forked from ansible-lockdown/RHEL9-CIS
section_1 updates
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
c96271ea7a
commit
efdcb0b6f5
10 changed files with 782 additions and 0 deletions
77
tasks/section_1/cis_1.1.2.x.yml
Normal file
77
tasks/section_1/cis_1.1.2.x.yml
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
---
|
||||
|
||||
- name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition"
|
||||
debug:
|
||||
msg: "WARNING!! /tmp is not mounted on a separate partition"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_2_1
|
||||
- ansible_mounts | selectattr('mount', 'match', '^/tmp$') | list | length == 0
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.2.1
|
||||
|
||||
# via fstab
|
||||
- name: |
|
||||
"1.1.2.2 | PATCH | Ensure nodev option set on /tmp partition"
|
||||
"1.1.2.3 | PATCH | Ensure noexec option set on /tmp partition"
|
||||
"1.1.2.4 | PATCH | Ensure nosuid option set on /tmp partition"
|
||||
mount:
|
||||
name: /tmp
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_2_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_2_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_2_4 %}nosuid{% endif %}
|
||||
notify: remount tmp
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
when:
|
||||
- item.mount == "/tmp"
|
||||
- not rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- rule_1.1.2.2
|
||||
- rule_1.1.2.3
|
||||
- rule_1.1.2.4
|
||||
|
||||
# via systemd
|
||||
- name: |
|
||||
"1.1.2.1 | PATCH | Ensure /tmp is configured"
|
||||
"1.1.2.2 | PATCH | Ensure nodev option set on /tmp partition"
|
||||
"1.1.2.3 | PATCH | Ensure noexec option set on /tmp partition"
|
||||
"1.1.2.4 | PATCH | Ensure nosuid option set on /tmp partition"
|
||||
template:
|
||||
src: etc/systemd/system/tmp.mount.j2
|
||||
dest: /etc/systemd/system/tmp.mount
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: systemd restart tmp.mount
|
||||
when:
|
||||
- rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_1 or
|
||||
rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- scored
|
||||
- patch
|
||||
- mounts
|
||||
- rule_1.1.2.1
|
||||
- rule_1.1.2.2
|
||||
- rule_1.1.2.3
|
||||
- rule_1.1.2.4
|
||||
63
tasks/section_1/cis_1.1.3.x.yml
Normal file
63
tasks/section_1/cis_1.1.3.x.yml
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
---
|
||||
|
||||
- name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var"
|
||||
block:
|
||||
- name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Absent"
|
||||
debug:
|
||||
msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: var_mount_absent
|
||||
changed_when: var_mount_absent.skipped is undefined
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
|
||||
- name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Present"
|
||||
debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: var_mount_present
|
||||
when:
|
||||
- required_mount in mount_names
|
||||
vars:
|
||||
required_mount: '/var'
|
||||
when:
|
||||
- rhel9cis_rule_1_1_3_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- rule_1.1.3.1
|
||||
|
||||
# skips if mount is absent
|
||||
- name: |
|
||||
"1.1.3.2 | PATCH | Ensure nodev option set on /var partition"
|
||||
"1.1.3.3 | PATCH | Ensure noexec option set on /var partition"
|
||||
"1.1.3.4 | PATCH | Ensure nosuid option set on /var partition"
|
||||
mount:
|
||||
name: /var
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_3_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_3_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_3_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- var_mount_present is defined
|
||||
- item.mount == "/var"
|
||||
- rhel9cis_rule_1_1_3_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_3_2 or
|
||||
rhel9cis_rule_1_1_3_3 or
|
||||
rhel9cis_rule_1_1_3_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- skip_ansible_lint
|
||||
- rule_1.1.3.2
|
||||
- rule_1.1.3.3
|
||||
- rule_1.1.3.4
|
||||
64
tasks/section_1/cis_1.1.4.x.yml
Normal file
64
tasks/section_1/cis_1.1.4.x.yml
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
---
|
||||
|
||||
# Skips if mount is absent
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp"
|
||||
block:
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Absent"
|
||||
debug:
|
||||
msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: var_tmp_mount_absent
|
||||
changed_when: var_tmp_mount_absent.skipped is undefined
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Present"
|
||||
debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: var_tmp_mount_present
|
||||
when:
|
||||
- required_mount in mount_names
|
||||
vars:
|
||||
required_mount: '/var/tmp'
|
||||
when:
|
||||
- rhel9cis_rule_1_1_4_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.4.1
|
||||
|
||||
# skips if mount is absent
|
||||
- name: |
|
||||
"1.1.4.2 | PATCH | Ensure noexec option set on /var/tmp partition"
|
||||
"1.1.4.3 | PATCH | Ensure nosuid option set on /var/tmp partition"
|
||||
"1.1.4.4 | PATCH | Ensure nodev option set on /var/tmp partition"
|
||||
mount:
|
||||
name: /var/tmp
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_4 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- var_tmp_mount_present is defined
|
||||
- item.mount == "/var/tmp"
|
||||
- rhel9cis_rule_1_1_4_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_4_2 or
|
||||
rhel9cis_rule_1_1_4_3 or
|
||||
rhel9cis_rule_1_1_4_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- skip_ansible_lint
|
||||
- rule_1.1.4.2
|
||||
- rule_1.1.4.3
|
||||
- rule_1.1.4.4
|
||||
62
tasks/section_1/cis_1.1.5.x.yml
Normal file
62
tasks/section_1/cis_1.1.5.x.yml
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
---
|
||||
|
||||
- name: "1.1.5.1 | AUDIT | Ensure separate partition exists for /var/log"
|
||||
block:
|
||||
- name: "1.1.5.1 | AUDIT | Ensure separate partition exists for /var/log | Absent"
|
||||
debug:
|
||||
msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: var_log_mount_absent
|
||||
changed_when: var_log_mount_absent.skipped is undefined
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
- name: "1.1.5.1 | AUDIT | Ensure separate partition exists for /var/log | Present"
|
||||
debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: var_log_mount_present
|
||||
when:
|
||||
- required_mount in mount_names
|
||||
vars:
|
||||
required_mount: '/var/log'
|
||||
when:
|
||||
- rhel9cis_rule_1_1_5_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.5.1
|
||||
- skip_ansible_lint
|
||||
|
||||
- name: |
|
||||
"1.1.5.2 | PATCH | Ensure nodev option set on /var/log partition"
|
||||
"1.1.5.3 | PATCH | Ensure noexec option set on /var/log partition"
|
||||
"1.1.5.4 | PATCH | Ensure nosuid option set on /var/log partition"
|
||||
mount:
|
||||
name: /var/log
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_5_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_5_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_5_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- var_log_mount_present is defined
|
||||
- item.mount == "/var/log"
|
||||
- rhel9cis_rule_1_1_5_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_5_2 or
|
||||
rhel9cis_rule_1_1_5_3 or
|
||||
rhel9cis_rule_1_1_5_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- skip_ansible_lint
|
||||
- rule_1.1.5.2
|
||||
- rule_1.1.5.3
|
||||
- rule_1.1.5.4
|
||||
61
tasks/section_1/cis_1.1.6.x.yml
Normal file
61
tasks/section_1/cis_1.1.6.x.yml
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
---
|
||||
|
||||
- name: "1.1.6.1 | AUDIT | Ensure separate partition exists for /var/log/audit"
|
||||
block:
|
||||
- name: "1.1.6.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Absent"
|
||||
debug:
|
||||
msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: var_log_audit_mount_absent
|
||||
changed_when: var_log_audit_mount_absent.skipped is undefined
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
- name: "1.1.6.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Present"
|
||||
debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: var_log_audit_mount_present
|
||||
when:
|
||||
- required_mount in mount_names
|
||||
vars:
|
||||
required_mount: '/var/log/audit'
|
||||
when:
|
||||
- rhel9cis_rule_1_1_6_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.6.1
|
||||
|
||||
- name: |
|
||||
"1.1.6.2 | PATCH | Ensure noexec option set on /var/log/audit partition"
|
||||
"1.1.6.3 | PATCH | Ensure nodev option set on /var/log/audit partition"
|
||||
"1.1.6.4 | PATCH | Ensure nosuid option set on /var/log/audit partition"
|
||||
mount:
|
||||
name: /var/log/audit
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_6_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_6_3 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_6_4 %}nosuid{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- var_log_audit_mount_present is defined
|
||||
- item.mount == "/var/log/audit"
|
||||
- rhel9cis_rule_1_1_6_1 # This is required so the check takes place
|
||||
- rhel9cis_rule_1_1_6_2 or
|
||||
rhel9cis_rule_1_1_6_3 or
|
||||
rhel9cis_rule_1_1_6_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- skip_ansible_lint
|
||||
- rule_1.1.6.2
|
||||
- rule_1.1.6.3
|
||||
- rule_1.1.6.4
|
||||
64
tasks/section_1/cis_1.1.7.x.yml
Normal file
64
tasks/section_1/cis_1.1.7.x.yml
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
---
|
||||
|
||||
- name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home"
|
||||
block:
|
||||
- name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Absent"
|
||||
debug:
|
||||
msg: "Warning! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: home_mount_absent
|
||||
changed_when: home_mount_absent.skipped is undefined
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
- name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Present"
|
||||
debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: home_mount_present
|
||||
when:
|
||||
- required_mount in mount_names
|
||||
vars:
|
||||
required_mount: '/home'
|
||||
when:
|
||||
- rhel9cis_rule_1_1_7_1
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.7.1
|
||||
- skip_ansible_lint
|
||||
|
||||
- name: |
|
||||
"1.1.7.2 | PATCH | Ensure nodev option set on /home partition
|
||||
1.1.7.3 | PATCH | Ensure nosuid option set on /home partition
|
||||
1.1.7.4 | PATCH | Ensure usrquota option set on /home partition
|
||||
1.1.7.5 | PATCH | Ensure grpquota option set on /home partition"
|
||||
mount:
|
||||
name: /home
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_7_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_7_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_7_4 %}usrquota,{% endif %}{% if rhel9cis_rule_1_1_7_5 %}grpquota{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
label: "{{ item.device }}"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- home_mount_present is defined
|
||||
- item.mount == "/home"
|
||||
- rhel9cis_rule_1_1_7_1
|
||||
- rhel9cis_rule_1_1_7_2 or
|
||||
rhel9cis_rule_1_1_7_3 or
|
||||
rhel9cis_rule_1_1_7_4 or
|
||||
rhel9cis_rule_1_1_7_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- rule_1.1.7.2
|
||||
- rule_1.1.7.3
|
||||
- rule_1.1.7.4
|
||||
- skip_ansible_lint
|
||||
43
tasks/section_1/cis_1.1.8.x.yml
Normal file
43
tasks/section_1/cis_1.1.8.x.yml
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
---
|
||||
|
||||
# Skips if mount is absent
|
||||
- name: |
|
||||
"1.1.8.1 | PATCH | Ensure nodev option set on /dev/shm partition
|
||||
1.1.8.2 | PATCH | Ensure nosuid option set on /dev/shm partition
|
||||
1.1.8.3 | PATCH | Ensure noexec option set on /dev/shm partition"
|
||||
block:
|
||||
- name: |
|
||||
"1.1.8.1 | AUDIT | Ensure nodev option set on /dev/shm partition | Check for /dev/shm existence
|
||||
1.1.8.2 | AUDIT | Ensure nosuid option set on /dev/shm partition | Check for /dev/shm existence
|
||||
1.1.8.3 | AUDIT | Ensure noexec option set on /dev/shm partition | Check for /dev/shm existence"
|
||||
shell: mount -l | grep -E '\s/dev/shm\s'
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: no
|
||||
register: rhel9cis_1_1_8_x_dev_shm_status
|
||||
|
||||
- name: |
|
||||
"1.1.8.1 | PATCH | Ensure nodev option set on /dev/shm partition | Set nodev option
|
||||
1.1.8.2 | PATCH | Ensure noexec option set on /dev/shm partition | Set nosuid option
|
||||
1.1.8.3 | PATCH | Ensure nosuid option set on /dev/shm partition | Set noexec option"
|
||||
mount:
|
||||
name: /dev/shm
|
||||
src: tmpfs
|
||||
fstype: tmpfs
|
||||
state: mounted
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_8_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_8_1 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_8_3 %}nosuid{% endif %}
|
||||
when: "'dev/shm' in rhel9cis_1_1_8_x_dev_shm_status.stdout"
|
||||
notify: change_requires_reboot
|
||||
when:
|
||||
- rhel9cis_rule_1_1_8_1 or
|
||||
rhel9cis_rule_1_1_8_2 or
|
||||
rhel9cis_rule_1_1_8_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- rule_1.1.8.1
|
||||
- rule_1.1.8.2
|
||||
- rule_1.1.8.3
|
||||
135
tasks/section_1/cis_1.6.1.x.yml
Normal file
135
tasks/section_1/cis_1.6.1.x.yml
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
---
|
||||
|
||||
- name: "1.6.1.1 | PATCH | Ensure SELinux is installed"
|
||||
package:
|
||||
name: libselinux
|
||||
state: present
|
||||
when:
|
||||
- rhel9cis_rule_1_6_1_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- rule_1.6.1.1
|
||||
|
||||
- name: "1.6.1.2 | PATCH | Ensure SELinux is not disabled in bootloader configuration"
|
||||
replace:
|
||||
dest: /etc/default/grub
|
||||
regexp: '(selinux|enforcing)\s*=\s*0\s*'
|
||||
replace: ''
|
||||
register: selinux_grub_patch
|
||||
ignore_errors: yes
|
||||
notify: grub2cfg
|
||||
when:
|
||||
- rhel9cis_rule_1_6_1_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- scored
|
||||
- patch
|
||||
- rule_1.6.1.2
|
||||
|
||||
# State set to enforcing because control 1.6.1.5 requires enforcing to be set
|
||||
- name: "1.6.1.3 | PATCH | Ensure SELinux policy is configured"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- selinux
|
||||
- patch
|
||||
- rule_1.6.1.3
|
||||
|
||||
# State set to enforcing because control 1.6.1.5 requires enforcing to be set
|
||||
- name: "1.6.1.4 | PATCH | Ensure the SELinux mode is not disabled"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- auotmated
|
||||
- selinux
|
||||
- patch
|
||||
- rule_1.6.1.4
|
||||
|
||||
- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
|
||||
selinux:
|
||||
conf: /etc/selinux/config
|
||||
policy: "{{ rhel9cis_selinux_pol }}"
|
||||
state: enforcing
|
||||
when:
|
||||
- not rhel9cis_selinux_disable
|
||||
- rhel9cis_rule_1_6_1_5
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- selinux
|
||||
- patch
|
||||
- rule_1.6.1.5
|
||||
|
||||
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist"
|
||||
block:
|
||||
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
|
||||
shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
|
||||
register: rhelcis_1_6_1_6_unconf_services
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on no unconfined services"
|
||||
debug:
|
||||
msg: "Good News! There are no services found on your system"
|
||||
when: rhelcis_1_6_1_6_unconf_services.stdout | length == 0
|
||||
|
||||
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
|
||||
debug:
|
||||
msg: "Warning! You have unconfined services: {{ rhelcis_1_6_1_6_unconf_services.stdout_lines }}"
|
||||
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
|
||||
when:
|
||||
- rhel9cis_rule_1_6_1_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- audit
|
||||
- services
|
||||
- rule_1.6.1.6
|
||||
|
||||
- name: "1.6.1.7 | PATCH | Ensure SETroubleshoot is not installed"
|
||||
package:
|
||||
name: setroubleshoot
|
||||
state: absent
|
||||
when:
|
||||
- rhel9cis_rule_1_6_1_7
|
||||
- "'setroubleshoot' in ansible_facts.packages"
|
||||
tags:
|
||||
- level1-server
|
||||
- automated
|
||||
- selinux
|
||||
- patch
|
||||
- rule_1.6.1.7
|
||||
|
||||
- name: "1.6.1.8 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
|
||||
package:
|
||||
name: mcstrans
|
||||
state: absent
|
||||
when:
|
||||
- rhel9cis_rule_1_6_1_8
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- rule_1.6.1.8
|
||||
102
tasks/section_1/cis_1.7.x.yml
Normal file
102
tasks/section_1/cis_1.7.x.yml
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
---
|
||||
|
||||
- name: "1.7.1 | PATCH | Ensure message of the day is configured properly"
|
||||
template:
|
||||
src: etc/motd.j2
|
||||
dest: /etc/motd
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- banner
|
||||
- patch
|
||||
- rule_1.7.1
|
||||
|
||||
- name: "1.7.2 | PATCH | Ensure local login warning banner is configured properly"
|
||||
template:
|
||||
src: etc/issue.j2
|
||||
dest: /etc/issue
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- rule_1.7.2
|
||||
|
||||
- name: "1.7.3 | PATCH | Ensure remote login warning banner is configured properly"
|
||||
template:
|
||||
src: etc/issue.net.j2
|
||||
dest: /etc/issue.net
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- banner
|
||||
- patch
|
||||
- rule_1.7.3
|
||||
|
||||
- name: "1.7.4 | PATCH | Ensure permissions on /etc/motd are configured"
|
||||
file:
|
||||
dest: /etc/motd
|
||||
state: file
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- perms
|
||||
- patch
|
||||
- rule_1.7.4
|
||||
|
||||
- name: "1.7.5 | PATCH | Ensure permissions on /etc/issue are configured"
|
||||
file:
|
||||
dest: /etc/issue
|
||||
state: file
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- perms
|
||||
- patch
|
||||
- rule_1.7.5
|
||||
|
||||
- name: "1.7.6 | PATCH | Ensure permissions on /etc/issue.net are configured"
|
||||
file:
|
||||
dest: /etc/issue.net
|
||||
state: file
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- rhel9cis_rule_1_7_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- perms
|
||||
- patch
|
||||
- rule_1.7.6
|
||||
111
tasks/section_1/cis_1.8.x.yml
Normal file
111
tasks/section_1/cis_1.8.x.yml
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
---
|
||||
|
||||
- name: "1.8.1 | PATCH | Ensure GNOME Display Manager is removed"
|
||||
package:
|
||||
name: gdm
|
||||
state: absent
|
||||
when:
|
||||
- rhel9cis_rule_1_8_1
|
||||
- "'gdm' in ansible_facts.packages"
|
||||
tags:
|
||||
- level2-server
|
||||
- automated
|
||||
- patch
|
||||
- gui
|
||||
- gdm
|
||||
- rule_1.8.1
|
||||
|
||||
- name: "1.8.2 | PATCH | Ensure GDM login banner is configured"
|
||||
lineinfile:
|
||||
dest: "{{ item.file }}"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
state: present
|
||||
create: yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: reload dconf
|
||||
with_items:
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-enable', line: 'banner-message-enable=true' }
|
||||
- { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel9cis_warning_banner }}' " }
|
||||
when:
|
||||
- rhel9cis_rule_1_8_2
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- gui
|
||||
- gdm
|
||||
- rule_1.8.2
|
||||
|
||||
- name: "1.8.3 | PATCH | Ensure last logged in user display is disabled"
|
||||
lineinfile:
|
||||
path: "{{ item.file }}"
|
||||
regexp: "{{ item.regexp }}"
|
||||
line: "{{ item.line }}"
|
||||
create: yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
notify: reload dconf
|
||||
with_items:
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
|
||||
- { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults'}
|
||||
- { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
|
||||
- { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: 'disable-user-list=', line: 'disable-user-list=true' }
|
||||
when:
|
||||
- rhel9cis_rule_1_8_3
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- gui
|
||||
- rule_1.8.3
|
||||
|
||||
- name: "1.8.4 | PATCH | Ensure XDMCP is not enabled"
|
||||
lineinfile:
|
||||
path: /etc/gdm/custom.conf
|
||||
regexp: 'Enable=true'
|
||||
state: absent
|
||||
when:
|
||||
- rhel9cis_rule_1_8_4
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- gui
|
||||
- rule_1.8.4
|
||||
|
||||
- name: "1.8.5 | PATCH | Ensure automatic mounting of removable media is disabled"
|
||||
lineinfile:
|
||||
path: /etc/dconf/db/local.d/00-media-automount
|
||||
regex: "{{ item.regex }}"
|
||||
line: "{{ item.line }}"
|
||||
create: yes
|
||||
notify: reload dconf
|
||||
with_items:
|
||||
- { regex: '\[org\/gnome\/desktop\/media-handling\]', line: '[org/gnome/desktop/media-handling]' }
|
||||
- { regex: 'automount=', line: 'automount=false' }
|
||||
- { regex: 'automount-open=', line: 'automount-open=false'}
|
||||
when:
|
||||
- rhel9cis_rule_1_8_5
|
||||
- rhel9cis_gui
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- patch
|
||||
- gui
|
||||
- rule_1.8.5
|
||||
Loading…
Add table
Add a link
Reference in a new issue