Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,27 @@
+---
+- name: Disable file system kernel modules
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/modprobe.d/disablefs.conf
+    line: "install {{ item }} /bin/true"
+    mode: "0644"
+    owner: root
+    group: root
+    state: present
+    create: true
+  with_items:
+    - "{{ fs_modules_blocklist }}"
+  tags:
+    - modprobe
+    - CCE-80835-2
+    - CCE-81031-7
+    - CIS-UBUNTU2004-1.1.1.1
+    - CIS-UBUNTU2004-1.1.1.2
+    - CIS-UBUNTU2004-1.1.1.3
+    - CIS-UBUNTU2004-1.1.1.4
+    - CIS-UBUNTU2004-1.1.1.5
+    - CIS-UBUNTU2004-1.1.1.5
+    - CIS-UBUNTU2004-1.1.1.6
+    - CIS-UBUNTU2004-1.1.1.7
+    - M1038
+    - M1042