Encryption and major changes
This commit is contained in:
@@ -0,0 +1,31 @@
|
||||
---
|
||||
- name: Add configuration file for adduser and addgroup
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/adduser.conf.j2
|
||||
dest: /etc/adduser.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- adduser
|
||||
- users
|
||||
|
||||
- name: Add configuration file for useradd
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/default/useradd.j2
|
||||
dest: /etc/default/useradd
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- useradd
|
||||
- users
|
||||
- CCE-27355-7
|
||||
- CCE-80954-1
|
||||
- CCE-83627-0
|
||||
- CIS-UBUNTU2004-5.5.1.4
|
||||
- UBTU-20-010409
|
||||
@@ -0,0 +1,161 @@
|
||||
---
|
||||
- name: Debian family AIDE installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: aide-common
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- aide
|
||||
- CIS-UBUNTU2004-1.3.1
|
||||
|
||||
- name: RedHat family AIDE package installation
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: aide
|
||||
state: present
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- aide
|
||||
- CCE-80844-4
|
||||
|
||||
- name: Stat AIDE cron.daily
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/cron.daily/aide
|
||||
register: aidecron
|
||||
tags:
|
||||
- aide
|
||||
- CCE-80844-4
|
||||
- CIS-UBUNTU2004-1.3.1
|
||||
|
||||
- name: Install AIDE service
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/aidecheck.service.j2
|
||||
dest: /lib/systemd/system/aidecheck.service
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
when: not aidecron.stat.exists
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Install AIDE timer
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: lib/systemd/system/aidecheck.timer.j2
|
||||
dest: /lib/systemd/system/aidecheck.timer
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
when: not aidecron.stat.exists
|
||||
notify:
|
||||
- Reload systemd
|
||||
- Enable aidecheck
|
||||
tags:
|
||||
- aide
|
||||
- CCE-80676-0
|
||||
- CIS-UBUNTU2004-1.3.2
|
||||
|
||||
- name: Add AIDE Debian dir exclusions
|
||||
become: true
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/aide/aide.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
backup: true
|
||||
insertafter: EOF
|
||||
block: |
|
||||
!/var/lib/docker
|
||||
!/var/lib/lxcfs
|
||||
!/var/lib/private/systemd
|
||||
!/var/log/audit
|
||||
!/var/log/journal
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Stat Debian aide.db
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /var/lib/aide/aide.db
|
||||
register: ubuaidedb
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Add AIDE RedHat dir exclusions
|
||||
become: true
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/aide.conf
|
||||
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||
backup: true
|
||||
insertafter: EOF
|
||||
block: |
|
||||
!/var/lib/docker
|
||||
!/var/lib/lxcfs
|
||||
!/var/lib/private/systemd
|
||||
!/var/log/audit
|
||||
!/var/log/journal
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Stat RedHat aide.db
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /var/lib/aide/aide.db.gz
|
||||
register: rhelaidedb
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Initialize RedHat AIDE
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
|
||||
register: init_redhat_aide
|
||||
changed_when: init_redhat_aide.rc != 0
|
||||
failed_when: init_redhat_aide.rc != 0
|
||||
when: ansible_os_family == "RedHat" and not rhelaidedb.stat.exists
|
||||
tags:
|
||||
- aide
|
||||
- CCE-80675-2
|
||||
|
||||
- name: Stat RedHat aide.db.new.gz
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /var/lib/aide/aide.db.new.gz
|
||||
register: rhelaidedbnew
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Copy RedHat AIDE database
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: cp /var/lib/aide/aide.db.gz /var/lib/aide/aide.db.new.gz
|
||||
register: cp_redhat_aide_db
|
||||
changed_when: cp_redhat_aide_db.rc != 0
|
||||
failed_when: cp_redhat_aide_db.rc != 0
|
||||
when: ansible_os_family == "RedHat" and not rhelaidedbnew.stat.exists
|
||||
tags:
|
||||
- aide
|
||||
|
||||
- name: Initialize Debian AIDE
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: aideinit --force --yes
|
||||
register: init_debian_aide
|
||||
changed_when: init_debian_aide.rc != 0
|
||||
failed_when: init_debian_aide.rc != 0
|
||||
when: ansible_os_family == "Debian" and not ubuaidedb.stat.exists
|
||||
tags:
|
||||
- aide
|
||||
@@ -0,0 +1,67 @@
|
||||
---
|
||||
- name: Set Debian family AppArmor grub cmdline
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX apparmor=1 security=apparmor"'
|
||||
dest: /etc/default/grub.d/99-hardening-apparmor.cfg
|
||||
state: present
|
||||
create: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
when: ansible_os_family == "Debian"
|
||||
notify:
|
||||
- Update GRUB
|
||||
tags:
|
||||
- apparmor
|
||||
- CIS-UBUNTU2004-1.6.1.2
|
||||
|
||||
- name: Configure pam_apparmor
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "session optional pam_apparmor.so order=user,group,default"
|
||||
dest: /etc/pam.d/apparmor
|
||||
state: present
|
||||
create: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
when: ansible_os_family == "Debian"
|
||||
notify:
|
||||
- Update GRUB
|
||||
tags:
|
||||
- apparmor
|
||||
|
||||
- name: Get AppArmor status
|
||||
become: true
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.builtin.command: aa-status --complaining
|
||||
register: get_apparmor_complaining
|
||||
changed_when: get_apparmor_complaining.stdout != "0"
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- apparmor
|
||||
|
||||
- name: Enforce AppArmor profiles
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: find /etc/apparmor.d/ -maxdepth 1 -type f -exec aa-enforce {} \;
|
||||
register: enforce_apparmor_profiles
|
||||
changed_when: enforce_apparmor_profiles.rc != 0
|
||||
failed_when: enforce_apparmor_profiles.rc != 0
|
||||
when: ansible_os_family == "Debian" and (get_apparmor_complaining.stdout != "0")
|
||||
tags:
|
||||
- apparmor
|
||||
- CIS-UBUNTU2004-1.6.1.3
|
||||
- CIS-UBUNTU2004-1.6.1.4
|
||||
|
||||
- name: Enable apparmor
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: apparmor
|
||||
enabled: true
|
||||
state: started
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- apparmor
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Disable apport
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^enabled="
|
||||
line: "enabled=0"
|
||||
dest: /etc/default/apport
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
register: default_apport
|
||||
notify:
|
||||
- Mask apport
|
||||
when: ansible_os_family == "Debian"
|
||||
failed_when:
|
||||
- default_apport.rc is defined
|
||||
- default_apport.rc !=0
|
||||
- not default_apport.rc == 257
|
||||
tags:
|
||||
- apport
|
||||
@@ -0,0 +1,204 @@
|
||||
---
|
||||
- name: Configure Debian auditd GRUB cmdline
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX {{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
|
||||
dest: /etc/default/grub.d/99-hardening-audit.cfg
|
||||
state: present
|
||||
create: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- auditd
|
||||
- CIS-UBUNTU2004-4.1.1.3
|
||||
- CIS-UBUNTU2004-4.1.1.4
|
||||
|
||||
- name: Configure RedHat auditd GRUB cmdline
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: 'grubby --update-kernel=ALL --args="{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"'
|
||||
register: grubby_update_kernel
|
||||
when: ansible_os_family == "RedHat"
|
||||
changed_when: grubby_update_kernel.rc != 0
|
||||
failed_when: grubby_update_kernel.rc != 0
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-80825-3
|
||||
- CCE-80943-4
|
||||
|
||||
- name: Configure auditd action_mail_acct
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^action_mail_acct ="
|
||||
line: "action_mail_acct = {{ auditd_action_mail_acct }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-80678-6
|
||||
|
||||
- name: Configure auditd admin_space_left_action
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^admin_space_left_action = "
|
||||
line: "admin_space_left_action = {{ auditd_admin_space_left_action }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
|
||||
- name: Configure auditd disk_error_action
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^disk_error_action ="
|
||||
line: "disk_error_action = {{ auditd_disk_error_action }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-84046-2
|
||||
|
||||
- name: Configure auditd disk_full_action
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^disk_full_action ="
|
||||
line: "disk_full_action = {{ auditd_disk_full_action }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-84045-4
|
||||
|
||||
- name: Configure auditd max_log_file
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^max_log_file ="
|
||||
line: "max_log_file = {{ auditd_max_log_file }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CIS-UBUNTU2004-4.1.2.1
|
||||
|
||||
- name: Configure auditd max_log_file_action
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^max_log_file_action ="
|
||||
line: "max_log_file_action = {{ auditd_max_log_file_action }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-80682-8
|
||||
- CIS-UBUNTU2004-4.1.2.2
|
||||
|
||||
- name: Configure auditd num_logs
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^num_logs ="
|
||||
line: "num_logs = {{ auditd_num_logs }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
|
||||
- name: Configure auditd space_left
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^space_left ="
|
||||
line: "space_left = {{ auditd_space_left }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
|
||||
- name: Configure auditd space_left_action
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^space_left_action ="
|
||||
line: "space_left_action = {{ auditd_space_left_action }}"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-80684-4
|
||||
|
||||
- name: Configure auditd name_format
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^name_format ="
|
||||
line: "name_format = hostname"
|
||||
dest: /etc/audit/auditd.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
tags:
|
||||
- auditd
|
||||
|
||||
- name: Enable auditd syslog plugin
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/audit/plugins.d/syslog.conf
|
||||
regexp: "^active"
|
||||
line: "active = yes"
|
||||
state: present
|
||||
mode: "0640"
|
||||
create: true
|
||||
tags:
|
||||
- auditd
|
||||
|
||||
- name: Add auditd rules
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/audit/rules.d/hardening.rules.j2
|
||||
dest: /etc/audit/rules.d/hardening.rules
|
||||
backup: true
|
||||
mode: "0600"
|
||||
owner: root
|
||||
group: root
|
||||
when: auditd_apply_audit_rules | bool
|
||||
notify:
|
||||
- Generate auditd rules
|
||||
- Restart Debian auditd
|
||||
- Restart RedHat auditd
|
||||
tags:
|
||||
- auditd
|
||||
- CCE-80708-1
|
||||
- CIS-UBUNTU2004-4.1.1.2
|
||||
- CIS-UBUNTU2004-4.1.3
|
||||
- CIS-UBUNTU2004-4.1.4
|
||||
- CIS-UBUNTU2004-4.1.5
|
||||
- CIS-UBUNTU2004-4.1.6
|
||||
- CIS-UBUNTU2004-4.1.7
|
||||
- CIS-UBUNTU2004-4.1.8
|
||||
- CIS-UBUNTU2004-4.1.9
|
||||
- CIS-UBUNTU2004-4.1.10
|
||||
- CIS-UBUNTU2004-4.1.11
|
||||
- CIS-UBUNTU2004-4.1.12
|
||||
- CIS-UBUNTU2004-4.1.13
|
||||
- CIS-UBUNTU2004-4.1.14
|
||||
- CIS-UBUNTU2004-4.1.15
|
||||
- CIS-UBUNTU2004-4.1.16
|
||||
- CIS-UBUNTU2004-4.1.17
|
||||
- D3-SDM
|
||||
- D3-SFA
|
||||
@@ -0,0 +1,35 @@
|
||||
---
|
||||
- name: Stat available compilers
|
||||
become: true
|
||||
ansible.builtin.find:
|
||||
paths:
|
||||
[
|
||||
"/usr/local/sbin",
|
||||
"/usr/local/bin",
|
||||
"/usr/sbin",
|
||||
"/usr/bin",
|
||||
"/sbin",
|
||||
"/bin",
|
||||
"/snap/bin",
|
||||
]
|
||||
patterns: "{{ compilers }}"
|
||||
file_type: any
|
||||
follow: true
|
||||
recurse: true
|
||||
register: compiler
|
||||
tags:
|
||||
- compilers
|
||||
|
||||
- name: Restrict compiler access
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0750"
|
||||
state: file
|
||||
follow: true
|
||||
with_items:
|
||||
- "{{ compiler.files }}"
|
||||
tags:
|
||||
- compilers
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
- name: Remove cron.deny and at.deny
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/at.deny
|
||||
- /etc/cron.deny
|
||||
tags:
|
||||
- at
|
||||
- cron
|
||||
|
||||
- name: Clean cron and at
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ item }}"
|
||||
regexp: "^(?!root).*$"
|
||||
state: absent
|
||||
with_items:
|
||||
- /etc/at.allow
|
||||
- /etc/cron.allow
|
||||
tags:
|
||||
- at
|
||||
- cron
|
||||
- CIS-UBUNTU2004-5.1.8
|
||||
- CIS-UBUNTU2004-5.1.9
|
||||
|
||||
- name: Allow root cron and at
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: "{{ item }}"
|
||||
line: "root"
|
||||
mode: "0600"
|
||||
state: present
|
||||
create: true
|
||||
with_items:
|
||||
- /etc/at.allow
|
||||
- /etc/cron.allow
|
||||
tags:
|
||||
- at
|
||||
- cron
|
||||
|
||||
- name: Mask atd
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: atd
|
||||
masked: true
|
||||
enabled: false
|
||||
state: stopped
|
||||
register: mask_atd
|
||||
failed_when: mask_atd is not success and not "Could not find the requested service" in mask_atd.msg
|
||||
tags:
|
||||
- at
|
||||
- systemd
|
||||
|
||||
- name: Set cron permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
mode: "0700"
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /etc/cron.d
|
||||
- /etc/cron.daily
|
||||
- /etc/cron.hourly
|
||||
- /etc/cron.weekly
|
||||
- /etc/cron.monthly
|
||||
tags:
|
||||
- cron
|
||||
- CIS-UBUNTU2004-5.1.3
|
||||
- CIS-UBUNTU2004-5.1.4
|
||||
- CIS-UBUNTU2004-5.1.5
|
||||
- CIS-UBUNTU2004-5.1.6
|
||||
- CIS-UBUNTU2004-5.1.7
|
||||
|
||||
- name: Set crontab permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/crontab
|
||||
mode: "0600"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- cron
|
||||
- crontab
|
||||
- CIS-UBUNTU2004-5.1.2
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
- name: Disable systemd ctrl-alt-del
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: ctrl-alt-del.target
|
||||
masked: true
|
||||
enabled: false
|
||||
state: stopped
|
||||
when: not ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- ctrl-alt-del
|
||||
- CCE-80785-9
|
||||
- systemd
|
||||
|
||||
- name: Disable systemd ctrl-alt-del - RedHat family
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: ctrl-alt-del.target
|
||||
masked: true
|
||||
enabled: false
|
||||
state: stopped
|
||||
when: ansible_os_family == "RedHat"
|
||||
changed_when: false
|
||||
tags:
|
||||
- ctrl-alt-del
|
||||
- CCE-80785-9
|
||||
- systemd
|
||||
...
|
||||
@@ -0,0 +1,27 @@
|
||||
---
|
||||
- name: Disable file system kernel modules
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/modprobe.d/disablefs.conf
|
||||
line: "install {{ item }} /bin/true"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
create: true
|
||||
with_items:
|
||||
- "{{ fs_modules_blocklist }}"
|
||||
tags:
|
||||
- modprobe
|
||||
- CCE-80835-2
|
||||
- CCE-81031-7
|
||||
- CIS-UBUNTU2004-1.1.1.1
|
||||
- CIS-UBUNTU2004-1.1.1.2
|
||||
- CIS-UBUNTU2004-1.1.1.3
|
||||
- CIS-UBUNTU2004-1.1.1.4
|
||||
- CIS-UBUNTU2004-1.1.1.5
|
||||
- CIS-UBUNTU2004-1.1.1.5
|
||||
- CIS-UBUNTU2004-1.1.1.6
|
||||
- CIS-UBUNTU2004-1.1.1.7
|
||||
- M1038
|
||||
- M1042
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
- name: Disable misc kernel modules
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/modprobe.d/disablemod.conf
|
||||
line: "install {{ item }} /bin/true"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
create: true
|
||||
with_items:
|
||||
- "{{ misc_modules_blocklist }}"
|
||||
tags:
|
||||
- modprobe
|
||||
- CCE-80832-9
|
||||
- CCE-82005-0
|
||||
- CCE-82059-7
|
||||
- CIS-UBUNTU2004-1.1.24
|
||||
- M1034
|
||||
- M1038
|
||||
- M1042
|
||||
|
||||
- name: Stat blacklisted kernel modules
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
modprobe -c | grep -o '^blacklist .*' | awk '{print $2}'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
failed_when: modprobe_blacklist.rc != 0
|
||||
register: modprobe_blacklist
|
||||
when: block_blacklisted | bool
|
||||
tags:
|
||||
- modprobe
|
||||
- M1034
|
||||
- M1038
|
||||
- M1042
|
||||
|
||||
- name: Block blacklisted kernel modules
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/modprobe.d/blockblacklisted.conf
|
||||
line: "install {{ item }} /bin/true"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
create: true
|
||||
with_items:
|
||||
- "{{ modprobe_blacklist.stdout_lines | sort }}"
|
||||
when: block_blacklisted | bool
|
||||
tags:
|
||||
- modprobe
|
||||
- M1034
|
||||
- M1038
|
||||
- M1042
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
- name: Disable kernel network modules
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/modprobe.d/disablenet.conf
|
||||
line: "install {{ item }} /bin/true"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
create: true
|
||||
with_items:
|
||||
- "{{ net_modules_blocklist }}"
|
||||
tags:
|
||||
- modprobe
|
||||
- CCE-80834-5
|
||||
- CCE-82028-2
|
||||
- CCE-82297-3
|
||||
- CIS-UBUNTU2004-3.4.1
|
||||
- CIS-UBUNTU2004-3.4.2
|
||||
- CIS-UBUNTU2004-3.4.3
|
||||
- CIS-UBUNTU2004-3.4.4
|
||||
- M1038
|
||||
- M1042
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
- name: Disable wireless interfaces
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
block:
|
||||
- name: Install network-manager
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: network-manager
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Get WiFi state
|
||||
ansible.builtin.command: nmcli -t radio
|
||||
register: wifi_state_pre
|
||||
changed_when: wifi_state_pre.rc != 0
|
||||
failed_when: wifi_state_pre.rc != 0
|
||||
|
||||
- name: Turn off wireless interfaces
|
||||
become: true
|
||||
ansible.builtin.command: nmcli radio all off
|
||||
register: nmcli_radio
|
||||
changed_when: nmcli_radio.rc != 0
|
||||
failed_when: nmcli_radio.rc != 0
|
||||
tags:
|
||||
- wireless
|
||||
- CCE-83501-7
|
||||
- CIS-UBUNTU2004-3.1.2
|
||||
...
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
- name: Reboot if required
|
||||
tags:
|
||||
- reboot
|
||||
- ubuntu
|
||||
when: reboot_ubuntu
|
||||
block:
|
||||
- name: Stat /var/run/reboot-required
|
||||
ansible.builtin.stat:
|
||||
path: /var/run/reboot-required
|
||||
register: stat_reboot_required
|
||||
|
||||
- name: Notify reboot handler
|
||||
become: true
|
||||
ansible.builtin.setup: ~
|
||||
notify:
|
||||
- Reboot node
|
||||
when:
|
||||
- ansible_distribution == "Ubuntu"
|
||||
- stat_reboot_required.stat.exists
|
||||
...
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
- name: Create custom facts directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/ansible/facts.d
|
||||
recurse: true
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- fact
|
||||
|
||||
- name: Add systemd version fact
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ansible/facts.d/systemd.fact
|
||||
dest: /etc/ansible/facts.d/systemd.fact
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- fact
|
||||
- systemd
|
||||
|
||||
- name: Add cpuinfo rdrand fact
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ansible/facts.d/cpuinfo.fact
|
||||
dest: /etc/ansible/facts.d/cpuinfo.fact
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- cpuinfo
|
||||
- fact
|
||||
- rdrand
|
||||
|
||||
- name: Add ssh keys fact
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ansible/facts.d/sshkeys.fact
|
||||
dest: /etc/ansible/facts.d/sshkeys.fact
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- fact
|
||||
- sshd
|
||||
|
||||
- name: Stat IPv6 status
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /proc/sys/net/ipv6
|
||||
register: stat_ipv6
|
||||
tags:
|
||||
- fact
|
||||
- ipv6
|
||||
|
||||
- name: Set IPv6 fact
|
||||
ansible.builtin.set_fact:
|
||||
system_has_ipv6: "{{ stat_ipv6.stat.exists }}"
|
||||
tags:
|
||||
- fact
|
||||
- ipv6
|
||||
|
||||
- name: Set sysctl configuration directory as fact
|
||||
tags:
|
||||
- fact
|
||||
- sysctl
|
||||
block:
|
||||
- name: Stat /usr/lib/sysctl.d/ exists
|
||||
ansible.builtin.stat:
|
||||
path: "/usr/lib/sysctl.d/"
|
||||
register: usr_lib_sysctl_d
|
||||
|
||||
- name: Set sysctl fact
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_conf_dir: "{{ '/usr/lib/sysctl.d' if usr_lib_sysctl_d.stat.exists else '/etc/sysctl.d' }}"
|
||||
|
||||
- name: Update current facts
|
||||
ansible.builtin.setup: ~
|
||||
tags:
|
||||
- fact
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
- name: Remove /tmp from fstab
|
||||
become: true
|
||||
ansible.posix.mount:
|
||||
path: /tmp
|
||||
state: absent
|
||||
tags:
|
||||
- fstab
|
||||
|
||||
- name: Remove floppy from fstab
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/fstab
|
||||
state: absent
|
||||
regexp: '^(.*)floppy(.*)$'
|
||||
tags:
|
||||
- fstab
|
||||
...
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
- name: Configure hosts.allow
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/hosts.allow.j2
|
||||
dest: /etc/hosts.allow
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- hosts.allow
|
||||
|
||||
- name: Configure hosts.deny
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/hosts.deny.j2
|
||||
dest: /etc/hosts.deny
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- hosts.deny
|
||||
@@ -0,0 +1,43 @@
|
||||
---
|
||||
- name: Set Debian ipv6.disable GRUB cmdline
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ipv6.disable=1"'
|
||||
dest: /etc/default/grub.d/99-hardening-ipv6.cfg
|
||||
state: present
|
||||
create: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- ipv6
|
||||
- CIS-UBUNTU2004-3.1.1
|
||||
|
||||
- name: Set RedHat ipv6.disable GRUB cmdline
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: 'grubby --update-kernel=ALL --args="ipv6.disable=1"'
|
||||
register: grubby_update_kernel
|
||||
when: ansible_os_family == "RedHat"
|
||||
changed_when: grubby_update_kernel.rc != 0
|
||||
failed_when: grubby_update_kernel.rc != 0
|
||||
tags:
|
||||
- ipv6
|
||||
|
||||
- name: Configure sysctl to disable IPv6
|
||||
become: true
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value | int }}"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
when: system_has_ipv6 and disable_ipv6
|
||||
with_dict: "{{ ipv6_disable_sysctl_settings }}"
|
||||
notify:
|
||||
- Restart sysctl
|
||||
tags:
|
||||
- ipv6
|
||||
@@ -0,0 +1,35 @@
|
||||
---
|
||||
- name: Add motd file
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/motd.j2
|
||||
dest: /etc/motd
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- motd
|
||||
- CCE-80763-6
|
||||
- CIS-UBUNTU2004-1.7.1
|
||||
- CIS-UBUNTU2004-1.7.4
|
||||
|
||||
- name: Add issue and issue.net files
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/issue.j2
|
||||
dest: "{{ item }}"
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
with_items:
|
||||
- /etc/issue
|
||||
- /etc/issue.net
|
||||
tags:
|
||||
- issue
|
||||
- CCE-80763-6
|
||||
- CIS-UBUNTU2004-1.7.2
|
||||
- CIS-UBUNTU2004-1.7.3
|
||||
- CIS-UBUNTU2004-1.7.5
|
||||
- CIS-UBUNTU2004-1.7.6
|
||||
@@ -0,0 +1,87 @@
|
||||
---
|
||||
- name: Configure systemd journald.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/journald.conf.j2
|
||||
dest: /etc/systemd/journald.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- systemd
|
||||
- journald
|
||||
- CIS-UBUNTU2004-4.2.2.1
|
||||
- CIS-UBUNTU2004-4.2.2.2
|
||||
- CIS-UBUNTU2004-4.2.2.3
|
||||
|
||||
- name: Configure logrotate(8)
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/logrotate.conf.j2
|
||||
dest: /etc/logrotate.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- logrotate
|
||||
|
||||
- name: Configure cron.daily logrotate
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "/usr/sbin/logrotate /etc/logrotate.conf"
|
||||
dest: /etc/cron.daily/logrotate
|
||||
mode: "0750"
|
||||
state: present
|
||||
create: true
|
||||
tags:
|
||||
- cron
|
||||
- logrotate
|
||||
|
||||
- name: Stat rsyslog.conf
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/rsyslog.conf
|
||||
register: rsyslogconf
|
||||
tags:
|
||||
- rsyslog
|
||||
|
||||
- name: Stat rsyslog.conf FileCreateMode
|
||||
become: true
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.builtin.shell: grep "^$FileCreateMode" /etc/rsyslog.conf
|
||||
register: rsyslog_filecreatemode
|
||||
changed_when: false
|
||||
when: rsyslogconf.stat.exists
|
||||
tags:
|
||||
- rsyslog
|
||||
|
||||
- name: Configure rsyslog.conf FileCreateMode
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: '^\$FileCreateMode'
|
||||
line: "$FileCreateMode 0600"
|
||||
dest: /etc/rsyslog.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
when: rsyslogconf.stat.exists and rsyslog_filecreatemode.stdout.find('FileCreateMode') != -1
|
||||
tags:
|
||||
- rsyslog
|
||||
- CIS-UBUNTU2004-4.2.1.4
|
||||
|
||||
- name: Add FileCreateMode file to the rsyslog.d directory
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: '^\$FileCreateMode'
|
||||
line: "$FileCreateMode 0600"
|
||||
dest: /etc/rsyslog.d/99-filecreatemode.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
tags:
|
||||
- rsyslog
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
- name: Configure limits.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/security/limits.conf.j2
|
||||
dest: /etc/security/limits.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- limits
|
||||
- CCE-80955-8
|
||||
- CCE-81038-2
|
||||
- CIS-UBUNTU2004-1.5.4
|
||||
- UBTU-20-010400
|
||||
|
||||
- name: Configure coredump.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/coredump.conf.j2
|
||||
dest: /etc/systemd/coredump.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- coredump
|
||||
- systemd
|
||||
- CCE-82251-0
|
||||
- CCE-82252-8
|
||||
- CIS-UBUNTU2004-1.5.4
|
||||
|
||||
- name: Disable kdump service
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: kdump.service
|
||||
enabled: "no"
|
||||
state: stopped
|
||||
masked: "yes"
|
||||
register: mask_kdump
|
||||
failed_when: mask_kdump is not success and not "Could not find the requested service" in mask_kdump.msg
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
- name: Lock the root account
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: root
|
||||
password_lock: true
|
||||
no_log: true
|
||||
tags:
|
||||
- users
|
||||
- lock_root
|
||||
...
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
- name: Configure systemd logind
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/logind.conf.j2
|
||||
dest: /etc/systemd/logind.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- systemd
|
||||
- logind
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
- name: Configure login.defs
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/login.defs.j2
|
||||
dest: /etc/login.defs
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- login
|
||||
- CCE-26486-1
|
||||
- CCE-27002-5
|
||||
- CCE-27051-2
|
||||
- CCE-27123-9
|
||||
- CCE-27124-7
|
||||
- CCE-80205-8
|
||||
- CCE-80647-1
|
||||
- CCE-80648-9
|
||||
- CCE-80652-1
|
||||
- CCE-82888-9
|
||||
- CCE-80892-3
|
||||
- CIS-UBUNTU2004-5.5.1.1
|
||||
- CIS-UBUNTU2004-5.5.1.2
|
||||
- CIS-UBUNTU2004-5.5.1.3
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- UBTU-20-010007
|
||||
- UBTU-20-010008
|
||||
- UBTU-20-010016
|
||||
- UBTU-20-010409
|
||||
@@ -0,0 +1,227 @@
|
||||
---
|
||||
- name: Install local facts
|
||||
ansible.builtin.include_tasks: facts.yml
|
||||
tags: always
|
||||
|
||||
- name: Configure systemd resolved
|
||||
ansible.builtin.include_tasks: resolvedconf.yml
|
||||
tags: always
|
||||
|
||||
- name: Install epel-release and python dependencies
|
||||
ansible.builtin.include_tasks: pre.yml
|
||||
tags: always
|
||||
|
||||
- name: Install and configure UFW
|
||||
ansible.builtin.include_tasks:
|
||||
file: ufw.yml
|
||||
apply:
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
when: ufw_enable
|
||||
tags:
|
||||
- roles::cis::ufw
|
||||
|
||||
- name: Configure sysctl
|
||||
ansible.builtin.include_tasks: sysctl.yml
|
||||
tags:
|
||||
- roles::cis::sysctl
|
||||
|
||||
- name: Disable kernel network modules
|
||||
ansible.builtin.include_tasks: disablenet.yml
|
||||
tags:
|
||||
- roles::cis::modules
|
||||
|
||||
- name: Disable file system kernel modules
|
||||
ansible.builtin.include_tasks: disablefs.yml
|
||||
tags:
|
||||
- roles::cis::modules
|
||||
|
||||
- name: Disable IPv6
|
||||
ansible.builtin.include_tasks: ipv6.yml
|
||||
when: disable_ipv6
|
||||
tags:
|
||||
- roles::cis::ipv6
|
||||
|
||||
- name: Configure systemd system and users
|
||||
ansible.builtin.include_tasks: systemdconf.yml
|
||||
tags:
|
||||
- roles::cis::users
|
||||
|
||||
- name: Configure systemd journald and logrotate
|
||||
ansible.builtin.include_tasks: journalconf.yml
|
||||
tags:
|
||||
- roles::cis::log
|
||||
|
||||
- name: Configure systemd timesyncd
|
||||
ansible.builtin.include_tasks: timesyncd.yml
|
||||
tags:
|
||||
- roles::cis::systemd
|
||||
|
||||
- name: Clean fstab
|
||||
ansible.builtin.include_tasks: fstab.yml
|
||||
tags:
|
||||
- roles::cis::fstab
|
||||
|
||||
- name: Configure shm and tmp mounts
|
||||
ansible.builtin.include_tasks: mount.yml
|
||||
tags:
|
||||
- roles::cis::mounts
|
||||
|
||||
- name: Disable prelink
|
||||
ansible.builtin.include_tasks: prelink.yml
|
||||
tags:
|
||||
- roles::cis::prelink
|
||||
|
||||
- name: Configure package managers, update caches and install updates
|
||||
ansible.builtin.include_tasks: packagemgmt.yml
|
||||
tags:
|
||||
- roles::cis::packages
|
||||
|
||||
- name: Configure hosts.allow and hosts.deny
|
||||
when: not custom_hosts_acls
|
||||
ansible.builtin.include_tasks: hosts.yml
|
||||
tags:
|
||||
- roles::cis::hosts
|
||||
|
||||
- name: Configure login.defs
|
||||
ansible.builtin.include_tasks: logindefs.yml
|
||||
tags:
|
||||
- roles::cis::logindefs
|
||||
|
||||
- name: Set limits
|
||||
ansible.builtin.include_tasks: limits.yml
|
||||
tags:
|
||||
- roles::cis::limits
|
||||
|
||||
- name: Configure adduser and useradd
|
||||
ansible.builtin.include_tasks: adduser.yml
|
||||
tags:
|
||||
- roles::cis::adduser
|
||||
|
||||
- name: Restrict root access
|
||||
ansible.builtin.include_tasks: rootaccess.yml
|
||||
tags:
|
||||
- roles::cis::root
|
||||
|
||||
- name: Configure needrestart, install and remove various packages
|
||||
ansible.builtin.include_tasks: packages.yml
|
||||
tags:
|
||||
- roles::cis::packages
|
||||
|
||||
- name: Configure ssh server and client
|
||||
ansible.builtin.include_tasks: sshconfig.yml
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- roles::cis::ssh
|
||||
|
||||
- name: Configure PAM
|
||||
ansible.builtin.include_tasks: password.yml
|
||||
tags:
|
||||
- roles::cis::pam
|
||||
|
||||
- name: Configure and clean at and cron
|
||||
ansible.builtin.include_tasks: cron.yml
|
||||
tags:
|
||||
- roles::cis::cron
|
||||
|
||||
- name: Disable systemd ctrl-alt-del.target
|
||||
ansible.builtin.include_tasks: ctrlaltdel.yml
|
||||
tags:
|
||||
- roles::cis::ctrlaltdel
|
||||
|
||||
- name: Configure auditd
|
||||
ansible.builtin.include_tasks: auditd.yml
|
||||
tags:
|
||||
- roles::cis::auditd
|
||||
|
||||
- name: Configure AppArmor
|
||||
ansible.builtin.include_tasks: apparmor.yml
|
||||
tags:
|
||||
- roles::cis::apparmor
|
||||
|
||||
- name: Disable misc kernel modules
|
||||
ansible.builtin.include_tasks: disablemod.yml
|
||||
tags:
|
||||
- roles::cis::modules
|
||||
|
||||
- name: Disable wireless interfaces
|
||||
ansible.builtin.include_tasks: disablewireless.yml
|
||||
when: disable_wireless
|
||||
tags:
|
||||
- roles::cis::wireless
|
||||
|
||||
- name: Manage users
|
||||
ansible.builtin.include_tasks: users.yml
|
||||
tags:
|
||||
- roles::cis::users
|
||||
|
||||
- name: Remove suid/sgid permissions
|
||||
ansible.builtin.include_tasks: suid.yml
|
||||
when: suid_sgid_permissions | bool
|
||||
tags:
|
||||
- roles::cis::suid
|
||||
|
||||
- name: Configure compiler permissions
|
||||
ansible.builtin.include_tasks: compilers.yml
|
||||
tags:
|
||||
- roles::cis::compilers
|
||||
|
||||
- name: Set umask
|
||||
ansible.builtin.include_tasks: umask.yml
|
||||
tags:
|
||||
- roles::cis::umask
|
||||
|
||||
- name: Configure paths
|
||||
ansible.builtin.include_tasks: path.yml
|
||||
tags:
|
||||
- roles::cis::path
|
||||
|
||||
- name: Configure systemd logind
|
||||
ansible.builtin.include_tasks: logindconf.yml
|
||||
tags:
|
||||
- roles::cis::logind
|
||||
|
||||
- name: Configure rkhunter
|
||||
ansible.builtin.include_tasks: rkhunter.yml
|
||||
tags:
|
||||
- roles::cis::rkhunter
|
||||
|
||||
- name: Add issue message
|
||||
ansible.builtin.include_tasks: issue.yml
|
||||
tags:
|
||||
- roles::cis::issue
|
||||
|
||||
- name: Configure apport
|
||||
ansible.builtin.include_tasks: apport.yml
|
||||
tags:
|
||||
- roles::cis::apport
|
||||
|
||||
- name: Lock root account
|
||||
ansible.builtin.include_tasks: lockroot.yml
|
||||
tags:
|
||||
- roles::cis::root
|
||||
|
||||
- name: Configure Postfix
|
||||
ansible.builtin.include_tasks: postfix.yml
|
||||
tags:
|
||||
- roles::cis::postfix
|
||||
|
||||
- name: Configure motdnews
|
||||
ansible.builtin.include_tasks: motdnews.yml
|
||||
tags:
|
||||
- roles::cis::motdnews
|
||||
|
||||
- name: Configure sudo
|
||||
ansible.builtin.include_tasks: sudo.yml
|
||||
tags:
|
||||
- roles::cis::sudo
|
||||
|
||||
- name: Miscellaneous extra tasks
|
||||
ansible.builtin.include_tasks: extras.yml
|
||||
tags:
|
||||
- roles::cis::extras
|
||||
|
||||
- name: Miscellaneous tasks after all handlers
|
||||
ansible.builtin.include_tasks: post.yml
|
||||
tags:
|
||||
- always
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
- name: Stat /etc/default/motd-news
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/motd-news
|
||||
register: motd_news
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- motd
|
||||
|
||||
- name: Disable motd-news
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^ENABLED="
|
||||
line: "ENABLED=0"
|
||||
dest: /etc/default/motd-news
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
notify:
|
||||
- Mask motdnews timer
|
||||
- Mask motdnews service
|
||||
when: ansible_os_family == "Debian" and motd_news.stat.exists
|
||||
tags:
|
||||
- motd
|
||||
|
||||
- name: Find update-motd.d files
|
||||
become: true
|
||||
ansible.builtin.find:
|
||||
paths: /etc/update-motd.d
|
||||
file_type: file
|
||||
register: update_motd_permissions
|
||||
tags:
|
||||
- motd
|
||||
|
||||
- name: Update motd permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
dest: "{{ item.path }}"
|
||||
mode: "0444"
|
||||
with_items:
|
||||
- "{{ update_motd_permissions.files }}"
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- motd
|
||||
|
||||
- name: Set /etc/update-motd.d permission
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
dest: /etc/update-motd.d
|
||||
mode: "0755"
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- motd
|
||||
|
||||
- name: Stat /usr/bin/pro
|
||||
ansible.builtin.stat:
|
||||
path: /usr/bin/pro
|
||||
register: ubuntu_advantage_pro
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- apt_news
|
||||
- ubuntu-pro
|
||||
|
||||
- name: Check apt_news status
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
pro config show | grep '^apt_news.*False'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: ubuntu_advantage_pro_state
|
||||
changed_when: ubuntu_advantage_pro_state.rc != 0
|
||||
failed_when: ubuntu_advantage_pro_state.rc > 1
|
||||
when: ansible_os_family == "Debian" and ubuntu_advantage_pro.stat.exists
|
||||
tags:
|
||||
- apt_news
|
||||
- ubuntu-pro
|
||||
|
||||
- name: Disable apt_news
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: pro config set apt_news=false
|
||||
register: disable_apt_news
|
||||
changed_when: disable_apt_news.rc != 0
|
||||
failed_when: disable_apt_news.rc != 0
|
||||
when:
|
||||
- ansible_os_family == "Debian"
|
||||
- ubuntu_advantage_pro.stat.exists
|
||||
- ubuntu_advantage_pro_state.rc != 0
|
||||
tags:
|
||||
- apt_news
|
||||
- ubuntu-pro
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
- name: Mount /proc with additional options
|
||||
become: true
|
||||
ansible.posix.mount:
|
||||
name: /proc
|
||||
src: none
|
||||
fstype: proc
|
||||
opts: rw,nosuid,nodev,noexec,relatime,hidepid={{ hide_pid | int }},gid={{ process_group }}
|
||||
state: present
|
||||
tags:
|
||||
- mount
|
||||
- proc
|
||||
|
||||
- name: Stat /dev/shm
|
||||
ansible.builtin.stat:
|
||||
path: /dev/shm
|
||||
register: dev_shm
|
||||
tags:
|
||||
- mount
|
||||
- shm
|
||||
|
||||
- name: Mount /dev/shm with noexec
|
||||
become: true
|
||||
ansible.posix.mount:
|
||||
name: /dev/shm
|
||||
src: none
|
||||
fstype: tmpfs
|
||||
opts: rw,nosuid,nodev,noexec
|
||||
state: present
|
||||
when: dev_shm.stat.exists
|
||||
tags:
|
||||
- mount
|
||||
- shm
|
||||
- CCE-80837-8
|
||||
- CCE-80838-6
|
||||
- CCE-80839-4
|
||||
- CIS-UBUNTU2004-1.1.7
|
||||
- CIS-UBUNTU2004-1.1.8
|
||||
- CIS-UBUNTU2004-1.1.9
|
||||
|
||||
- name: Add systemd tmp.mount
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/tmp.mount.j2
|
||||
dest: /etc/systemd/system/tmp.mount
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- mount
|
||||
- tmp
|
||||
- CCE-82139-7
|
||||
- CCE-82140-5
|
||||
- CCE-82623-0
|
||||
|
||||
- name: Stat tmp.mount
|
||||
ansible.builtin.stat:
|
||||
path: /etc/systemd/system/tmp.mount
|
||||
register: tmp_mount
|
||||
tags:
|
||||
- mount
|
||||
- tmp
|
||||
|
||||
- name: Unmask tmp.mount
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: tmp.mount
|
||||
masked: false
|
||||
when: tmp_mount.stat.exists
|
||||
tags:
|
||||
- mount
|
||||
- tmp
|
||||
|
||||
- name: Start tmp.mount
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: tmp.mount
|
||||
daemon_reload: true
|
||||
state: started
|
||||
enabled: true
|
||||
when: tmp_mount.stat.exists
|
||||
tags:
|
||||
- mount
|
||||
- tmp
|
||||
@@ -0,0 +1,264 @@
|
||||
---
|
||||
- name: Configure apt
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/apt/apt.conf.d/98-hardening-ubuntu
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
line: "{{ item }}"
|
||||
with_items:
|
||||
- 'Acquire::AllowDowngradeToInsecureRepositories "false";'
|
||||
- 'Acquire::AllowInsecureRepositories "false";'
|
||||
- 'Acquire::http::AllowRedirect "false";'
|
||||
- 'APT::Get::AllowUnauthenticated "false";'
|
||||
- 'APT::Get::AutomaticRemove "true";'
|
||||
- 'APT::Install-Recommends "false";'
|
||||
- 'APT::Install-Suggests "false";'
|
||||
- 'APT::Periodic::AutocleanInterval "7";'
|
||||
- 'APT::Sandbox::Seccomp "1";'
|
||||
- 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
|
||||
- 'Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";'
|
||||
- 'Unattended-Upgrade::Automatic-Reboot "{{ unattended_reboot }}";'
|
||||
- 'Unattended-Upgrade::Automatic-Reboot-WithUsers "true";'
|
||||
- 'Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_reboot_time }}";'
|
||||
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- apt
|
||||
- M1045
|
||||
|
||||
- name: Run apt update
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
cache_valid_time: 1800
|
||||
notify:
|
||||
- Run apt-get clean
|
||||
- Run apt-get autoremove
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- apt
|
||||
|
||||
- name: Run apt upgrade
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
upgrade: safe
|
||||
register: apt_upgrade_response
|
||||
changed_when: apt_upgrade_response.stdout.find('0 upgraded') == -1
|
||||
when: ansible_os_family == "Debian" and system_upgrade | bool
|
||||
tags:
|
||||
- apt
|
||||
- CIS-UBUNTU2004-1.9
|
||||
- D3-SU
|
||||
- M1051
|
||||
|
||||
- name: Link dnf.conf
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
src: /etc/dnf/dnf.conf
|
||||
dest: /etc/yum.conf
|
||||
owner: root
|
||||
group: root
|
||||
state: link
|
||||
when: ansible_distribution == "Fedora"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
|
||||
- name: Import RedHat RPM key
|
||||
become: true
|
||||
ansible.builtin.rpm_key:
|
||||
state: present
|
||||
key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
|
||||
with_items:
|
||||
- "{{ redhat_signing_keys }}"
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
- CCE-80795-8
|
||||
|
||||
- name: Set yum.conf gpgcheck
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^gpgcheck="
|
||||
line: "gpgcheck=1"
|
||||
dest: /etc/yum.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
- CCE-80790-9
|
||||
- CCE-80792-5
|
||||
- M1045
|
||||
|
||||
- name: Set yum.conf clean_requirements
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "clean_requirements_on_remove=True"
|
||||
dest: /etc/yum.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
insertafter: "[main]"
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
- CCE-82476-3
|
||||
|
||||
- name: Set yum.conf localpkg_gpgcheck
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "localpkg_gpgcheck=1"
|
||||
dest: /etc/yum.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
insertafter: "[main]"
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
- CCE-80791-7
|
||||
- M1045
|
||||
|
||||
- name: Comment yum.conf repo_gpgcheck
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "# repo_gpgcheck=1"
|
||||
dest: /etc/yum.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
insertafter: "[main]"
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
|
||||
- name: RHEL8 package management tasks
|
||||
when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "8"
|
||||
block:
|
||||
- name: Import RHEL8 necessary GPG keys
|
||||
become: true
|
||||
ansible.builtin.rpm_key:
|
||||
state: present
|
||||
key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
|
||||
with_items:
|
||||
- "{{ epel8_signing_keys }}"
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: RHEL8 EPEL repo installation
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm"
|
||||
state: present
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Install CodeReady repo for RHEL8
|
||||
become: true
|
||||
ansible.builtin.command: subscription-manager repos --enable "codeready-builder-for-rhel-8-{{ ansible_architecture }}-rpms"
|
||||
changed_when: false
|
||||
|
||||
- name: RHEL7 repo tasks
|
||||
when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "7"
|
||||
block:
|
||||
- name: Import RHEL7 necessary GPG keys
|
||||
become: true
|
||||
ansible.builtin.rpm_key:
|
||||
state: present
|
||||
key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
|
||||
with_items:
|
||||
- "{{ epel7_signing_keys }}"
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: RHEL7 EPEL repo installation
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
|
||||
state: present
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Install Extras and HA for RHEL7
|
||||
become: true
|
||||
ansible.builtin.command: subscription-manager repos --enable "rhel-*-optional-rpms" --enable "rhel-*-extras-rpms" --enable "rhel-ha-for-rhel-*-server-rpms"
|
||||
changed_when: false
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Stat PowerTools repository files
|
||||
ansible.builtin.stat:
|
||||
path: "{{ item }}"
|
||||
with_items:
|
||||
- /etc/yum.repos.d/almalinux-crb.repo
|
||||
- /etc/yum.repos.d/almalinux-powertools.repo
|
||||
- /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
|
||||
- /etc/yum.repos.d/CentOS-PowerTools.repo
|
||||
- /etc/yum.repos.d/CentOS-Stream-PowerTools.repo
|
||||
register: powertools_repo
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Enable the PowerTools repository
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: "^enabled=.*$"
|
||||
replace: "enabled=1"
|
||||
dest: "{{ item.stat.path }}"
|
||||
with_items:
|
||||
- "{{ powertools_repo.results }}"
|
||||
when: ansible_os_family == "RedHat" and item.stat.exists
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Update dnf cache
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
update_cache: true
|
||||
when: ansible_os_family == "RedHat"
|
||||
notify:
|
||||
- Run dnf autoremove
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
|
||||
- name: Run dnf upgrade
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "*" # noqa package-latest
|
||||
state: latest
|
||||
bugfix: true
|
||||
security: true
|
||||
nobest: true
|
||||
when: ansible_os_family == "RedHat" and system_upgrade | bool
|
||||
tags:
|
||||
- dnf
|
||||
- yum
|
||||
- CCE-80865-9
|
||||
- D3-SU
|
||||
- M1051
|
||||
@@ -0,0 +1,222 @@
|
||||
---
|
||||
- name: Merge package lists
|
||||
ansible.builtin.set_fact:
|
||||
packages_merged: "{{ packages_debian + packages_redhat + packages_ubuntu }}"
|
||||
tags:
|
||||
- packages
|
||||
|
||||
- name: Configure needrestart
|
||||
tags:
|
||||
- needrestart
|
||||
- packages
|
||||
block:
|
||||
- name: Pre register needrestart configuration directory
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/needrestart/conf.d
|
||||
register: needrestart_directory_created
|
||||
|
||||
- name: Create needrestart directory
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/needrestart/conf.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
recurse: true
|
||||
when: ("needrestart" in packages_merged) and not needrestart_directory_created.stat.exists
|
||||
|
||||
- name: Stat needrestart configuration directory
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/needrestart/conf.d
|
||||
register: needrestart_directory
|
||||
|
||||
- name: Get needrestart restart value
|
||||
ansible.builtin.command:
|
||||
cmd: grep -Rqo "$nrconf{restart} = 'l';" /etc/needrestart/conf.d/
|
||||
register: needrestart_restart_set
|
||||
when: needrestart_directory.stat.exists
|
||||
changed_when: needrestart_restart_set.rc != 0
|
||||
failed_when: needrestart_restart_set.rc > 1
|
||||
|
||||
- name: Configure needrestart
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/needrestart/conf.d/00-restart.conf
|
||||
line: "$nrconf{restart} = 'l';"
|
||||
create: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
when: needrestart_directory.stat.exists and needrestart_restart_set.rc != 0
|
||||
|
||||
- name: Debian family package installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages_debian }}"
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- packages
|
||||
- CIS-UBUNTU2004-1.6.1.1
|
||||
- CIS-UBUNTU2004-4.1.1.1
|
||||
- CIS-UBUNTU2004-4.2.1.1
|
||||
- M1049
|
||||
- UBTU-20-010005
|
||||
|
||||
- name: Ubuntu package installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages_ubuntu }}"
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
tags:
|
||||
- packages
|
||||
|
||||
- name: Ubuntu update-notifier-common package installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "update-notifier-common"
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_distribution == "Ubuntu"
|
||||
tags:
|
||||
- packages
|
||||
|
||||
- name: RedHat family package installation
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "{{ packages_redhat }}"
|
||||
state: present
|
||||
when: ansible_os_family == "RedHat"
|
||||
notify:
|
||||
- Enable haveged
|
||||
tags:
|
||||
- packages
|
||||
- CCE-80847-7
|
||||
- CCE-81043-2
|
||||
- CCE-82859-0
|
||||
- CCE-83303-8
|
||||
- M1049
|
||||
|
||||
- name: Run apt purge
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages_blocklist }}"
|
||||
state: absent
|
||||
purge: true
|
||||
when: ansible_os_family == "Debian"
|
||||
register: apt_purge
|
||||
failed_when: apt_purge is not success and not "No package" in apt_purge.msg
|
||||
tags:
|
||||
- packages
|
||||
- M1042
|
||||
|
||||
- name: Generic package removal
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: "{{ packages_blocklist }}"
|
||||
state: absent
|
||||
register: package_removal
|
||||
failed_when: package_removal is not success and not "No package" in package_removal.msg
|
||||
tags:
|
||||
- packages
|
||||
- CCE-80873-3
|
||||
- CCE-82182-7
|
||||
- CCE-82184-3
|
||||
- CCE-82436-7
|
||||
- CIS-UBUNTU2004-1.1.23
|
||||
- CIS-UBUNTU2004-1.5.3
|
||||
- CIS-UBUNTU2004-2.1.3
|
||||
- CIS-UBUNTU2004-2.1.16
|
||||
- CIS-UBUNTU2004-2.2.2
|
||||
- CIS-UBUNTU2004-2.2.3
|
||||
- CIS-UBUNTU2004-2.2.4
|
||||
- CIS-UBUNTU2004-2.2.6
|
||||
- M1042
|
||||
|
||||
- name: VirtualBox guest packages installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "{{ packages }}"
|
||||
state: present
|
||||
install_recommends: false
|
||||
vars:
|
||||
packages:
|
||||
- virtualbox-guest-dkms
|
||||
- virtualbox-guest-utils
|
||||
register: virtualbox_packages
|
||||
when: ansible_virtualization_type == "VirtualBox" and
|
||||
ansible_distribution == "Ubuntu"
|
||||
failed_when: virtualbox_packages is not success and not "No package matching" in virtualbox_packages.msg
|
||||
tags:
|
||||
- packages
|
||||
- virtualbox
|
||||
|
||||
- name: VMWare package installation
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: open-vm-tools
|
||||
state: present
|
||||
when: ansible_virtualization_type == "VMware"
|
||||
tags:
|
||||
- packages
|
||||
- vmware
|
||||
|
||||
- name: QEMU package installation
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: qemu-guest-agent
|
||||
state: present
|
||||
when: ansible_system_vendor == "QEMU"
|
||||
tags:
|
||||
- packages
|
||||
- qemu
|
||||
|
||||
- name: Install rng-tools
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: rng-tools
|
||||
state: present
|
||||
when: ansible_local.cpuinfo.rdrand
|
||||
tags:
|
||||
- rng-tools
|
||||
- packages
|
||||
- CCE-82968-9
|
||||
|
||||
- name: Stat sysstat default
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/default/sysstat
|
||||
register: default_sysstat
|
||||
tags:
|
||||
- packages
|
||||
- sysstat
|
||||
|
||||
- name: Enable sysstat
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^ENABLED"
|
||||
line: 'ENABLED="true"'
|
||||
dest: /etc/default/sysstat
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
when: default_sysstat.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- sysstat
|
||||
|
||||
- name: Remove unneeded Debian dependencies
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
autoclean: true
|
||||
autoremove: true
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- packages
|
||||
@@ -0,0 +1,297 @@
|
||||
---
|
||||
- name: Stat faillock
|
||||
become: true
|
||||
ansible.builtin.find:
|
||||
paths:
|
||||
[
|
||||
"/usr/local/sbin",
|
||||
"/usr/local/bin",
|
||||
"/usr/sbin",
|
||||
"/usr/bin",
|
||||
"/sbin",
|
||||
"/bin",
|
||||
"/snap/bin",
|
||||
]
|
||||
patterns: "faillock"
|
||||
recurse: true
|
||||
register: faillock
|
||||
tags:
|
||||
- common-account
|
||||
- common-auth
|
||||
- pam
|
||||
|
||||
- name: Stat faillock configuration file
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/security/faillock.conf
|
||||
register: faillockconf
|
||||
tags:
|
||||
- common-account
|
||||
- common-auth
|
||||
- pam
|
||||
|
||||
- name: Configure faillock.conf
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/security/faillock.conf
|
||||
mode: "0644"
|
||||
state: present
|
||||
line: "{{ item }}"
|
||||
with_items:
|
||||
- "audit"
|
||||
- "local_users_only"
|
||||
- "deny = 5"
|
||||
- "fail_interval = 900"
|
||||
when: faillockconf.stat.exists
|
||||
tags:
|
||||
- common-account
|
||||
- common-auth
|
||||
- pam
|
||||
|
||||
- name: Debian OS family PAM configuration
|
||||
become: true
|
||||
when: ansible_os_family == "Debian"
|
||||
block:
|
||||
- name: Configure common-password
|
||||
ansible.builtin.template:
|
||||
src: etc/pam.d/common-password.j2
|
||||
dest: /etc/pam.d/common-password
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- common-password
|
||||
- pam
|
||||
- CIS-UBUNTU2004-5.4.3
|
||||
- CIS-UBUNTU2004-5.4.4
|
||||
- UBTU-20-010070
|
||||
|
||||
- name: Configure common-auth
|
||||
ansible.builtin.template:
|
||||
src: etc/pam.d/common-auth.j2
|
||||
dest: /etc/pam.d/common-auth
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- common-auth
|
||||
- pam
|
||||
- CIS-UBUNTU2004-5.4.2
|
||||
- M1036
|
||||
- UBTU-20-010072
|
||||
|
||||
- name: Configure common-account
|
||||
ansible.builtin.template:
|
||||
src: etc/pam.d/common-account.j2
|
||||
dest: /etc/pam.d/common-account
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- common-account
|
||||
- pam
|
||||
- M1036
|
||||
|
||||
- name: Configure login
|
||||
ansible.builtin.template:
|
||||
src: etc/pam.d/login.j2
|
||||
dest: /etc/pam.d/login
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- login
|
||||
- pam
|
||||
- UBTU-20-010075
|
||||
|
||||
- name: RedHat OS family PAM configuration
|
||||
become: true
|
||||
when: ansible_os_family == "RedHat"
|
||||
block:
|
||||
- name: Remove nullok from system-auth
|
||||
ansible.builtin.replace:
|
||||
dest: /etc/pam.d/system-auth
|
||||
regexp: "nullok"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- system-auth
|
||||
- pam
|
||||
- CCE-80841-0
|
||||
|
||||
- name: Remove nullok from password-auth
|
||||
ansible.builtin.replace:
|
||||
dest: /etc/pam.d/password-auth
|
||||
regexp: "nullok"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- password-auth
|
||||
- pam
|
||||
|
||||
- name: Remove nullok from sssd-shadowutils
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
dest: /etc/pam.d/sssd-shadowutils
|
||||
regexp: "nullok"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- sssd-shadowutils
|
||||
- pam
|
||||
|
||||
- name: Set system-auth remember
|
||||
ansible.builtin.replace:
|
||||
regexp: 'use_authtok(\s+.*)'
|
||||
replace: "use_authtok remember=5"
|
||||
dest: /etc/pam.d/system-auth
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- system-auth
|
||||
- CCE-80666-1
|
||||
|
||||
- name: Configure pwquality
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/security/pwquality.conf
|
||||
line: "{{ item.key }} = {{ item.value }}"
|
||||
regexp: ".*{{ item.key }} = "
|
||||
state: present
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
with_dict: "{{ pwquality_config }}"
|
||||
tags:
|
||||
- pwquality
|
||||
- pam
|
||||
- CCE-80653-9
|
||||
- CCE-80654-7
|
||||
- CCE-80655-4
|
||||
- CCE-80656-2
|
||||
- CCE-80663-8
|
||||
- CCE-80665-3
|
||||
- CCE-82066-2
|
||||
- CCE-82046-4
|
||||
- CIS-UBUNTU2004-5.4.1
|
||||
- D3-SPP
|
||||
- M1027
|
||||
- UBTU-20-010050
|
||||
- UBTU-20-010051
|
||||
- UBTU-20-010052
|
||||
- UBTU-20-010053
|
||||
- UBTU-20-010054
|
||||
- UBTU-20-010055
|
||||
- UBTU-20-010056
|
||||
- UBTU-20-010057
|
||||
|
||||
- name: Stat libuser configuration
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/libuser.conf
|
||||
register: libuser
|
||||
tags:
|
||||
- libuser
|
||||
|
||||
- name: Set libuser crypt_style to sha512
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: 'crypt_style(\s+.*)'
|
||||
replace: "crypt_style = sha512"
|
||||
dest: /etc/libuser.conf
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
when: libuser.stat.exists
|
||||
tags:
|
||||
- libuser
|
||||
- CCE-80891-5
|
||||
|
||||
- name: Stat crypto-policies config
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/crypto-policies/config
|
||||
register: crypto_policies_config
|
||||
tags:
|
||||
- crypto-policy
|
||||
|
||||
- name: Get crypto-policies value
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.builtin.command: grep -qo "^{{ crypto_policy }}$" /etc/crypto-policies/config
|
||||
register: crypto_policy_set
|
||||
when: crypto_policies_config.stat.exists
|
||||
changed_when: crypto_policy_set.rc != 0
|
||||
failed_when: crypto_policy_set.rc > 1
|
||||
tags:
|
||||
- crypto-policy
|
||||
- M1041
|
||||
|
||||
- name: Set crypto-policies
|
||||
become: true
|
||||
ansible.builtin.command: update-crypto-policies --set "{{ crypto_policy | upper }}"
|
||||
register: set_crypto_policies
|
||||
changed_when: set_crypto_policies.rc != 0
|
||||
failed_when: set_crypto_policies.rc != 0
|
||||
when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0
|
||||
tags:
|
||||
- crypto-policy
|
||||
- CCE-80935-0
|
||||
- M1041
|
||||
|
||||
- name: Set FIPS mode
|
||||
become: true
|
||||
ansible.builtin.command: fips-mode-setup --enable # noqa no-changed-when
|
||||
when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0 and crypto_policy.upper == "FIPS"
|
||||
tags:
|
||||
- crypto-policy
|
||||
- CCE-80935-0
|
||||
- CCE-80942-6
|
||||
- CCE-84027-2
|
||||
- M1041
|
||||
|
||||
- name: Add cracklib password list
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: usr/share/dict/passwords.list
|
||||
dest: /usr/share/dict/passwords
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Update Debian cracklib
|
||||
- Update RedHat cracklib
|
||||
tags:
|
||||
- cracklib
|
||||
- pam
|
||||
|
||||
- name: Add local information to password list
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /usr/share/dict/passwords.local
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
create: true
|
||||
line: "{{ item }}"
|
||||
notify:
|
||||
- Update Debian cracklib
|
||||
- Update RedHat cracklib
|
||||
with_items:
|
||||
- "{{ ansible_hostname | lower }}"
|
||||
- "{{ ansible_hostname | upper }}"
|
||||
- "{{ ansible_os_family | lower }}"
|
||||
- "{{ ansible_os_family | upper }}"
|
||||
tags:
|
||||
- cracklib
|
||||
- pam
|
||||
@@ -0,0 +1,27 @@
|
||||
---
|
||||
- name: Set path
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^PATH="
|
||||
line: 'PATH="/usr/local/bin:/usr/sbin:/usr/bin:/bin:/snap/bin"'
|
||||
dest: /etc/environment
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
tags:
|
||||
- path
|
||||
- M1038
|
||||
|
||||
- name: Add path script
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/profile.d/initpath.sh.j2
|
||||
dest: /etc/profile.d/initpath.sh
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- path
|
||||
- M1038
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
- name: Create /boot/grub directory if efi boot
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /boot/grub
|
||||
state: directory
|
||||
mode: "0755"
|
||||
owner: root
|
||||
group: root
|
||||
when: booted_with_efi | bool
|
||||
tags:
|
||||
- grub
|
||||
|
||||
- name: Run all notified handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
- name: Stat RedHat auditd GRUB settings
|
||||
become: true
|
||||
ansible.builtin.shell:
|
||||
cmd: |
|
||||
set -o pipefail
|
||||
grubby --info="/boot/vmlinuz-$(uname -r)" | grep "^args.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
args:
|
||||
executable: /bin/bash
|
||||
register: audit_grubenv
|
||||
when: ansible_os_family == "RedHat"
|
||||
ignore_errors: true
|
||||
tags:
|
||||
- auditd
|
||||
- grub
|
||||
|
||||
- name: Update grub2 if missing GRUB settings
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: grub2-mkconfig
|
||||
register: update_grub_redhat
|
||||
changed_when: update_grub_redhat.rc != 0
|
||||
failed_when: update_grub_redhat.rc != 0
|
||||
when: ansible_os_family == "RedHat" and audit_grubenv.rc != 0
|
||||
tags:
|
||||
- auditd
|
||||
- grub
|
||||
|
||||
- name: Stat Debian auditd GRUB settings
|
||||
become: true
|
||||
ansible.builtin.shell: grep "linux.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}" /boot/grub/grub.cfg
|
||||
changed_when: audit_grub_cfg.rc != 0
|
||||
failed_when: audit_grub_cfg.rc != 0
|
||||
register: audit_grub_cfg
|
||||
ignore_errors: true
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- auditd
|
||||
- grub
|
||||
|
||||
- name: Update GRUB if settings are missing
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: update-grub
|
||||
register: update_grub_debian
|
||||
changed_when: update_grub_debian.rc != 0
|
||||
failed_when: update_grub_debian.rc != 0
|
||||
when: ansible_os_family == "Debian" and audit_grub_cfg.rc != 0
|
||||
tags:
|
||||
- auditd
|
||||
- grub
|
||||
|
||||
- name: Find GRUB config files
|
||||
become: true
|
||||
ansible.builtin.find:
|
||||
paths: /boot
|
||||
patterns: "*.cfg,grubenv"
|
||||
recurse: true
|
||||
register: grub_cfg
|
||||
tags:
|
||||
- grub
|
||||
- CIS-UBUNTU2004-1.4.3
|
||||
|
||||
- name: Set GRUB config permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
mode: "0400"
|
||||
when: item.mode | int > 400
|
||||
changed_when: false
|
||||
with_items:
|
||||
- "{{ grub_cfg.files | reject('search', '/boot/efi/EFI/ubuntu/grub.cfg') | list }}"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
tags:
|
||||
- grub
|
||||
- CIS-UBUNTU2004-1.4.3
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
- name: Stat postfix main.cf
|
||||
ansible.builtin.stat:
|
||||
path: /etc/postfix/main.cf
|
||||
register: postfix_main_cf
|
||||
tags:
|
||||
- packages
|
||||
- postfix
|
||||
|
||||
- name: Configure Postfix disable_vrfy_command
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^disable_vrfy_command"
|
||||
dest: /etc/postfix/main.cf
|
||||
line: "disable_vrfy_command = yes"
|
||||
state: present
|
||||
when: postfix_main_cf.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- postfix
|
||||
|
||||
- name: Configure Postfix inet_interfaces
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^inet_interfaces"
|
||||
dest: /etc/postfix/main.cf
|
||||
line: "inet_interfaces = loopback-only"
|
||||
state: present
|
||||
when: postfix_main_cf.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- postfix
|
||||
|
||||
- name: Configure Postfix smtpd_banner
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^smtpd_banner"
|
||||
dest: /etc/postfix/main.cf
|
||||
line: 'smtpd_banner = \$myhostname - ESMTP'
|
||||
state: present
|
||||
when: postfix_main_cf.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- postfix
|
||||
|
||||
- name: Configure Postfix smtpd_client_restrictions
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^smtpd_client_restrictions"
|
||||
dest: /etc/postfix/main.cf
|
||||
line: "smtpd_client_restrictions = permit_mynetworks,reject"
|
||||
when: postfix_main_cf.stat.exists
|
||||
tags:
|
||||
- packages
|
||||
- postfix
|
||||
...
|
||||
@@ -0,0 +1,119 @@
|
||||
---
|
||||
- name: Update subscription info on RHEL
|
||||
become: true
|
||||
ansible.builtin.command: subscription-manager refresh --force
|
||||
changed_when: false
|
||||
when: ansible_distribution == "RedHat"
|
||||
tags:
|
||||
- subscription
|
||||
|
||||
- name: RedHat family EPEL installation
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "epel-release"
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_os_family == "RedHat" and (not (ansible_distribution == "Fedora" or ansible_distribution == "RedHat"))
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- yum
|
||||
|
||||
- name: Install python-pexpect
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: python-pexpect
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_os_family == "Debian" and ansible_python.version.major <= 2
|
||||
tags:
|
||||
- apt
|
||||
- packages
|
||||
- python
|
||||
|
||||
- name: Install python3-pexpect
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: python3-pexpect
|
||||
state: present
|
||||
update_cache: true
|
||||
when: ansible_os_family == "Debian" and ansible_python.version.major >= 3
|
||||
tags:
|
||||
- apt
|
||||
- packages
|
||||
- python
|
||||
|
||||
- name: Install python2-rpm
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "python2-rpm"
|
||||
state: present
|
||||
when: ansible_distribution == "RedHat" and ansible_python.version.major <= 2
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- python
|
||||
- yum
|
||||
|
||||
- name: Install python3-rpm
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "python3-rpm"
|
||||
state: present
|
||||
when: ansible_distribution == "RedHat" and ansible_python.version.major >= 3
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- python
|
||||
- yum
|
||||
|
||||
- name: Install python3-passlib
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: python3-passlib
|
||||
state: present
|
||||
register: python3_passlib
|
||||
failed_when:
|
||||
- python3_passlib.rc is defined
|
||||
- python3_passlib.rc != 0
|
||||
- not ansible_distribution == "AlmaLinux"
|
||||
tags:
|
||||
- apt
|
||||
- dnf
|
||||
- packages
|
||||
- python
|
||||
- yum
|
||||
|
||||
- name: Install Python pip
|
||||
when:
|
||||
- python3_passlib.rc is defined
|
||||
- python3_passlib.rc != 0
|
||||
block:
|
||||
- name: Python3-pip installation
|
||||
become: true
|
||||
ansible.builtin.package:
|
||||
name: "python3-pip"
|
||||
state: present
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- python
|
||||
- yum
|
||||
|
||||
- name: Pip passlib installation
|
||||
become: true
|
||||
ansible.builtin.pip:
|
||||
name: "passlib"
|
||||
state: present
|
||||
tags:
|
||||
- dnf
|
||||
- packages
|
||||
- python
|
||||
- yum
|
||||
|
||||
- name: EFI or UEFI booting check
|
||||
ansible.builtin.set_fact:
|
||||
booted_with_efi: "{{ ansible_mounts | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}"
|
||||
tags:
|
||||
- fact
|
||||
...
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
- name: Configure sysconfig prelink
|
||||
ansible.builtin.stat:
|
||||
path: /etc/sysconfig/prelink
|
||||
register: sysconfig_prelink
|
||||
tags:
|
||||
- prelink
|
||||
|
||||
- name: Stat prelink configuration file
|
||||
ansible.builtin.stat:
|
||||
path: /etc/prelink.conf
|
||||
register: etc_prelink
|
||||
tags:
|
||||
- prelink
|
||||
|
||||
- name: Disable prelinking
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "PRELINKING=no"
|
||||
dest: /etc/sysconfig/prelink
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
when: ansible_os_family == "RedHat" and sysconfig_prelink.stat.exists
|
||||
tags:
|
||||
- prelink
|
||||
|
||||
- name: Return to non-prelinked state
|
||||
become: true
|
||||
ansible.builtin.command: prelink -ua # noqa no-changed-when
|
||||
when: sysconfig_prelink.stat.exists or etc_prelink.stat.exists
|
||||
tags:
|
||||
- prelink
|
||||
- CIS-UBUNTU2004-1.5.3
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
- name: Configure systemd resolved
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/resolved.conf.j2
|
||||
dest: /etc/systemd/resolved.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- resolved
|
||||
- systemd
|
||||
- CCE-84049-6
|
||||
|
||||
- name: Add nameservers to resolv.conf
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/resolv.conf
|
||||
line: "nameserver {{ item }}"
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
state: present
|
||||
with_items: "{{ dns | split }}"
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- resolved
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
- name: Configure rkhunter
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/default/rkhunter.j2
|
||||
dest: /etc/default/rkhunter
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
when: ansible_os_family == "Debian"
|
||||
notify:
|
||||
- Run rkhunter propupd
|
||||
tags:
|
||||
- packages
|
||||
- rkhunter
|
||||
- M1049
|
||||
|
||||
- name: SSH root access should be disabled
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "ALLOW_SSH_ROOT_USER"
|
||||
line: "ALLOW_SSH_ROOT_USER=no"
|
||||
dest: /etc/rkhunter.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
notify:
|
||||
- Run rkhunter propupd
|
||||
tags:
|
||||
- packages
|
||||
- rkhunter
|
||||
- M1049
|
||||
|
||||
- name: SSH v1 should not be used
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "ALLOW_SSH_PROT_V1"
|
||||
line: "ALLOW_SSH_PROT_V1=0"
|
||||
dest: /etc/rkhunter.conf
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
notify:
|
||||
- Run rkhunter propupd
|
||||
tags:
|
||||
- packages
|
||||
- rkhunter
|
||||
- M1049
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
- name: Stat access.conf
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/security/access.conf
|
||||
register: security_access_conf
|
||||
tags:
|
||||
- access_conf
|
||||
|
||||
- name: Stat securetty
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/securetty
|
||||
register: etc_securetty
|
||||
tags:
|
||||
- securetty
|
||||
|
||||
- name: Clean access.conf
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/security/access.conf
|
||||
regexp: '^(?!\+:root:127.0.0.1)$'
|
||||
mode: "0644"
|
||||
state: absent
|
||||
when: security_access_conf.stat.exists
|
||||
tags:
|
||||
- access_conf
|
||||
|
||||
- name: Allow localhost root in access.conf
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/security/access.conf
|
||||
line: "+:root:127.0.0.1"
|
||||
mode: "0644"
|
||||
state: present
|
||||
when: security_access_conf.stat.exists
|
||||
tags:
|
||||
- access_conf
|
||||
|
||||
- name: Clean securetty
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/securetty
|
||||
regexp: "^(?!console).*$"
|
||||
state: absent
|
||||
when: etc_securetty.stat.exists
|
||||
tags:
|
||||
- securetty
|
||||
|
||||
- name: Allow console in securetty
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/securetty
|
||||
line: "console"
|
||||
mode: "0644"
|
||||
state: present
|
||||
when: etc_securetty.stat.exists
|
||||
tags:
|
||||
- securetty
|
||||
- CIS-UBUNTU2004-5.6
|
||||
|
||||
- name: Mask systemd debug-shell
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
name: debug-shell.service
|
||||
masked: true
|
||||
tags:
|
||||
- systemd
|
||||
- debug-shell
|
||||
- CCE-80876-6
|
||||
@@ -0,0 +1,256 @@
|
||||
---
|
||||
- name: Get installed ssh version
|
||||
ansible.builtin.command:
|
||||
cmd: ssh -V
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
register: ssh_version
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
|
||||
- name: Set ssh version as fact
|
||||
ansible.builtin.set_fact:
|
||||
ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
|
||||
- name: Stat sysconfig sshd configuration
|
||||
ansible.builtin.stat:
|
||||
path: /etc/sysconfig/sshd
|
||||
register: sysconfig_sshd
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
- M1041
|
||||
|
||||
- name: Remove sshd system crypto policy
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/sysconfig/sshd
|
||||
state: absent
|
||||
regexp: ^\s*CRYPTO_POLICY.*$
|
||||
when: sysconfig_sshd.stat.exists
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- CCE-80939-2
|
||||
- M1041
|
||||
|
||||
- name: Get sshd Include config
|
||||
become: true
|
||||
ansible.builtin.command: grep -E "^Include " /etc/ssh/sshd_config
|
||||
register: grep_include
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
- M1041
|
||||
|
||||
- name: Check if sshd_config.d exits
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ssh/sshd_config.d
|
||||
register: sshd_config_d
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
- M1041
|
||||
|
||||
- name: Ensure /etc/ssh/sshd_config permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/ssh/sshd_config
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
|
||||
- name: Configure sshd
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config
|
||||
backup: true
|
||||
mode: "0600"
|
||||
owner: root
|
||||
group: root
|
||||
validate: sshd -t -f %s
|
||||
when: not sshd_config_d.stat.exists or grep_include.rc != 0
|
||||
notify:
|
||||
- Restart sshd service
|
||||
- Restart ssh service
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
- CCE-80895-6
|
||||
- CCE-80896-4
|
||||
- CCE-80897-2
|
||||
- CCE-80898-0
|
||||
- CCE-80901-2
|
||||
- CCE-80902-0
|
||||
- CCE-80903-8
|
||||
- CCE-80904-6
|
||||
- CCE-80905-3
|
||||
- CCE-80906-1
|
||||
- CCE-82177-7
|
||||
- CCE-82281-7
|
||||
- CCE-83360-8
|
||||
- CIS-UBUNTU2004-5.3.1
|
||||
- CIS-UBUNTU2004-5.3.4
|
||||
- CIS-UBUNTU2004-5.3.5
|
||||
- CIS-UBUNTU2004-5.3.6
|
||||
- CIS-UBUNTU2004-5.3.7
|
||||
- CIS-UBUNTU2004-5.3.8
|
||||
- CIS-UBUNTU2004-5.3.9
|
||||
- CIS-UBUNTU2004-5.3.10
|
||||
- CIS-UBUNTU2004-5.3.11
|
||||
- CIS-UBUNTU2004-5.3.12
|
||||
- CIS-UBUNTU2004-5.3.13
|
||||
- CIS-UBUNTU2004-5.3.14
|
||||
- CIS-UBUNTU2004-5.3.15
|
||||
- CIS-UBUNTU2004-5.3.16
|
||||
- CIS-UBUNTU2004-5.3.17
|
||||
- CIS-UBUNTU2004-5.3.18
|
||||
- CIS-UBUNTU2004-5.3.19
|
||||
- CIS-UBUNTU2004-5.3.20
|
||||
- CIS-UBUNTU2004-5.3.21
|
||||
- CIS-UBUNTU2004-5.3.22
|
||||
- M1041
|
||||
- UBTU-20-010036
|
||||
- UBTU-20-010037
|
||||
|
||||
- name: Configure sshd using sshd_config.d
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/sshd_config.j2
|
||||
dest: /etc/ssh/sshd_config.d/01-hardening.conf
|
||||
backup: true
|
||||
mode: "0600"
|
||||
owner: root
|
||||
group: root
|
||||
validate: sshd -t -f %s
|
||||
when: sshd_config_d.stat.exists and grep_include.rc == 0
|
||||
notify:
|
||||
- Restart sshd service
|
||||
- Restart ssh service
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
- CCE-80895-6
|
||||
- CCE-80896-4
|
||||
- CCE-80897-2
|
||||
- CCE-80898-0
|
||||
- CCE-80901-2
|
||||
- CCE-80902-0
|
||||
- CCE-80903-8
|
||||
- CCE-80904-6
|
||||
- CCE-80905-3
|
||||
- CCE-80906-1
|
||||
- CCE-82177-7
|
||||
- CCE-82281-7
|
||||
- CCE-83360-8
|
||||
- CIS-UBUNTU2004-5.3.1
|
||||
- CIS-UBUNTU2004-5.3.4
|
||||
- CIS-UBUNTU2004-5.3.5
|
||||
- CIS-UBUNTU2004-5.3.6
|
||||
- CIS-UBUNTU2004-5.3.7
|
||||
- CIS-UBUNTU2004-5.3.8
|
||||
- CIS-UBUNTU2004-5.3.9
|
||||
- CIS-UBUNTU2004-5.3.10
|
||||
- CIS-UBUNTU2004-5.3.11
|
||||
- CIS-UBUNTU2004-5.3.12
|
||||
- CIS-UBUNTU2004-5.3.13
|
||||
- CIS-UBUNTU2004-5.3.14
|
||||
- CIS-UBUNTU2004-5.3.15
|
||||
- CIS-UBUNTU2004-5.3.16
|
||||
- CIS-UBUNTU2004-5.3.17
|
||||
- CIS-UBUNTU2004-5.3.18
|
||||
- CIS-UBUNTU2004-5.3.19
|
||||
- CIS-UBUNTU2004-5.3.20
|
||||
- CIS-UBUNTU2004-5.3.21
|
||||
- CIS-UBUNTU2004-5.3.22
|
||||
- M1041
|
||||
- UBTU-20-010036
|
||||
- UBTU-20-010037
|
||||
|
||||
- name: Remove possible Subsystem duplicate
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: ^Subsystem.*
|
||||
state: absent
|
||||
when: sshd_config_d.stat.exists and grep_include.rc == 0
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- sshd_config
|
||||
|
||||
- name: Stat sshd host keys
|
||||
become: true
|
||||
ansible.builtin.find:
|
||||
paths: /etc/ssh
|
||||
file_type: file
|
||||
patterns: "ssh_host_*"
|
||||
excludes: "*.pub"
|
||||
register: ssh_host_keys
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- M1022
|
||||
- M1041
|
||||
|
||||
- name: Set sshd host key permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0600"
|
||||
path: "{{ item.path }}"
|
||||
with_items: "{{ ssh_host_keys.files }}"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
tags:
|
||||
- roles::cis::sshd
|
||||
- sshd
|
||||
- CCE-82424-3
|
||||
- CIS-UBUNTU2004-5.3.2
|
||||
- M1022
|
||||
- M1041
|
||||
|
||||
- name: Check if ssh_config.d exits
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ssh/ssh_config.d
|
||||
register: ssh_config_d
|
||||
tags:
|
||||
- roles::cis::ssh
|
||||
- ssh
|
||||
- ssh_config
|
||||
- M1041
|
||||
|
||||
- name: Configure ssh client
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/ssh/ssh_config.j2
|
||||
dest: /etc/ssh/ssh_config
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
tags:
|
||||
- roles::cis::ssh
|
||||
- ssh
|
||||
- ssh_config
|
||||
- CCE-82880-6
|
||||
- M1041
|
||||
@@ -0,0 +1,128 @@
|
||||
---
|
||||
- name: Configure sudo
|
||||
become: true
|
||||
tags:
|
||||
- sudo
|
||||
block:
|
||||
- name: Configure sudo use_pty
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults use_pty"
|
||||
dest: /etc/sudoers.d/011_use_pty
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- CIS-UBUNTU2004-5.2.2
|
||||
|
||||
- name: Configure sudo logfile
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: 'Defaults logfile="/var/log/sudo.log"'
|
||||
dest: /etc/sudoers.d/012_logfile
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- CIS-UBUNTU2004-5.2.3
|
||||
|
||||
- name: Configure sudo disable pwfeedback
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults !pwfeedback"
|
||||
dest: /etc/sudoers.d/013_pwfeedback
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
|
||||
- name: Configure sudo disable visiblepw
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults !visiblepw"
|
||||
dest: /etc/sudoers.d/014_visiblepw
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
|
||||
- name: Remove inconsistently named sudoer file
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /etc/sudoers.d/15_timeout
|
||||
state: absent
|
||||
|
||||
- name: Configure sudo passwd_timeout
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults passwd_timeout=1"
|
||||
dest: /etc/sudoers.d/015_passwdtimeout
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
|
||||
- name: Configure sudo timestamp_timeout
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults timestamp_timeout=5"
|
||||
dest: /etc/sudoers.d/016_timestamptimeout
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
|
||||
- name: Configure sudo timestamp_type
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults timestamp_type=tty"
|
||||
dest: /etc/sudoers.d/017_timestamptype
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- M1028
|
||||
|
||||
- name: Configure sudo user password for privilege escalation
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "Defaults {{ item }}"
|
||||
dest: /etc/sudoers.d/018_userpassword
|
||||
mode: "0440"
|
||||
state: present
|
||||
create: true
|
||||
validate: visudo -cf %s
|
||||
with_items:
|
||||
- "!rootpw"
|
||||
- "!runaspw"
|
||||
- "!targetpw"
|
||||
tags:
|
||||
- V-237642
|
||||
|
||||
- name: Create su group sugroup
|
||||
become: true
|
||||
ansible.builtin.group:
|
||||
name: sugroup
|
||||
state: present
|
||||
tags:
|
||||
- pam
|
||||
- su
|
||||
- sudo
|
||||
- CIS-UBUNTU2004-5.7
|
||||
|
||||
- name: Configure su group
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "auth required pam_wheel.so use_uid group=sugroup"
|
||||
dest: /etc/pam.d/su
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: true
|
||||
tags:
|
||||
- pam
|
||||
- su
|
||||
- sudo
|
||||
- CIS-UBUNTU2004-5.7
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
- name: Remove risky suid bits
|
||||
tags:
|
||||
- suid
|
||||
- CIS-UBUNTU2004-6.1.13
|
||||
- CIS-UBUNTU2004-6.1.14
|
||||
block:
|
||||
- name: Find possible suid binaries
|
||||
ansible.builtin.shell: |
|
||||
command -v "{{ item }}"
|
||||
args:
|
||||
executable: /bin/bash
|
||||
with_items:
|
||||
- "{{ suid_sgid_blocklist }}"
|
||||
register: find_result
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Stat permissions
|
||||
ansible.builtin.stat:
|
||||
path: "{{ item.stdout }}"
|
||||
check_mode: true
|
||||
register: suid_file
|
||||
when:
|
||||
- item.rc == 0
|
||||
with_items:
|
||||
- "{{ find_result.results }}"
|
||||
|
||||
- name: Remove suid/sgid permissions
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.stat.path }}"
|
||||
mode: 'a-s'
|
||||
state: file
|
||||
follow: true
|
||||
when:
|
||||
- item.stat.mode is defined
|
||||
- item.stat.mode | int >= 2000
|
||||
- item.stat.mode | int <= 5000
|
||||
with_items:
|
||||
- "{{ suid_file.results }}"
|
||||
...
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
- name: Set sysctl dev.tty.ldisc_autoload
|
||||
become: true
|
||||
ansible.posix.sysctl:
|
||||
name: dev.tty.ldisc_autoload
|
||||
value: "{{ sysctl_dev_tty_ldisc_autoload | int }}"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
when: ansible_kernel is version("5", ">=")
|
||||
tags:
|
||||
- sysctl
|
||||
|
||||
- name: Set sysctl net.ipv6.conf.accept_ra_rtr_pref
|
||||
become: true
|
||||
ansible.posix.sysctl:
|
||||
name: net.ipv6.conf.{{ ansible_default_ipv4.interface }}.accept_ra_rtr_pref
|
||||
value: "{{ sysctl_net_ipv6_conf_accept_ra_rtr_pref | int }}"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
when: system_has_ipv6
|
||||
tags:
|
||||
- ipv6
|
||||
- sysctl
|
||||
|
||||
- name: Sysctl rules if the system has ipv6
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_settings: "{{ generic_sysctl_settings | combine(ipv4_sysctl_settings) | combine(ipv6_sysctl_settings) }}"
|
||||
when: system_has_ipv6
|
||||
tags:
|
||||
- ipv6
|
||||
- sysctl
|
||||
|
||||
- name: Sysctl rules if the system does not have ipv6
|
||||
ansible.builtin.set_fact:
|
||||
sysctl_settings: "{{ generic_sysctl_settings | combine(ipv4_sysctl_settings) }}"
|
||||
when: not system_has_ipv6
|
||||
tags:
|
||||
- sysctl
|
||||
|
||||
- name: Configure sysctl
|
||||
become: true
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value | int }}"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
with_dict: "{{ sysctl_settings }}"
|
||||
notify:
|
||||
- Restart sysctl
|
||||
tags:
|
||||
- sysctl
|
||||
- CCE-80913-7
|
||||
- CCE-80915-2
|
||||
- CCE-80916-0
|
||||
- CCE-80917-8
|
||||
- CCE-80918-6
|
||||
- CCE-80919-4
|
||||
- CCE-80920-2
|
||||
- CCE-80921-0
|
||||
- CCE-80922-8
|
||||
- CCE-80953-3
|
||||
- CCE-81006-9
|
||||
- CCE-81007-7
|
||||
- CCE-81009-3
|
||||
- CCE-81010-1
|
||||
- CCE-81011-9
|
||||
- CCE-81013-5
|
||||
- CCE-81021-8
|
||||
- CCE-81024-2
|
||||
- CCE-81027-5
|
||||
- CCE-81030-9
|
||||
- CCE-81054-9
|
||||
- CCE-82974-7
|
||||
- CIS-UBUNTU2004-1.5.2
|
||||
- CIS-UBUNTU2004-1.5.4
|
||||
- CIS-UBUNTU2004-3.2.1
|
||||
- CIS-UBUNTU2004-3.2.2
|
||||
- CIS-UBUNTU2004-3.3.1
|
||||
- CIS-UBUNTU2004-3.3.2
|
||||
- CIS-UBUNTU2004-3.3.3
|
||||
- CIS-UBUNTU2004-3.3.4
|
||||
- CIS-UBUNTU2004-3.3.5
|
||||
- CIS-UBUNTU2004-3.3.6
|
||||
- CIS-UBUNTU2004-3.3.7
|
||||
- CIS-UBUNTU2004-3.3.8
|
||||
- CIS-UBUNTU2004-3.3.9
|
||||
- UBTU-20-010412
|
||||
- UBTU-20-010448
|
||||
...
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
- name: Configure systemd system.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/system.conf.j2
|
||||
dest: /etc/systemd/system.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- system
|
||||
- systemd
|
||||
- CCE-80784-2
|
||||
|
||||
- name: Configure systemd user.conf
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/user.conf.j2
|
||||
dest: /etc/systemd/user.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- systemd
|
||||
- users
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
- name: Configure systemd timesyncd
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: etc/systemd/timesyncd.conf.j2
|
||||
dest: /etc/systemd/timesyncd.conf
|
||||
backup: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
notify:
|
||||
- Reload systemd
|
||||
tags:
|
||||
- systemd
|
||||
- timesyncd
|
||||
- CIS-UBUNTU2004-2.1.1.1
|
||||
- CIS-UBUNTU2004-2.1.1.2
|
||||
|
||||
- name: Stat timesyncd status
|
||||
ansible.builtin.command: systemctl status systemd-timesyncd
|
||||
register: timesyncd_status
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
tags:
|
||||
- systemd
|
||||
- timesyncd
|
||||
- CIS-UBUNTU2004-2.1.1.1
|
||||
- CIS-UBUNTU2004-2.1.1.2
|
||||
|
||||
- name: Stat timedatectl show
|
||||
ansible.builtin.command: timedatectl show
|
||||
register: timedatectl_show
|
||||
changed_when: timedatectl_show.stdout.find('NTPSynchronized=yes') == -1 and timesyncd_status.rc == 0
|
||||
tags:
|
||||
- systemd
|
||||
- timesyncd
|
||||
- CIS-UBUNTU2004-2.1.1.1
|
||||
- CIS-UBUNTU2004-2.1.1.2
|
||||
|
||||
- name: Run timedatectl set-ntp
|
||||
become: true
|
||||
ansible.builtin.command: timedatectl set-ntp true # noqa no-changed-when
|
||||
when: timedatectl_show.stdout.find('NTPSynchronized=yes') == -1 and timesyncd_status.rc == 0
|
||||
tags:
|
||||
- systemd
|
||||
- timesyncd
|
||||
- CIS-UBUNTU2004-2.1.1.2
|
||||
@@ -0,0 +1,253 @@
|
||||
---
|
||||
- name: Add the nf_conntrack module
|
||||
become: true
|
||||
community.general.modprobe:
|
||||
name: nf_conntrack
|
||||
state: present
|
||||
tags:
|
||||
- conntrack
|
||||
- sysctl
|
||||
|
||||
- name: Stat nf_conntrack_tcp_be_liberal
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal
|
||||
register: conntrackliberal
|
||||
tags:
|
||||
- conntrack
|
||||
- sysctl
|
||||
|
||||
# https://github.com/ansible/ansible/issues/45446
|
||||
- name: Enable nf_conntrack_tcp_be_liberal to keep connections alive
|
||||
become: true
|
||||
ansible.posix.sysctl:
|
||||
name: net.netfilter.nf_conntrack_tcp_be_liberal
|
||||
value: "1"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
reload: true
|
||||
when: conntrackliberal.stat.exists
|
||||
tags:
|
||||
- conntrack
|
||||
- sysctl
|
||||
|
||||
- name: Debian family UFW installation
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: "ufw"
|
||||
state: present
|
||||
install_recommends: false
|
||||
when: ansible_os_family == "Debian"
|
||||
tags:
|
||||
- ufw
|
||||
- CCE-82998-6
|
||||
- M1037
|
||||
- CIS-UBUNTU2004-3.5.1.1
|
||||
- CIS-UBUNTU2004-3.5.1.3
|
||||
|
||||
- name: RedHat family UFW installation
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
name: "ufw"
|
||||
state: present
|
||||
when: ansible_os_family == "RedHat"
|
||||
tags:
|
||||
- ufw
|
||||
- CCE-82998-6
|
||||
- M1037
|
||||
|
||||
- name: Set UFW IPT_SYSCTL
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^IPT_SYSCTL="
|
||||
line: "IPT_SYSCTL={{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
dest: /etc/default/ufw
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
tags:
|
||||
- ufw
|
||||
- M1037
|
||||
|
||||
- name: Set UFW DEFAULT_FORWARD_POLICY
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
regexp: "^DEFAULT_FORWARD_POLICY="
|
||||
line: 'DEFAULT_FORWARD_POLICY="{{ ufw_default_forward_policy }}"'
|
||||
dest: /etc/default/ufw
|
||||
mode: "0640"
|
||||
state: present
|
||||
create: false
|
||||
backrefs: true
|
||||
tags:
|
||||
- ufw
|
||||
- M1037
|
||||
|
||||
- name: Enable UFW and set default deny incoming
|
||||
become: true
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
direction: incoming
|
||||
policy: deny
|
||||
log: true
|
||||
comment: ansible managed
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.7
|
||||
- D3-ITF
|
||||
- M1037
|
||||
|
||||
- name: Enable UFW and set default deny outgoing
|
||||
become: true
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
direction: outgoing
|
||||
policy: deny
|
||||
log: true
|
||||
logging: low
|
||||
comment: ansible managed
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.7
|
||||
- M1037
|
||||
|
||||
- name: Stat UFW rules
|
||||
become: true
|
||||
ansible.builtin.shell: |
|
||||
set -o pipefail
|
||||
ufw show added | grep '^ufw' | grep -v "'ansible\smanaged'" | sed 's/ufw //g'
|
||||
args:
|
||||
executable: /bin/bash
|
||||
failed_when: ufw_not_managed.rc > 1
|
||||
changed_when: false
|
||||
register: ufw_not_managed
|
||||
tags:
|
||||
- ufw
|
||||
- M1037
|
||||
|
||||
- name: Allow sshd port from administrator networks
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: limit
|
||||
src: "{{ item }}"
|
||||
port: "{{ sshd_port | int }}"
|
||||
proto: tcp
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ ssh_allowed_networks }}"
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- M1037
|
||||
|
||||
- name: Allow incoming specific ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: "{{ item.rule }}"
|
||||
src: "{{ item.from | d('any') }}"
|
||||
port: "{{ item.port | int }}"
|
||||
proto: "{{ item.proto }}"
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ fw_allowed_ports }}"
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- M1037
|
||||
|
||||
- name: Allow outgoing specified ports
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
port: "{{ item | int }}"
|
||||
direction: out
|
||||
comment: ansible managed
|
||||
with_items:
|
||||
- "{{ ufw_outgoing_traffic }}"
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.5
|
||||
- D3-OTF
|
||||
- M1037
|
||||
|
||||
- name: Deny loopback network traffic
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: deny
|
||||
src: "{{ item }}"
|
||||
comment: ansible managed
|
||||
loop:
|
||||
- 127.0.0.0/8
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.4
|
||||
- M1037
|
||||
retries: 5
|
||||
delay: 10
|
||||
when: fw_loopback_traffic_deny
|
||||
|
||||
- name: Allow loopback traffic in
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
interface: lo
|
||||
direction: in
|
||||
comment: ansible managed
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.4
|
||||
- M1037
|
||||
|
||||
- name: Allow loopback traffic out
|
||||
become: true
|
||||
community.general.ufw:
|
||||
rule: allow
|
||||
interface: lo
|
||||
direction: out
|
||||
comment: ansible managed
|
||||
retries: 5
|
||||
delay: 10
|
||||
tags:
|
||||
- ufw
|
||||
- CIS-UBUNTU2004-3.5.1.4
|
||||
- M1037
|
||||
|
||||
- name: Delete unmanaged UFW rules
|
||||
become: true
|
||||
ansible.builtin.command: ufw delete {{ item }} # noqa no-changed-when
|
||||
when: ufw_not_managed.stdout_lines | length > 0 and not ansible_os_family == "RedHat" and ufw_delete_unmanaged
|
||||
with_items:
|
||||
- "{{ ufw_not_managed.stdout_lines }}"
|
||||
tags:
|
||||
- ufw
|
||||
- D3-OTF
|
||||
- M1037
|
||||
|
||||
- name: Configure conntrack sysctl
|
||||
become: true
|
||||
environment:
|
||||
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ansible.posix.sysctl:
|
||||
name: "{{ item.key }}"
|
||||
value: "{{ item.value | int }}"
|
||||
state: present
|
||||
sysctl_set: true
|
||||
sysctl_file: "{{ sysctl_conf_dir }}/zz-hardening.conf"
|
||||
with_dict: "{{ conntrack_sysctl_settings }}"
|
||||
notify:
|
||||
- Restart sysctl
|
||||
tags:
|
||||
- conntrack
|
||||
- sysctl
|
||||
@@ -0,0 +1,125 @@
|
||||
---
|
||||
- name: Stat init.d/rc
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/init.d/rc
|
||||
register: initdrc
|
||||
tags:
|
||||
- umask
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Set default rc umask
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: 'umask(\s+.*)'
|
||||
replace: "umask {{ umask_value }}"
|
||||
dest: /etc/init.d/rc
|
||||
mode: "0755"
|
||||
when: initdrc.stat.exists
|
||||
tags:
|
||||
- umask
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Stat bashrc
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/bashrc
|
||||
register: bashrc
|
||||
tags:
|
||||
- bash
|
||||
- umask
|
||||
- CCE-81036-6
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Set default bashrc umask
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: 'umask(\s+.*)'
|
||||
replace: "umask {{ umask_value }}"
|
||||
dest: /etc/bashrc
|
||||
mode: "0644"
|
||||
when: bashrc.stat.exists
|
||||
tags:
|
||||
- bash
|
||||
- umask
|
||||
- CCE-81036-6
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Stat csh.cshrc
|
||||
become: true
|
||||
ansible.builtin.stat:
|
||||
path: /etc/csh.cshrc
|
||||
register: cshrc
|
||||
tags:
|
||||
- csh
|
||||
- umask
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Set default csh.cshrc umask
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: 'umask(\s+.*)'
|
||||
replace: "umask {{ umask_value }}"
|
||||
dest: /etc/csh.cshrc
|
||||
mode: "0644"
|
||||
when: cshrc.stat.exists
|
||||
tags:
|
||||
- csh
|
||||
- umask
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Set default profile umask
|
||||
become: true
|
||||
ansible.builtin.replace:
|
||||
regexp: 'umask(\s+.*)'
|
||||
replace: "umask {{ umask_value }}"
|
||||
dest: /etc/profile
|
||||
mode: "0644"
|
||||
tags:
|
||||
- umask
|
||||
- CIS-UBUNTU2004-5.5.4
|
||||
- M1022
|
||||
|
||||
- name: Configure readonly TMOUT
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "readonly TMOUT"
|
||||
dest: /etc/profile
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
insertbefore: "^export"
|
||||
tags:
|
||||
- tmout
|
||||
|
||||
- name: Set TMOUT
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "TMOUT=600"
|
||||
dest: /etc/profile
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
insertbefore: "^readonly TMOUT"
|
||||
tags:
|
||||
- tmout
|
||||
- CIS-UBUNTU2004-5.5.5
|
||||
- UBTU-20-010013
|
||||
|
||||
- name: Export TMOUT
|
||||
become: true
|
||||
ansible.builtin.lineinfile:
|
||||
line: "export TMOUT"
|
||||
dest: /etc/profile
|
||||
mode: "0644"
|
||||
state: present
|
||||
create: false
|
||||
insertafter: "^readonly TMOUT"
|
||||
tags:
|
||||
- tmout
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
- name: Remove users
|
||||
become: true
|
||||
ansible.builtin.user:
|
||||
name: "{{ item }}"
|
||||
state: absent
|
||||
remove: true
|
||||
register: remove_users
|
||||
with_items:
|
||||
- "{{ delete_users }}"
|
||||
failed_when: >
|
||||
remove_users is not success and
|
||||
not ("not removing" in remove_users.msg or
|
||||
"not found" in remove_users.msg)
|
||||
tags:
|
||||
- users
|
||||
|
||||
- name: Stat user /home directories
|
||||
ansible.builtin.find:
|
||||
paths: /home
|
||||
file_type: directory
|
||||
register: home_directories
|
||||
tags:
|
||||
- users
|
||||
- CIS-UBUNTU2004-6.2.6
|
||||
- M1022
|
||||
|
||||
- name: Set user /home directories permission
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
mode: "0750"
|
||||
path: "{{ item.path }}"
|
||||
with_items: "{{ home_directories.files }}"
|
||||
loop_control:
|
||||
label: "{{ item.path }}"
|
||||
tags:
|
||||
- users
|
||||
- CIS-UBUNTU2004-6.2.6
|
||||
- M1022
|
||||
Reference in New Issue
Block a user