sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

lint updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-07-24 14:00:00 +01:00
parent aa0f4d0f6d
commit f1c4d96412
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
18 changed files with 578 additions and 835 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tasks/section_1/cis_1.6.x.yml
View file

@ -15,8 +15,8 @@
msg: "Captured in prelim to ensure not LEGACY. Runs handler to update"
changed_when: true
notify:
- Update Crypto Policy
- Set Crypto Policy
- Update Crypto Policy
- Set Crypto Policy
- name: "1.6.2 | PATCH | Ensure system wide crypto policy is not set in sshd configuration"
when:
@ -36,7 +36,7 @@
state: absent
notify: Restart sshd
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support"
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support | Add submodule exclusion"
when:
- rhel9cis_rule_1_6_3
- "'NO-SHA1' not in rhel9cis_crypto_policy_module"
@ -49,7 +49,7 @@
- rule_1.6.3
- NIST800-53R5_SC-6
block:
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support | Add submodule exclusion"
- name: "1.6.3 | PATCH | Ensure system wide crypto policy disables sha1 hash and signature support"
ansible.builtin.template:
src: etc/crypto-policies/policies/modules/NO-SHA1.pmod.j2
dest: /etc/crypto-policies/policies/modules/NO-SHA1.pmod
@ -92,7 +92,6 @@
ansible.builtin.set_fact:
rhel9cis_crypto_policy_module: "{{ rhel9cis_crypto_policy_module + ':NO-WEAKMAC' }}"
- name: "1.6.5 | PATCH | Ensure system wide crypto policy disables cbc for ssh"
when:
- rhel9cis_rule_1_6_5
@ -124,7 +123,7 @@
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh"
when:
- rhel9cis_rule_1_6_6
- "'NO-SSHCHACHA20' not in rhel9cis_crypto_policy_module"
- "'NO-SSHWEAKMAC' not in rhel9cis_crypto_policy_module"
tags:
- level1-server
- level1-workstation
@ -136,8 +135,8 @@
block:
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | Add submodule exclusion"
ansible.builtin.template:
src: etc/crypto-policies/policies/modules/NO-SSHCHACHA20.pmod.j2
dest: /etc/crypto-policies/policies/modules/NO-SSHCHACHA20.pmod
src: etc/crypto-policies/policies/modules/NO-SSHWEAKMAC.pmod.j2
dest: /etc/crypto-policies/policies/modules/NO-SSHWEAKMAC.pmod
owner: root
group: root
mode: '0640'
@ -147,7 +146,7 @@
- name: "1.6.6 | PATCH | Ensure system wide crypto policy disables chacha20-poly1305 for ssh | submodule to crypto policy modules"
ansible.builtin.set_fact:
rhel9cis_crypto_policy_module: "{{ rhel9cis_crypto_policy_module + ':NO-SSHCHACHA20' }}"
rhel9cis_crypto_policy_module: "{{ rhel9cis_crypto_policy_module + ':NO-SSHWEAKMAC' }}"
- name: "1.6.7 | PATCH | Ensure system wide crypto policy disables EtM for ssh"
when: