sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Merge pull request #267 from ansible-lockdown/devel

Browse source 
CIS v1.0.0 final release to main
This commit is contained in:
uk-bolly 2024-12-19 15:07:56 +00:00 • committed by GitHub
commit ef2b7dca5d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
15 changed files with 23 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.pre-commit-config.yaml
View file

@ -43,7 +43,7 @@ repos:
args: ['--baseline-path', '.config/.gitleaks-report.json'] args: ['--baseline-path', '.config/.gitleaks-report.json']
- repo: https://github.com/ansible-community/ansible-lint - repo: https://github.com/ansible-community/ansible-lint
rev: v24.10.0 rev: v24.12.2
hooks: hooks:
- id: ansible-lint - id: ansible-lint
name: Ansible-lint name: Ansible-lint

2
LICENSE
View file

@ -1,6 +1,6 @@
MIT License MIT License
Copyright (c) 2023 Mindpoint Group / Lockdown Enterprise / Lockdown Enterprise Releases Copyright (c) 2025 Mindpoint Group - A Tyto Athene Company / Ansible Lockdown
Permission is hereby granted, free of charge, to any person obtaining a copy Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal of this software and associated documentation files (the "Software"), to deal

11
handlers/main.yml
View file

@ -98,8 +98,15 @@
when: when:
- auditd_immutable_check.stdout == '1' - auditd_immutable_check.stdout == '1'
- name: Restart auditd - name: Stop auditd process
ansible.builtin.shell: service auditd restart ansible.builtin.shell: systemctl kill auditd
listen: Restart auditd
- name: Start auditd process
ansible.builtin.systemd_service:
name: auditd
state: started
listen: Restart auditd
- name: Change_requires_reboot - name: Change_requires_reboot
ansible.builtin.set_fact: ansible.builtin.set_fact:

2
tasks/auditd.yml
View file

@ -23,7 +23,7 @@
ansible.builtin.import_tasks: ansible.builtin.import_tasks:
file: warning_facts.yml file: warning_facts.yml
vars: vars:
warn_control_id: 'Auditd template updated, see diff output for details' warn_control_id: 'Auditd template updated, validate as expected'
when: when:
- rhel9cis_auditd_template_updated.changed - rhel9cis_auditd_template_updated.changed
- rhel9cis_auditd_file.stat.exists - rhel9cis_auditd_file.stat.exists

2
tasks/section_1/cis_1.5.x.yml
View file

@ -18,7 +18,7 @@
- name: "1.5.2 | PATCH | Ensure core dump backtraces are disabled" - name: "1.5.2 | PATCH | Ensure core dump backtraces are disabled"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/systemd/coredump.conf path: /etc/systemd/coredump.conf
regexp: '^ProcessSizeMax\s*=\s*.*[1-9]$' regexp: '^ProcessSizeMax\s*=\s*.*[1-9].*'
line: 'ProcessSizeMax=0' line: 'ProcessSizeMax=0'
when: when:
- rhel9cis_rule_1_5_2 - rhel9cis_rule_1_5_2

2
templates/audit/98_auditd_exception.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# This file contains users whose actions are not logged by auditd # This file contains users whose actions are not logged by auditd

2
templates/audit/99_auditd.rules.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# This template will set all of the auditd configurations via a handler in the role in one task instead of individually # This template will set all of the auditd configurations via a handler in the role in one task instead of individually

2
templates/etc/cron.d/aide.cron.j2
View file

@ -1,7 +1,7 @@
# Run AIDE integrity check # Run AIDE integrity check
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
### YOUR CHANGES WILL BE LOST! ### YOUR CHANGES WILL BE LOST!
# CIS 1.3.2 # CIS 1.3.2

2
templates/etc/dconf/db/00-automount_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling automount setting # Lock desktop media-handling automount setting
/org/gnome/desktop/media-handling/automount /org/gnome/desktop/media-handling/automount

2
templates/etc/dconf/db/00-autorun_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop media-handling settings # Lock desktop media-handling settings
/org/gnome/desktop/media-handling/autorun-never /org/gnome/desktop/media-handling/autorun-never

2
templates/etc/dconf/db/00-media-automount.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling] [org/gnome/desktop/media-handling]
automount=false automount=false

2
templates/etc/dconf/db/00-media-autorun.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/desktop/media-handling] [org/gnome/desktop/media-handling]
autorun-never=true autorun-never=true

2
templates/etc/dconf/db/00-screensaver.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
# Specify the dconf path # Specify the dconf path
[org/gnome/desktop/session] [org/gnome/desktop/session]

2
templates/etc/dconf/db/00-screensaver_lock.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
# Lock desktop screensaver idle-delay setting # Lock desktop screensaver idle-delay setting
/org/gnome/desktop/session/idle-delay /org/gnome/desktop/session/idle-delay

2
templates/etc/dconf/db/gdm.d/01-banner-message.j2
View file

@ -1,6 +1,6 @@
## Ansible controlled file ## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline # Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC # provided by Mindpoint Group - A Tyto Athene Company
[org/gnome/login-screen] [org/gnome/login-screen]
banner-message-enable=true banner-message-enable=true