_rule_6_2_2_1_3 From 40078515fe95fa31cab24e4bd00c3c0e7eec370c Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 11:01:35 +0000 Subject: [PATCH 04/13] updated 1.4.2 thanks to @brent-bean #300 Signed-off-by: Mark Bolwell --- handlers/main.yml | 9 ++++++++ tasks/section_1/cis_1.4.x.yml | 40 +++++++++++++++++++++++++++++++---- vars/main.yml | 3 +++ 3 files changed, 48 insertions(+), 4 deletions(-) diff --git a/handlers/main.yml b/handlers/main.yml index 3c51ddf..1a3b66e 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -144,6 +144,15 @@ state: remounted listen: "Remount /var/log/audit" +- name: "Remounting /boot/efi" + vars: + mount_point: '/boot/efi' + ansible.posix.mount: + path: "{{ mount_point }}" + state: remounted + notify: Change_requires_reboot + listen: "Remount /boot/efi" + - name: Reload sysctl ansible.builtin.command: sysctl --system changed_when: true diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml index d422f14..ee941c0 100644 --- a/tasks/section_1/cis_1.4.x.yml +++ b/tasks/section_1/cis_1.4.x.yml @@ -29,7 +29,8 @@ - rule_1.4.2 - NIST800-53R5_AC-3 block: - - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured" + - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | bios based system" + when: rhel9cis_legacy_boot ansible.builtin.file: path: "/boot/grub2/{{ item.path }}" owner: root @@ -39,6 +40,37 @@ modification_time: preserve access_time: preserve loop: - - { path: 'grub.cfg', mode: '0700' } - - { path: 'grubenv', mode: 'go-rwx' } - - { path: 'user.cfg', mode: 'go-rwx' } + - { path: 'grub.cfg', mode: 'u-x,go-rwx' } + - { path: 'grubenv', mode: 'u-x,go-rwx' } + - { path: 'user.cfg', mode: 'u-x,go-rwx' } + + - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system" + when: not rhel9cis_legacy_boot + vars: + efi_mount_options: ['umask=0077','fmask=0077','uid=0','gid=0'] + block: + - name: "1.4.2 | AUDIT | Ensure permissions on bootloader config are configured | efi based system | capture current state" + ansible.builtin.shell: grep "^[^#;]" /etc/fstab | grep '/boot/efi' | cut -d ' ' -f4 + changed_when: false + register: discovered_efi_fstab + + - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system | Build Options" + when: item not in discovered_efi_fstab.stdout + ansible.builtin.set_fact: + efi_mount_opts_addition: "{{ efi_mount_opts_addition + item + ',' }}" + loop: "{{ efi_mount_options }}" + + - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system | Add mount options" + ansible.builtin.lineinfile: + path: /etc/fstab + regexp: (.*/boot/efi\s*\w*\s*){{ discovered_efi_fstab.stdout }}(.*) + line: \1{{ discovered_efi_fstab.stdout + efi_mount_opts_addition }}\2 + backrefs: true + notify: Remount /boot/efi + + - debug: + msg: + - "{{ discovered_efi_fstab.stdout }}" + - "{{ efi_mount_opts_addition }}" + + - pause: diff --git a/vars/main.yml b/vars/main.yml index c1d0fb3..cdca90d 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -22,6 +22,9 @@ rhel9cis_allowed_crypto_policies_modules: warn_control_list: "" warn_count: 0 +# Default empty values for 1.4.2 +efi_mount_opts_addition: '' + gpg_key_package: "{{ ansible_facts.distribution | lower }}-gpg-keys" ## Controls 6.3.3.x - Audit template From d6fb1734e3a3b9b4104e19e65f91813026fe2217 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 11:27:36 +0000 Subject: [PATCH 05/13] fixed thanks to @brent-bean #301 Signed-off-by: Mark Bolwell --- templates/audit/99_auditd.rules.j2 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/templates/audit/99_auditd.rules.j2 b/templates/audit/99_auditd.rules.j2 index b9e632c..66ef19d 100644 --- a/templates/audit/99_auditd.rules.j2 +++ b/templates/audit/99_auditd.rules.j2 @@ -23,6 +23,7 @@ -w {{ rhel9cis_sudolog_location }} -p wa -k sudo_log_file {% endif %} {% if rhel9cis_rule_6_3_3_4 %} +{% set syscalls = ["adjtimex","settimeofday"] %} {% set arch_syscalls = [] %} {% for syscall in syscalls %} {% if syscall in supported_syscalls %} @@ -31,6 +32,14 @@ {% endfor %} -a always,exit -F arch=b64 -S {{ arch_syscalls|join(',') }} -k time-change -a always,exit -F arch=b32 -S {{ arch_syscalls|join(',') }} -k time-change +{% set syscalls = ["clock_settime"] %} +{% set arch_syscalls = [] %} +{% for syscall in syscalls %} +{% if syscall in supported_syscalls %} +{{ arch_syscalls.append(syscall) }} +-a always,exit -F arch=b64 -S {{ arch_syscalls|join(',') }} -F a0=0x0 -k time-change +{% endif %} +{% endfor %} -w /etc/localtime -p wa -k time-change {% endif %} {% if rhel9cis_rule_6_3_3_5 %} From 12be5388ffb49d508a49b4fb3dd0278b6ae9f639 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 12:26:19 +0000 Subject: [PATCH 06/13] improved logic Signed-off-by: Mark Bolwell --- tasks/section_1/cis_1.4.x.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml index ee941c0..004bfca 100644 --- a/tasks/section_1/cis_1.4.x.yml +++ b/tasks/section_1/cis_1.4.x.yml @@ -50,7 +50,7 @@ efi_mount_options: ['umask=0077','fmask=0077','uid=0','gid=0'] block: - name: "1.4.2 | AUDIT | Ensure permissions on bootloader config are configured | efi based system | capture current state" - ansible.builtin.shell: grep "^[^#;]" /etc/fstab | grep '/boot/efi' | cut -d ' ' -f4 + ansible.builtin.shell: grep "^[^#;]" /etc/fstab | grep '/boot/efi' | awk -F" " '{print $4}' changed_when: false register: discovered_efi_fstab @@ -67,10 +67,3 @@ line: \1{{ discovered_efi_fstab.stdout + efi_mount_opts_addition }}\2 backrefs: true notify: Remount /boot/efi - - - debug: - msg: - - "{{ discovered_efi_fstab.stdout }}" - - "{{ efi_mount_opts_addition }}" - - - pause: From ed1bc1c074ad0c626d6a184f141f3712bd96db50 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 12:26:46 +0000 Subject: [PATCH 07/13] 7.1.10 extended in case file absent Signed-off-by: Mark Bolwell --- tasks/section_7/cis_7.1.x.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tasks/section_7/cis_7.1.x.yml b/tasks/section_7/cis_7.1.x.yml index 83c83a0..b23fb89 100644 --- a/tasks/section_7/cis_7.1.x.yml +++ b/tasks/section_7/cis_7.1.x.yml @@ -169,6 +169,8 @@ owner: root group: root mode: 'u-x,go-wx' + failed_when: discovered_file_exists.state not in '[ file, absent ]' + register: discovered_file_exists - name: "7.1.11 | PATCH | Ensure world writable files and directories are secured" when: From 8cd7d765c52737bc334599be7fd923299cef19c2 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 12:26:58 +0000 Subject: [PATCH 08/13] updated layout Signed-off-by: Mark Bolwell --- templates/audit/99_auditd.rules.j2 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/templates/audit/99_auditd.rules.j2 b/templates/audit/99_auditd.rules.j2 index 66ef19d..4d9c0d3 100644 --- a/templates/audit/99_auditd.rules.j2 +++ b/templates/audit/99_auditd.rules.j2 @@ -37,6 +37,7 @@ {% for syscall in syscalls %} {% if syscall in supported_syscalls %} {{ arch_syscalls.append(syscall) }} +-a always,exit -F arch=b32 -S {{ arch_syscalls|join(',') }} -F a0=0x0 -k time-change -a always,exit -F arch=b64 -S {{ arch_syscalls|join(',') }} -F a0=0x0 -k time-change {% endif %} {% endfor %} @@ -50,8 +51,8 @@ {{ arch_syscalls.append(syscall) }} {% endif %} {% endfor %} --a always,exit -F arch=b64 -S {{ arch_syscalls|join(',') }} -k system-locale --a always,exit -F arch=b32 -S {{ arch_syscalls|join(',') }} -k system-locale +-a always,exit -F arch=b64 -S {{ arch_syscalls|join(',') }} -k system-locale +-a always,exit -F arch=b32 -S {{ arch_syscalls|join(',') }} -k system-locale -w /etc/issue -p wa -k system-locale -w /etc/issue.net -p wa -k system-locale -w /etc/hosts -p wa -k system-locale @@ -178,7 +179,7 @@ -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>={{ prelim_min_int_uid }} -F auid!=unset -k perm_chng {% endif %} {% if rhel9cis_rule_6_3_3_17 %} --a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>={{ prelim_min_int_uid }} -F auid!=unset -k priv_chng +-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>={{ prelim_min_int_uid }} -F auid!=unset -k perm_chng {% endif %} {% if rhel9cis_rule_6_3_3_18 %} -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>={{ prelim_min_int_uid }} -F auid!=unset -k usermod From 5a612675e2e8ca9e03a8281c390b0cde8c9e1f29 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 14:04:01 +0000 Subject: [PATCH 09/13] improve authselect logic Signed-off-by: Mark Bolwell --- tasks/main.yml | 8 +------- tasks/section_5/cis_5.3.2.x.yml | 4 +--- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/tasks/main.yml b/tasks/main.yml index 2e5049c..a0a58f8 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -116,17 +116,11 @@ fail_msg: "You still have the default name for your authselect profile" - name: "Check authselect profile is selected | Check current profile" - ansible.builtin.shell: authselect current | head -1 | awk '{print $NF}' + ansible.builtin.shell: authselect list changed_when: false failed_when: prelim_authselect_current_profile.rc not in [ 0, 1 ] register: prelim_authselect_current_profile - - name: "Check authselect profile is selected | Ensure profile name is set" - ansible.builtin.assert: - that: prelim_authselect_current_profile is defined - success_msg: "Authselect is running and profile is selected" - fail_msg: Authselect updates have been selected there are issues with profile selection" - - name: "Ensure root password is set" when: rhel9cis_rule_5_4_2_4 tags: diff --git a/tasks/section_5/cis_5.3.2.x.yml b/tasks/section_5/cis_5.3.2.x.yml index eadb9b5..5917019 100644 --- a/tasks/section_5/cis_5.3.2.x.yml +++ b/tasks/section_5/cis_5.3.2.x.yml @@ -14,9 +14,7 @@ - rule_5.3.2.1 block: - name: "5.3.2.1 | PATCH | Ensure active authselect profile includes pam modules | Create custom profiles" - when: - - rhel9cis_authselect_custom_profile_name not in prelim_authselect_current_profile.stdout or - prelim_authselect_current_profile.stdout is not defined + when: rhel9cis_authselect_custom_profile_name not in prelim_authselect_current_profile.stdout ansible.builtin.command: "/usr/bin/authselect create-profile {{ rhel9cis_authselect_custom_profile_name }} -b {{ rhel9cis_authselect_default_profile_to_copy }}" changed_when: false args: From 74f17b7ee8e052f11cb2d830fd3d1c4c7573dea1 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 14:04:13 +0000 Subject: [PATCH 10/13] updated logic Signed-off-by: Mark Bolwell --- tasks/section_6/cis_6.2.4.1.yml | 42 ++++++++++++++------------------- 1 file changed, 18 insertions(+), 24 deletions(-) diff --git a/tasks/section_6/cis_6.2.4.1.yml b/tasks/section_6/cis_6.2.4.1.yml index 814c46c..9e8b9b3 100644 --- a/tasks/section_6/cis_6.2.4.1.yml +++ b/tasks/section_6/cis_6.2.4.1.yml @@ -8,6 +8,8 @@ - patch - logfiles - rule_6.2.4.1 + - NIST800-53R5_AC-3 + - NIST800-53R5_MP-2 block: - name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | find log files" ansible.builtin.shell: find /var/log/ -type f -exec ls {} \; @@ -15,43 +17,35 @@ failed_when: false register: discovered_logfiles - - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions" + - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions SSSD min 660" when: - discovered_logfiles.stdout_lines | length > 0 - - ('audit.log' in item or 'journal' in item) or - item == '/var/log/secure' or - item == '/var/log/syslog' or - item == '/var/log/messages' or - item == '/var/log/auth.log' + - item is match("/var/log/(gdm|sssd)") ansible.builtin.file: path: "{{ item }}" - mode: 'u-x,g-wx,o-rwx' + mode: 'ug-x,o-rwx' failed_when: discovered_logfile_list.state not in '[ file, absent ]' register: discovered_logfile_list loop: "{{ discovered_logfiles.stdout_lines }}" - - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions" + - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions tmp min 664" when: - discovered_logfiles.stdout_lines | length > 0 - - ('anaconda' in item or 'dnf' in item or 'secure' in item or 'messages' in item or 'hawkey' in item) - ansible.builtin.file: - path: "{{ item }}" - mode: 'u-x,g-x,o-rwx' - failed_when: discovered_logfile_list.state not in '[ file, absent ]' - register: discovered_logfile_list - loop: "{{ discovered_logfiles.stdout_lines }}" - - - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions" - when: - - discovered_logfiles.stdout_lines | length > 0 - - ('sssd' in item or 'lastlog' in item) or - item == "/var/log/btmp" or - item == "/var/log/utmp" or - item == "/var/log/wtmp" or - item == "/var/log/lastlog" + - item is match("/var/log/((u|b|w)tmp*|lastlog)") ansible.builtin.file: path: "{{ item }}" mode: 'ug-x,o-wx' failed_when: discovered_logfile_list.state not in '[ file, absent ]' register: discovered_logfile_list loop: "{{ discovered_logfiles.stdout_lines }}" + + - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions else all 640" + when: + - discovered_logfiles.stdout_lines | length > 0 + - item is not match("/var/log/((u|b|w)tmp*|lastlog|sssd)") + ansible.builtin.file: + path: "{{ item }}" + mode: 'u-x,g-wx,o-rwx' + failed_when: discovered_logfile_list.state not in '[ file, absent ]' + register: discovered_logfile_list + loop: "{{ discovered_logfiles.stdout_lines }}" From 4d8cc6eb607ebc8d7f3b481de0736763a118acea Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Feb 2025 14:04:22 +0000 Subject: [PATCH 11/13] updated minclass Signed-off-by: Mark Bolwell --- defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defaults/main.yml b/defaults/main.yml index f5c38b1..da5ca20 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -923,7 +923,7 @@ rhel9cis_passwd_complex_file: etc/security/pwquality.conf.d/50-pwcomplexity.conf # Options are: minclass or credits # ensure only one is selected rhel9cis_passwd_complex_option: minclass # pragma: allowlist secret -rhel9cis_passwd_minclass: 3 +rhel9cis_passwd_minclass: 4 # rhel9cis_passwd_complex: credits rhel9cis_passwd_dcredit: -1 rhel9cis_passwd_ucredit: -2 From 1bfde74ad6ce5385fbdfc2f9d99456f66d6a3f67 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 27 Feb 2025 13:02:54 +0000 Subject: [PATCH 12/13] Improve logic Signed-off-by: Mark Bolwell --- tasks/section_1/cis_1.4.x.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml index 004bfca..8d8c21b 100644 --- a/tasks/section_1/cis_1.4.x.yml +++ b/tasks/section_1/cis_1.4.x.yml @@ -57,10 +57,11 @@ - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system | Build Options" when: item not in discovered_efi_fstab.stdout ansible.builtin.set_fact: - efi_mount_opts_addition: "{{ efi_mount_opts_addition + item + ',' }}" + efi_mount_opts_addition: "{{ efi_mount_opts_addition + ',' + item }}" loop: "{{ efi_mount_options }}" - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system | Add mount options" + when: efi_mount_opts_addition | length > 0 ansible.builtin.lineinfile: path: /etc/fstab regexp: (.*/boot/efi\s*\w*\s*){{ discovered_efi_fstab.stdout }}(.*) From a1a719fbe7026dbf0d550bc8b394a09fac7b1890 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 27 Feb 2025 13:47:25 +0000 Subject: [PATCH 13/13] lint update Signed-off-by: Mark Bolwell --- tasks/section_1/cis_1.4.x.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml index 8d8c21b..d3534cd 100644 --- a/tasks/section_1/cis_1.4.x.yml +++ b/tasks/section_1/cis_1.4.x.yml @@ -47,7 +47,7 @@ - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured | efi based system" when: not rhel9cis_legacy_boot vars: - efi_mount_options: ['umask=0077','fmask=0077','uid=0','gid=0'] + efi_mount_options: ['umask=0077', 'fmask=0077', 'uid=0', 'gid=0'] block: - name: "1.4.2 | AUDIT | Ensure permissions on bootloader config are configured | efi based system | capture current state" ansible.builtin.shell: grep "^[^#;]" /etc/fstab | grep '/boot/efi' | awk -F" " '{print $4}'