forked from ansible-lockdown/RHEL9-CIS
02a36f7f8d
* container standards Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic on handlers Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * initial container ignore Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tags and containder discovery Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic on auditd task Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tags and crypto logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * distro update for rocky Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * system_is_container updates Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * ssh pkg check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logrotate pkg check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic in container check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * add pkg fact and audit conditionals Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tidy up crypto step Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added missing tags Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * container vars file now a variable Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * added uid discovery and usage Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Updated OS checks and conditionals Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed empty become Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * change audit to include task Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added OS_specific vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated import/include Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * OS Specific vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated tags Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated changed_when Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed UID logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * changed reboot var Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * changed skip_reboot var name Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * masked only Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fix logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * remove debug update logic 6.2.8 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * initial Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed CentOS Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
142 lines
2.7 KiB
YAML
142 lines
2.7 KiB
YAML
---
|
|
# handlers file for RHEL9-CIS
|
|
|
|
- name: sysctl flush ipv4 route table
|
|
become: true
|
|
sysctl:
|
|
name: net.ipv4.route.flush
|
|
value: '1'
|
|
sysctl_set: true
|
|
ignore_errors: true
|
|
when: ansible_virtualization_type != "docker"
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: sysctl flush ipv6 route table
|
|
become: true
|
|
sysctl:
|
|
name: net.ipv6.route.flush
|
|
value: '1'
|
|
sysctl_set: true
|
|
when: ansible_virtualization_type != "docker"
|
|
|
|
- name: update sysctl
|
|
template:
|
|
src: etc/99-sysctl.conf.j2
|
|
dest: /etc/sysctl.d/99-sysctl.conf
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
notify: reload sysctl
|
|
when:
|
|
- ansible_virtualization_type != "docker"
|
|
- "'procps-ng' in ansible_facts.packages"
|
|
|
|
- name: reload sysctl
|
|
sysctl:
|
|
name: net.ipv4.route.flush
|
|
value: '1'
|
|
state: present
|
|
reload: true
|
|
ignoreerrors: true
|
|
when:
|
|
- ansible_virtualization_type != "docker"
|
|
- "'systemd' in ansible_facts.packages"
|
|
|
|
- name: systemd restart tmp.mount
|
|
become: true
|
|
systemd:
|
|
name: tmp.mount
|
|
daemon_reload: true
|
|
enabled: true
|
|
masked: false
|
|
state: reloaded
|
|
|
|
- name: systemd restart var-tmp.mount
|
|
become: true
|
|
systemd:
|
|
name: var-tmp.mount
|
|
daemon_reload: true
|
|
enabled: true
|
|
masked: false
|
|
state: reloaded
|
|
|
|
- name: remount tmp
|
|
shell: mount -o remount /tmp
|
|
args:
|
|
warn: false
|
|
|
|
- name: restart firewalld
|
|
become: true
|
|
service:
|
|
name: firewalld
|
|
state: restarted
|
|
|
|
- name: restart xinetd
|
|
become: true
|
|
service:
|
|
name: xinetd
|
|
state: restarted
|
|
|
|
- name: restart sshd
|
|
become: true
|
|
service:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: restart postfix
|
|
become: true
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: reload dconf
|
|
become: true
|
|
shell: dconf update
|
|
args:
|
|
warn: false
|
|
|
|
- name: update auditd
|
|
template:
|
|
src: audit/99_auditd.rules.j2
|
|
dest: /etc/audit/rules.d/99_auditd.rules
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
notify: restart auditd
|
|
|
|
- name: restart auditd
|
|
shell: /sbin/service auditd restart
|
|
changed_when: false
|
|
check_mode: false
|
|
failed_when: false
|
|
args:
|
|
warn: false
|
|
when:
|
|
- not rhel9cis_skip_for_travis
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: grub2cfg
|
|
shell: "grub2-mkconfig -o {{ grub_cfg.stat.lnk_source }}"
|
|
args:
|
|
warn: false
|
|
ignore_errors: True
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: restart rsyslog
|
|
become: true
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
|
|
- name: restart syslog-ng
|
|
become: true
|
|
service:
|
|
name: syslog-ng
|
|
state: restarted
|
|
|
|
- name: systemd_daemon_reload
|
|
systemd:
|
|
daemon-reload: true
|