sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

updated controls

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-04-01 15:26:13 +01:00
parent 19a218390d
commit f0c4701dbd
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
23 changed files with 238 additions and 364 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tasks/main.yml
View file

@ -112,9 +112,11 @@
- rhel9cis_section6
tags:
- rule_5.5.2
- rule_6.2.7
- rule_6.2.8
- rule_6.2.20
- rule_5.6.2
- rule_6.2.9
- rule_6.2.10
- rule_6.2.11
- rhel9cis_section5
- rhel9cis_section6
- name: run Section 1 tasks

31
tasks/post.yml
View file

@ -66,7 +66,30 @@
- name: flush handlers
meta: flush_handlers
- name: Reboot host
reboot:
when:
- not skip_reboot
- name: POST | reboot system if changes require it and not skipped
block:
- name: POST | Reboot system if changes require it and not skipped
reboot:
when:
- change_requires_reboot
- not skip_reboot
- name: POST | Warning a reboot required but skip option set
debug:
msg: "Warning!! changes have been made that require a reboot to be implemented but skip reboot was set - Can affect compliance check results"
changed_when: true
when:
- change_requires_reboot
- skip_reboot
tags:
- grub
- level1-server
- level1-workstation
- level2-server
- level2-workstation
- rhel9cis_section1
- rhel9cis_section2
- rhel9cis_section3
- rhel9cis_section4
- rhel9cis_section5
- rhel9cis_section6

16
tasks/prelim.yml
View file

@ -32,8 +32,9 @@
warn: false
changed_when: false
check_mode: false
register: uid_zero_accounts_except_root
register: rhel9cis_uid_zero_accounts_except_root
tags:
- rule_6.2.8
- level1-server
- level1-workstation
- users
@ -144,6 +145,19 @@
- authconfig
- auditd
- name: "PRELIM | 5.3.4 | Find all sudoers files."
command: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"
changed_when: false
failed_when: false
check_mode: false
register: rhel9cis_sudoers_files
when:
- rhel9cis_rule_5_3_4 or
rhel9cis_rule_5_3_5
tags:
- rule_5.3.4
- rule_5.3.5
- name: "PRELIM | Set facts based on boot type"
block:
- name: "PRELIM | Check whether machine is UEFI-based"

9
tasks/section_2/cis_2.1.x.yml
View file

@ -2,11 +2,11 @@
- name: "2.1.1 | PATCH | Ensure time synchronization is in use"
package:
name: "{{ rhel9cis_time_synchronization }}"
name: chrony
state: present
when:
- rhel9cis_rule_2_1_1
- not rhel9cis_system_is_container
- not system_is_container
tags:
- level1-server
- level1-workstation
@ -18,7 +18,7 @@
block:
- name: "2.1.2 | PATCH | Ensure chrony is configured | Set configuration"
template:
src: chrony.conf.j2
src: etc/chrony.conf.j2
dest: /etc/chrony.conf
owner: root
group: root
@ -33,9 +33,8 @@
create: yes
mode: 0644
when:
- rhel9cis_time_synchronization == "chrony"
- rhel9cis_rule_2_1_2
- not rhel9cis_system_is_container
- not system_is_container
tags:
- level1-server
- level1-workstation

4
tasks/section_3/cis_3.2.x.yml
View file

@ -17,7 +17,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.2.1
- rhel9cis_rule_3_2_1
tags:
- level1-server
- level1-workstation
@ -42,7 +42,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.2.2
- rhel9cis_rule_3_2_2
tags:
- level1-server
- level1-workstation

18
tasks/section_3/cis_3.3.x.yml
View file

@ -17,7 +17,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.3.1
- rhel9cis_rule_3_3_1
tags:
- level1-server
- level1-workstation
@ -42,7 +42,7 @@
- update sysctl
when: rhel9cis_ipv6_required
when:
- rhel9cis_rule_3.3.2
- rhel9cis_rule_3_3_2
tags:
- level1-server
- level1-workstation
@ -55,7 +55,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.3
- rhel9cis_rule_3_3_3
tags:
- level1-server
- level1-workstation
@ -68,7 +68,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.4
- rhel9cis_rule_3_3_4
tags:
- level1-server
- level1-workstation
@ -81,7 +81,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.5
- rhel9cis_rule_3_3_5
tags:
- level1-server
- level1-workstation
@ -94,7 +94,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.6
- rhel9cis_rule_3_3_6
tags:
- level1-server
- level1-workstation
@ -107,7 +107,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.7
- rhel9cis_rule_3_3_7
tags:
- level1-server
- level1-workstation
@ -120,7 +120,7 @@
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/99-sysctl.conf"
notify: update sysctl
when:
- rhel9cis_rule_3.3.8
- rhel9cis_rule_3_3_8
tags:
- level1-server
- level1-workstation
@ -146,7 +146,7 @@
when: rhel9cis_ipv6_required
when:
- rhel9cis_ipv6_required
- rhel9cis_rule_3.3.9
- rhel9cis_rule_3_3_9
tags:
- level2-server
- level2-workstation

1
tasks/section_3/cis_3.4.1.x.yml
View file

@ -22,7 +22,6 @@
- name: "3.4.1.2 | PATCH | Ensure iptables-services not installed with firewalld | Stop running services"
systemd:
name: "{{ item }}"
enabled: false
masked: true
with_items:
- iptables

36
tasks/section_3/main.yml
View file

@ -1,41 +1,35 @@
---
- name: "SECTION | 3.1.x | Packet and IP redirection"
- name: "SECTION | 3.1.x | Disable unused network protocols and devices"
import_tasks: cis_3.1.x.yml
- name: "SECTION | 3.2.x | Network Parameters (Host Only)"
import_tasks: cis_3.2.x.yml
- name: "SECTION | 3.3.x | Uncommon Network Protocols"
- name: "SECTION | 3.3.x | Network Parameters (host and Router)"
import_tasks: cis_3.3.x.yml
- name: "SECTION | 3.4.1.x | firewall defined"
import_tasks: cis_3.4.1.1.yml
- name: "SECTION | 3.4.2.x | firewalld firewall"
include_tasks: cis_3.4.2.x.yml
- name: "SECTION | 3.4.1.x | Configure firewalld"
import_tasks: cis_3.4.1.x.yml
when:
- rhel9cis_firewall == "firewalld"
- name: "SECTION | 3.4.3.x | Configure nftables firewall"
include_tasks: cis_3.4.3.x.yml
- name: "SECTION | 3.4.2.x | Configure nftables"
include_tasks: cis_3.4.2.x.yml
when:
- rhel9cis_firewall == "nftables"
- name: "SECTION | 3.4.4.1.x | Configure iptables IPv4"
include_tasks: cis_3.4.4.1.x.yml
- name: "SECTION | 3.4.3.1.x | Configure iptables"
include_tasks: cis_3.4.3.1.x.yml
when:
- rhel9cis_firewall == "iptables"
- name: "SECTION | 3.4.4.2.x | Configure iptables IPv6"
include_tasks: cis_3.4.4.2.x.yml
- name: "SECTION | 3.4.3.2.x | Configure iptables IPv4"
include_tasks: cis_3.4.3.2.x.yml
when:
- rhel9cis_firewall == "iptables"
- name: "SECTION | 3.4.3.3.x | Configure iptables IPv6"
include_tasks: cis_3.4.3.3.x.yml
when:
- ( rhel9cis_firewall == "iptables" and rhel9cis_ipv6_required )
- name: "SECTION | 3.5 | Configure wireless"
import_tasks: cis_3.5.yml
- name: "SECTION | 3.5 | disable IPv6"
include_tasks: cis_3.5.yml
when:
- not rhel9cis_ipv6_required

2
tasks/section_4/main.yml
View file

@ -9,7 +9,7 @@
import_tasks: cis_4.1.2.x.yml
- name: "SECTION | 4.1.3 | Configure Auditd rules"
import_tasks: cis_4.1.x.yml
import_tasks: cis_4.1.3.x.yml
- name: "SECTION | 4.2 | Configure Logging"
import_tasks: cis_4.2.1.x.yml

2
tasks/section_5/cis_5.3.x.yml
View file

@ -33,7 +33,7 @@
lineinfile:
dest: /etc/sudoers
regexp: '^Defaults logfile='
line: 'Defaults logfile="{{ rhel9cis_varlog_location }}"'
line: 'Defaults logfile="{{ rhel9cis_sudolog_location }}"'
state: present
when:
- rhel9cis_rule_5_3_3

4
tasks/section_5/cis_5.5.x.yml
View file

@ -13,7 +13,7 @@
- item.id != "sync"
- item.id != "shutdown"
- item.id != "halt"
- rhel9cis_int_gid | int > item.gid
- min_int_uid | int > item.gid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
@ -28,7 +28,7 @@
- item.id != "shutdown"
- item.id != "sync"
- item.id != "root"
- rhel9cis_int_gid | int > item.gid
- min_int_uid | int > item.gid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
when:

4
tasks/section_5/cis_5.6.x.yml
View file

@ -13,7 +13,7 @@
- item.id != "sync"
- item.id != "shutdown"
- item.id != "halt"
- rhel9cis_int_gid | int < item.gid
- min_int_uid | int < item.gid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
loop_control:
@ -30,7 +30,7 @@
- item.id != "shutdown"
- item.id != "sync"
- item.id != "root"
- rhel9cis_int_gid | int < item.gid
- min_int_uid | int < item.gid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
loop_control:

12
tasks/section_6/cis_6.2.x.yml
View file

@ -230,7 +230,7 @@
stat:
path: "{{ item }}"
register: rhel_08_6_2_9_audit
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
- name: "6.2.9 | AUDIT | Ensure all users' home directories exist"
command: find -H {{ item.0 | quote }} -not -type l -perm /027
@ -270,7 +270,7 @@
recursive: yes
etype: "{{ item.1.etype }}"
permissions: "{{ item.1.mode }}"
when: not rhel9cis_system_is_container
when: not system_is_container
with_nested:
- "{{ (ansible_check_mode | ternary(rhel_08_6_2_9_patch_audit, rhel_08_6_2_9_patch)).results |
rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"
@ -299,13 +299,13 @@
loop_control:
label: "{{ rhel9cis_passwd_label }}"
when:
- item.uid >= rhel9cis_int_gid
- min_int_uid | int <= item.uid
- rhel9cis_rule_6_2_10
tags:
- skip_ansible_lint # settings found on 6_2_7
- level1-server
- level1-workstation
- autoamted
- automated
- patch
- users
- rule_6.2.10
@ -315,7 +315,7 @@
- name: "6.2.11 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
stat:
path: "{{ item }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
register: rhel_08_6_2_11_audit
- name: "6.2.11 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
@ -356,7 +356,7 @@
recursive: yes
etype: "{{ item.1.etype }}"
permissions: "{{ item.1.mode }}"
when: not rhel9cis_system_is_container
when: not system_is_container
with_nested:
- "{{ (ansible_check_mode | ternary(rhel_08_6_2_11_patch_audit, rhel_08_6_2_11_patch)).results |
rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"