forked from ansible-lockdown/RHEL9-CIS
352 lines
15 KiB
YAML
352 lines
15 KiB
YAML
---
|
|
|
|
- name: "3.4.2.1 | PATCH | Ensure nftables is installed"
|
|
package:
|
|
name: nftables
|
|
state: present
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.1
|
|
|
|
# The control allows the service it be masked or not installed
|
|
# We have chosen not installed
|
|
- name: "3.4.2.2 | PATCH | Ensure firewalld is either not installed or masked with nftables"
|
|
package:
|
|
name: firewalld
|
|
state: absent
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.2
|
|
|
|
- name: "3.4.2.3 | PATCH | Ensure iptables-services not installed with nftables"
|
|
block:
|
|
- name: "3.4.2.3 | PATCH | Ensure iptables-services not installed with nftables | Stop services"
|
|
systemd:
|
|
name: "{{ item }}"
|
|
enabled: false
|
|
masked: true
|
|
ignore_errors: true
|
|
with_items:
|
|
- iptables
|
|
- ip6tables
|
|
|
|
- name: "3.4.2.3 | PATCH | Ensure iptables-services not installed with nftables | Remove IPTables"
|
|
package:
|
|
name: iptables-service
|
|
state: absent
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_3
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.3
|
|
|
|
- name: "3.4.2.4 | PATCH | Ensure iptables are flushed with nftables"
|
|
block:
|
|
- name: "3.4.2.4 | PATCH | Ensure iptables are flushed with nftables | IPv4"
|
|
command: iptables -F
|
|
|
|
- name: "3.4.2.4 | PATCH | Ensure iptables are flushed with nftables | IPv6"
|
|
command: ip6tables -F
|
|
when: rhel9cis_ipv6_required
|
|
when:
|
|
- rhel9cis_rule_3_4_2_4
|
|
- rhel9cis_firewall != "firewalld"
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- manual
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.4
|
|
|
|
- name: "3.4.2.5 | AUDIT | Ensure an nftables table exists"
|
|
block:
|
|
- name: "3.4.2.5 | AUDIT | Ensure a table exists | Check for tables"
|
|
command: nft list tables
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_5_nft_tables
|
|
|
|
- name: "3.4.2.5 | AUDIT | Ensure an nftables table exists | Show existing tables"
|
|
debug:
|
|
msg:
|
|
- "Below are the current nft tables, please review"
|
|
- "{{ rhel9cis_3_4_2_5_nft_tables.stdout_lines }}"
|
|
when: rhel9cis_3_4_2_5_nft_tables.stdout | length > 0
|
|
|
|
- name: "3.4.2.5 | AUDIT | Ensure an nftables table exists | Alert on no tables"
|
|
debug:
|
|
msg:
|
|
- "Warning!! You currently have no nft tables, please review your setup"
|
|
- 'Use the command "nft create table inet <table name>" to create a new table'
|
|
when:
|
|
- rhel9cis_3_4_2_5_nft_tables.stdout | length == 0
|
|
- not rhel9cis_nft_tables_autonewtable
|
|
|
|
- name: "3.4.2.5 | AUDIT | Ensure an nftables table exists | Alert on no tables | warning count"
|
|
set_fact:
|
|
control_number: "{{ control_number }} + [ 'rule_3.4.2.5' ]"
|
|
warn_count: "{{ warn_count|int + 1 }}"
|
|
when:
|
|
- rhel9cis_3_4_2_5_nft_tables.stdout | length == 0
|
|
- not rhel9cis_nft_tables_autonewtable
|
|
|
|
- name: "3.4.2.5 | PATCH | Ensure a table exists | Create table if needed"
|
|
command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}"
|
|
failed_when: no
|
|
when: rhel9cis_nft_tables_autonewtable
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_5
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.5
|
|
|
|
- name: "3.4.2.6 | PATCH | Ensure nftables base chains exist"
|
|
block:
|
|
- name: "3.4.2.6 | AUDIT | Ensure nftables base chains exist | Get current chains for INPUT"
|
|
shell: nft list ruleset | grep 'hook input'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_6_input_chains
|
|
|
|
- name: "3.4.2.6 | AUDIT | Ensure nftables base chains exist | Get current chains for FORWARD"
|
|
shell: nft list ruleset | grep 'hook forward'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_6_forward_chains
|
|
|
|
- name: "3.4.2.6 | AUDIT | Ensure nftables base chains exist | Get current chains for OUTPUT"
|
|
shell: nft list ruleset | grep 'hook output'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_6_output_chains
|
|
|
|
- name: "3.4.2.6 | AUDIT | Ensure nftables base chains exist | Display chains for review"
|
|
debug:
|
|
msg:
|
|
- "Below are the current INPUT chains"
|
|
- "{{ rhel9cis_3_4_2_6_input_chains.stdout_lines }}"
|
|
- "Below are the current FORWARD chains"
|
|
- "{{ rhel9cis_3_4_2_6_forward_chains.stdout_lines }}"
|
|
- "Below are teh current OUTPUT chains"
|
|
- "{{ rhel9cis_3_4_2_6_output_chains.stdout_lines }}"
|
|
when: not rhel9cis_nft_tables_autochaincreate
|
|
|
|
- name: "3.4.2.6 | PATCH | Ensure nftables base chains exist | Create chains if needed"
|
|
shell: "{{ item }}"
|
|
args:
|
|
warn: no
|
|
failed_when: no
|
|
with_items:
|
|
- nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
|
|
- nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { type filter hook forward priority 0 \; }
|
|
- nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" output { type filter hook output priority 0 \; }
|
|
when: rhel9cis_nft_tables_autochaincreate
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_6
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automate
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.6
|
|
|
|
- name: "3.4.2.7 | PATCH | Ensure nftables loopback traffic is configured"
|
|
block:
|
|
- name: "3.4.2.7 | AUDIT | Ensure nftables loopback traffic is configured | Gather iif lo accept existence"
|
|
shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_7_iiflo
|
|
|
|
- name: "3.4.2.7 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip saddr existence"
|
|
shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_7_ipsaddr
|
|
|
|
- name: "3.4.2.7 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip6 saddr existence"
|
|
shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_7_ip6saddr
|
|
|
|
- name: "3.4.2.7 | PATCH | Ensure nftables loopback traffic is configured | Set iif lo accept rule"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept
|
|
when: '"iif \"lo\" accept" not in rhel9cis_3_4_2_7_iiflo.stdout'
|
|
|
|
- name: "3.4.2.7 | PATCH | Ensure nftables loopback traffic is configured | Set ip sddr rule"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop
|
|
when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_7_ipsaddr.stdout'
|
|
|
|
- name: "3.4.2.7 | PATCH | Ensure nftables loopback traffic is configured | Set ip6 saddr rule"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop
|
|
when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in rhel9cis_3_4_2_7_ip6saddr.stdout'
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_7
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.7
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured"
|
|
block:
|
|
- name: "3.4.2.8 | AUDIT | Ensure nftables outbound and established connections are configured | Gather incoming connection rules"
|
|
shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_8_inconnectionrule
|
|
|
|
- name: "3.4.2.8| AUDIT | Ensure nftables outbound and established connections are configured | Gather outbound connection rules"
|
|
shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
|
|
changed_when: false
|
|
failed_when: false
|
|
register: rhel9cis_3_4_2_8_outconnectionrule
|
|
|
|
- name: "3.4.2.8| PATCH | Ensure nftables outbound and established connections are configured | Add input tcp established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
|
|
when: '"ip protocol tcp ct state established accept" not in rhel9cis_3_4_2_8_inconnectionrule.stdout'
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured | Add input udp established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept
|
|
when: '"ip protocol udp ct state established accept" not in rhel9cis_3_4_2_8_inconnectionrule.stdout'
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured | Add input icmp established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept
|
|
when: '"ip protocol icmp ct state established accept" not in rhel9cis_3_4_2_8_inconnectionrule.stdout'
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured | Add output tcp new, related, established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept
|
|
when: '"ip protocol tcp ct state established,related,new accept" not in rhel9cis_3_4_2_8_outconnectionrule.stdout'
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured | Add output udp new, related, established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept
|
|
when: '"ip protocol udp ct state established,related,new accept" not in rhel9cis_3_4_2_8_outconnectionrule.stdout'
|
|
|
|
- name: "3.4.2.8 | PATCH | Ensure nftables outbound and established connections are configured | Add output icmp new, related, established accept policy"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept
|
|
when: '"ip protocol icmp ct state established,related,new accept" not in rhel9cis_3_4_2_8_outconnectionrule.stdout'
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_8
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.3.5
|
|
|
|
- name: "3.4.2.9 | PATCH | Ensure nftables default deny firewall policy"
|
|
block:
|
|
- name: "3.4.2.9 | AUDIT | Ensure nftables default deny firewall policy | Check for hook input deny policy"
|
|
shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input'
|
|
failed_when: false
|
|
changed_when: false
|
|
register: rhel9cis_3_4_2_9_inputpolicy
|
|
|
|
- name: "3.4.2.9 | AUDIT | Ensure nftables default deny firewall policy | Check for hook forward deny policy"
|
|
shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward'
|
|
failed_when: false
|
|
changed_when: false
|
|
register: rhel9cis_3_4_2_9_forwardpolicy
|
|
|
|
- name: "3.4.2.9 | AUDIT | Ensure nftables default deny firewall policy | Check for hook output deny policy"
|
|
shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output'
|
|
failed_when: false
|
|
changed_when: false
|
|
register: rhel9cis_3_4_2_9_outputpolicy
|
|
|
|
- name: "3.4.2.9 | AUDIT | Ensure nftables default deny firewall policy | Check for SSH allow"
|
|
shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh'
|
|
failed_when: false
|
|
changed_when: false
|
|
register: rhel9cis_3_4_2_9_sshallowcheck
|
|
|
|
- name: "3.4.2.9 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic"
|
|
command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept
|
|
when: '"tcp dport ssh accept" not in rhel9cis_3_4_2_9_sshallowcheck.stdout'
|
|
|
|
- name: "3.4.2.9 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy"
|
|
command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; }
|
|
when: '"type filter hook input priority 0; policy drop;" not in rhel9cis_3_4_2_9_inputpolicy.stdout'
|
|
|
|
- name: "3.4.2.9 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy"
|
|
command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; }
|
|
when: '"type filter hook forward priority 0; policy drop;" not in rhel9cis_3_4_2_9_forwardpolicy.stdout'
|
|
|
|
- name: "3.4.2.9 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy"
|
|
command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; }
|
|
when: '"type filter hook output priority 0; policy drop;" not in rhel9cis_3_4_2_9_outputpolicy.stdout'
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_9
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.9
|
|
|
|
- name: "3.4.2.10 | PATCH | Ensure nftables service is enabled"
|
|
service:
|
|
name: nftables
|
|
enabled: yes
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_10
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.3.7
|
|
|
|
- name: "3.4.2.11 | PATCH | Ensure nftables rules are permanent"
|
|
lineinfile:
|
|
path: /etc/sysconfig/nftables.conf
|
|
state: present
|
|
insertafter: EOF
|
|
line: include "/etc/nftables/inet-{{ rhel9cis_nft_tables_tablename }}"
|
|
when:
|
|
- rhel9cis_firewall == "nftables"
|
|
- rhel9cis_rule_3_4_2_11
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- nftables
|
|
- rule_3.4.2.11
|