forked from ansible-lockdown/RHEL9-CIS
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
---
|
|
|
|
- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
|
|
block:
|
|
- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
|
|
sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: '0'
|
|
state: present
|
|
reload: yes
|
|
ignoreerrors: yes
|
|
notify: sysctl flush ipv4 route table
|
|
|
|
- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
|
|
sysctl:
|
|
name: net.ipv6.conf.all.forwarding
|
|
value: '0'
|
|
state: present
|
|
reload: yes
|
|
ignoreerrors: yes
|
|
notify: sysctl flush ipv6 route table
|
|
when: rhel9cis_ipv6_required
|
|
when:
|
|
- not rhel9cis_is_router
|
|
- rhel9cis_rule_3_2_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- sysctl
|
|
- patch
|
|
- rule_3.2.1
|
|
|
|
- name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
|
|
sysctl:
|
|
name: '{{ item.name }}'
|
|
value: '{{ item.value }}'
|
|
sysctl_set: yes
|
|
state: present
|
|
reload: yes
|
|
ignoreerrors: yes
|
|
notify: sysctl flush ipv4 route table
|
|
with_items:
|
|
- { name: net.ipv4.conf.all.send_redirects, value: 0 }
|
|
- { name: net.ipv4.conf.default.send_redirects, value: 0 }
|
|
when:
|
|
- not rhel9cis_is_router
|
|
- rhel9cis_rule_3_2_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- sysctl
|
|
- rule_3.2.2
|