forked from ansible-lockdown/RHEL9-CIS
02a36f7f8d
* container standards Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic on handlers Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * initial container ignore Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tags and containder discovery Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic on auditd task Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tags and crypto logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * distro update for rocky Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * system_is_container updates Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * ssh pkg check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logrotate pkg check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * logic in container check Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * add pkg fact and audit conditionals Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * tidy up crypto step Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added missing tags Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * container vars file now a variable Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * added uid discovery and usage Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Updated OS checks and conditionals Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed empty become Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * change audit to include task Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added OS_specific vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated import/include Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * OS Specific vars Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated tags Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated changed_when Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fixed UID logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * changed reboot var Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * changed skip_reboot var name Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * masked only Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fix logic Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * remove debug update logic 6.2.8 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * initial Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed CentOS Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
103 lines
2.9 KiB
YAML
103 lines
2.9 KiB
YAML
---
|
|
|
|
- name: "1.2.1 | L1 | PATCH | Ensure Red Hat Subscription Manager connection is configured"
|
|
redhat_subscription:
|
|
state: present
|
|
username: "{{ rhel9cis_rh_sub_user }}"
|
|
password: "{{ rhel9cis_rh_sub_password }}"
|
|
auto_attach: true
|
|
no_log: true
|
|
when:
|
|
- ansible_distribution == "RedHat"
|
|
- rhel9cis_rhnsd_required
|
|
- rhel9cis_rule_1_2_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- notscored
|
|
- patch
|
|
- rule_1.2.1
|
|
- skip_ansible_lint # Added as no_log still errors on ansuible-lint
|
|
|
|
- name: "1.2.2 | L1 | PATCH | Disable the rhnsd Daemon"
|
|
service:
|
|
name: rhnsd
|
|
state: stopped
|
|
enabled: false
|
|
masked: true
|
|
when:
|
|
- ansible_distribution == "RedHat"
|
|
- rhnsd_service_status.stdout == "loaded" and not rhel9cis_rhnsd_required
|
|
- rhel9cis_rule_1_2_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- notscored
|
|
- patch
|
|
- rule_1.2.2
|
|
|
|
- name: "1.2.3 | L1 | AUDIT | Ensure GPG keys are configured"
|
|
shell: gpg --quiet --with-fingerprint "{{ rpm_gpg_key }}"
|
|
args:
|
|
warn: false
|
|
when:
|
|
- rhel9cis_rule_1_2_3
|
|
- ansible_distribution == "RedHat" or
|
|
ansible_distribution == "Rocky"
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- notscored
|
|
- patch
|
|
- rule_1.2.3
|
|
|
|
- name: "1.2.4 | L1 | PATCH | Ensure gpgcheck is globally activated"
|
|
block:
|
|
- name: "1.2.4 | L1 | AUDIT | Ensure gpgcheck is globally activated | Find repos"
|
|
find:
|
|
paths: /etc/yum.repos.d
|
|
patterns: "*.repo"
|
|
register: yum_repos
|
|
changed_when: false
|
|
|
|
- name: "1.2.4 | L1 | PATCH | Ensure gpgcheck is globally activated | Update yum.repos"
|
|
replace:
|
|
name: "{{ item.path }}"
|
|
regexp: "^gpgcheck=0"
|
|
replace: "gpgcheck=1"
|
|
with_items:
|
|
- "{{ yum_repos.files }}"
|
|
when:
|
|
- rhel9cis_rule_1_2_4
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- scored
|
|
- patch
|
|
- rule_1.2.4
|
|
|
|
- name: "1.2.5 | L1 | Ensure package manager repositories are configured"
|
|
block:
|
|
- name: "1.2.5 | L1 | AUDIT | Ensure package manager repositories are configured | Get repo list"
|
|
shell: dnf repolist
|
|
args:
|
|
warn: false
|
|
changed_when: false
|
|
failed_when: false
|
|
register: dnf_configured
|
|
check_mode: false
|
|
|
|
- name: "1.2.5 | L1 | AUDIT | Ensure package manager repositories are configured | Display repo list"
|
|
debug:
|
|
msg:
|
|
- "Alert! Below are the configured repos. Please review and make sure all align with site policy"
|
|
- "{{ dnf_configured.stdout_lines }}"
|
|
when:
|
|
- rhel9cis_rule_1_2_5
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- notscored
|
|
- patch
|
|
- rule_1.2.5
|
|
- skip_ansible_lint
|