forked from ansible-lockdown/RHEL9-CIS
138 lines
4.2 KiB
YAML
138 lines
4.2 KiB
YAML
---
|
|
|
|
- name: "3.4.1.1 | PATCH | Ensure firewalld is installed"
|
|
package:
|
|
name:
|
|
- firewalld
|
|
- iptables
|
|
state: present
|
|
when:
|
|
- rhel9cis_rule_3_4_1_1
|
|
- rhel9cis_firewall == "firewalld"
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- firewalld
|
|
- rule_3.4.1.1
|
|
|
|
- name: "3.4.1.2 | PATCH | Ensure iptables-services not installed with firewalld"
|
|
block:
|
|
- name: "3.4.1.2 | PATCH | Ensure iptables-services not installed with firewalld | Stop running services"
|
|
systemd:
|
|
name: "{{ item }}"
|
|
enabled: false
|
|
masked: true
|
|
with_items:
|
|
- iptables
|
|
- ip6tables
|
|
when: item in ansible_facts.packages
|
|
|
|
- name: "3.4.1.2 | PATCH | Ensure iptables-services not installed with firewalld | Remove IPTables"
|
|
package:
|
|
name: iptables-services
|
|
state: absent
|
|
when:
|
|
- rhel9cis_rule_3_4_1_2
|
|
- rhel9cis_firewall == "firewalld"
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- firewalld
|
|
- rule_3.4.1.2
|
|
|
|
- name: "3.4.1.3 | PATCH | Ensure nftables either not installed or masked with firewalld"
|
|
systemd:
|
|
name: nftables
|
|
state: stopped
|
|
masked: yes
|
|
when:
|
|
- rhel9cis_firewall == "firewalld"
|
|
- rhel9cis_rule_3_4_1_3
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- firewalld
|
|
- rule_3_4_1_3
|
|
|
|
- name: "3.4.1.4 | PATCH | Ensure firewalld service is enabled and running"
|
|
systemd:
|
|
name: firewalld
|
|
state: started
|
|
enabled: yes
|
|
when:
|
|
- rhel9cis_firewall == "firewalld"
|
|
- rhel9cis_rule_3_4_1_4
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- firewalld
|
|
- rule_3_4_1_4
|
|
|
|
- name: "3.4.1.5 | PATCH | Ensure firewalld default zone is set"
|
|
command: firewall-cmd --set-default-zone="{{ rhel9cis_default_zone }}"
|
|
when:
|
|
- rhel9cis_firewall == "firewalld"
|
|
- rhel9cis_rule_3_4_1_5
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- automated
|
|
- patch
|
|
- firewalld
|
|
- rule_3.4.1.5
|
|
|
|
- name: "3.4.1.6 | AUDIT | Ensure network interfaces are assigned to appropriate zone"
|
|
block:
|
|
- name: "3.4.1.6 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies"
|
|
shell: "nmcli -t connection show | awk -F: '{ if($4){print $4} }' | while read INT; do firewall-cmd --get-active-zones | grep -B1 $INT; done"
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: no
|
|
register: rhel9cis_3_4_1_6_interfacepolicy
|
|
|
|
- name: "3.4.1.6 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies | Show the interface to policy"
|
|
debug:
|
|
msg:
|
|
- "The items below are the policies tied to the interfaces, please correct as needed"
|
|
- "{{ rhel9cis_3_4_1_6_interfacepolicy.stdout_lines }}"
|
|
when:
|
|
- rhel9cis_firewall == "firewalld"
|
|
- rhel9cis_rule_3_4_1_6
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- manual
|
|
- audit
|
|
- rule_3.4.1.6
|
|
|
|
- name: "3.4.1.7 | AUDIT | Ensure firewalld drops unnecessary services and ports"
|
|
block:
|
|
- name: "3.4.1.7 | AUDIT | Ensure firewalld drops unnecessary services and ports | Get list of services and ports"
|
|
shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done"
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: no
|
|
register: rhel9cis_3_4_1_7_servicesport
|
|
|
|
- name: "3.4.1.7 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports"
|
|
debug:
|
|
msg:
|
|
- "The items below are the services and ports that are accepted, please correct as needed"
|
|
- "{{ rhel9cis_3_4_1_7_servicesport.stdout_lines }}"
|
|
when:
|
|
- rhel9cis_firewall == "firewalld"
|
|
- rhel9cis_rule_3_4_1_7
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- manual
|
|
- audit
|
|
- rule_3.4.1.7
|