Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feb25 updates #111

Merged
merged 5 commits into from
Feb 11, 2025
Merged

Feb25 updates #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
071c94b
addressed #98 thanks to @exZACHly
uk-bolly Feb 10, 2025
f436de2
Updated logic for symlinks
uk-bolly Feb 10, 2025
a16c035
Updated NIST naming to standard
uk-bolly Feb 10, 2025
9d7c5c4
updated as per #101
uk-bolly Feb 10, 2025
0188dee
corrected module used
uk-bolly Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion site.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---

- name: Amazon 2023 cis benchmark
- name: Apply Amazon Linux 2023 CIS hardening
hosts: all
become: true

Expand Down
12 changes: 6 additions & 6 deletions tasks/section_1/cis_1.1.1.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
- patch
- rule_1.1.1.1
- squashfs
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disabled"
block:
Expand Down Expand Up @@ -94,7 +94,7 @@
- patch
- rule_1.1.1.3
- cramfs
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.1.1.4 | PATCH | Ensure mounting of freevxfs filesystems is disabled"
block:
Expand Down Expand Up @@ -126,7 +126,7 @@
- patch
- rule_1.1.1.4
- freevxfs
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.1.1.5 | PATCH | Ensure mounting of jffs2 filesystems is disabled"
block:
Expand Down Expand Up @@ -158,7 +158,7 @@
- patch
- rule_1.1.1.5
- jffs2
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.1.1.6 | PATCH | Ensure mounting of hfs filesystems is disabled"
block:
Expand Down Expand Up @@ -190,7 +190,7 @@
- patch
- rule_1.1.1.6
- hfs
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.1.1.7 | PATCH | Ensure mounting of hfsplus filesystems is disabled"
block:
Expand Down Expand Up @@ -222,4 +222,4 @@
- patch
- rule_1.1.1.7
- hfsplus
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7
10 changes: 5 additions & 5 deletions tasks/section_1/cis_1.1.2.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
- audit
- mounts
- rule_1.1.2.1
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

# via fstab
- name: |
Expand Down Expand Up @@ -50,7 +50,7 @@
- rule_1.1.2.2
- rule_1.1.2.3
- rule_1.1.2.4
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

# via systemd
- name: |
Expand All @@ -76,6 +76,6 @@
- rule_1.1.2.2
- rule_1.1.2.3
- rule_1.1.2.4
- nist_sp800-53r5_CM-7
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_CM-7
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
4 changes: 2 additions & 2 deletions tasks/section_1/cis_1.1.3.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,5 +46,5 @@
- skip_ansible_lint
- rule_1.1.3.2
- rule_1.1.3.3
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
4 changes: 2 additions & 2 deletions tasks/section_1/cis_1.1.4.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,5 @@
- rule_1.1.4.2
- rule_1.1.4.3
- rule_1.1.4.4
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
6 changes: 3 additions & 3 deletions tasks/section_1/cis_1.1.5.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
- audit
- mounts
- rule_1.1.5.1
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6

- name: |
"1.1.5.2 | PATCH | Ensure nodev option set on /var/log partition"
Expand Down Expand Up @@ -50,5 +50,5 @@
- rule_1.1.5.2
- rule_1.1.5.3
- rule_1.1.5.4
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
6 changes: 3 additions & 3 deletions tasks/section_1/cis_1.1.6.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
- audit
- mounts
- rule_1.1.6.1
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6

- name: |
"1.1.6.2 | PATCH | Ensure noexec option set on /var/log/audit partition"
Expand Down Expand Up @@ -49,5 +49,5 @@
- rule_1.1.6.2
- rule_1.1.6.3
- rule_1.1.6.4
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
6 changes: 3 additions & 3 deletions tasks/section_1/cis_1.1.7.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
- audit
- mounts
- rule_1.1.7.1
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6

- name: |
"1.1.7.2 | PATCH | Ensure nodev option set on /home partition
Expand All @@ -46,5 +46,5 @@
- mounts
- rule_1.1.7.2
- rule_1.1.7.3
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
6 changes: 3 additions & 3 deletions tasks/section_1/cis_1.1.8.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
- audit
- mounts
- rule_1.1.8.1
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: |
"1.1.8.2 | PATCH | Ensure nodev option set on /dev/shm partition | Set nodev option
Expand All @@ -46,5 +46,5 @@
- rule_1.1.8.2
- rule_1.1.8.3
- rule_1.1.8.4
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
2 changes: 1 addition & 1 deletion tasks/section_1/cis_1.1.9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,4 +33,4 @@
- mounts
- removable_storage
- rule_1.1.9
- nist_sp800-53r5_SI-3
- NIST800-53R5_SI-3
8 changes: 4 additions & 4 deletions tasks/section_1/cis_1.2.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
- manual
- patch
- rule_1.2.1
- nist_sp800-53r5_SI-2
- NIST800-53R5_SI-2

- name: "1.2.2 | PATCH | Ensure gpgcheck is globally activated"
block:
Expand All @@ -53,7 +53,7 @@
- level1-server
- patch
- rule_1.2.2
- nist_sp800-53r5_SI-3
- NIST800-53R5_SI-3

- name: "1.2.3 | AUDIT | Ensure package manager repositories are configured"
block:
Expand Down Expand Up @@ -82,7 +82,7 @@
- manual
- audit
- rule_1.2.3
- nist_sp800-53r5_SI-3
- NIST800-53R5_SI-3

- name: "1.2.4 | AUDIT | Ensure repo_gpgcheck is globally activated"
block:
Expand Down Expand Up @@ -114,4 +114,4 @@
- manual
- audit
- rule_1.2.4
- nist_sp800-53r5_SI-3
- NIST800-53R5_SI-3
6 changes: 3 additions & 3 deletions tasks/section_1/cis_1.3.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
- aide
- patch
- rule_1.3.1
- nist_sp800-53r5_AU-2
- NIST800-53R5_AU-2

- name: "1.3.2 | PATCH | Ensure filesystem integrity is regularly checked"
ansible.builtin.cron:
Expand All @@ -51,7 +51,7 @@
- file_integrity
- patch
- rule_1.3.2
- nist_sp800-53r5_AU-2
- NIST800-53R5_AU-2

- name: "1.3.3 | PATCH | Ensure cryptographic mechanisms are used to protect the integrity of audit tools"
ansible.builtin.blockinfile:
Expand All @@ -73,4 +73,4 @@
- file_integrity
- patch
- rule_1.3.3
- nist_sp800-53r5_AU-2
- NIST800-53R5_AU-2
8 changes: 4 additions & 4 deletions tasks/section_1/cis_1.5.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
- patch
- sysctl
- rule_1.5.1
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6

- name: "1.5.2 | PATCH | Ensure ptrace_scope is restricted"
block:
Expand All @@ -34,7 +34,7 @@
- patch
- sysctl
- rule_1.5.2
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6

- name: "1.5.3 | PATCH | Ensure core dump storage is disabled"
ansible.builtin.lineinfile:
Expand All @@ -49,7 +49,7 @@
- level1-server
- patch
- rule_1.5.3
- nist_sp800-53r5_CM-7
- NIST800-53R5_CM-7

- name: "1.5.4 | PATCH | Ensure core dump backtraces are disabled"
ansible.builtin.lineinfile:
Expand All @@ -63,4 +63,4 @@
- patch
- sysctl
- rule_1.5.4
- nist_sp800-53r5_CM-6
- NIST800-53R5_CM-6
28 changes: 14 additions & 14 deletions tasks/section_1/cis_1.6.1.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@
- level1-server
- patch
- rule_1.6.1.1
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

- name: "1.6.1.2 | PATCH | Ensure SELinux is not disabled in bootloader configuration"
ansible.builtin.replace:
Expand All @@ -31,7 +31,7 @@
- scored
- patch
- rule_1.6.1.2
- nist_sp800-53r5_SI-7
- NIST800-53R5_SI-7

# State set to enforcing because control 1.6.1.5 requires enforcing to be set
- name: "1.6.1.3 | PATCH | Ensure SELinux policy is configured"
Expand All @@ -47,8 +47,8 @@
- selinux
- patch
- rule_1.6.1.3
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

- name: "1.6.1.4 | PATCH | Ensure the SELinux state is not disabled"
ansible.posix.selinux:
Expand All @@ -63,8 +63,8 @@
- selinux
- patch
- rule_1.6.1.4
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
ansible.posix.selinux:
Expand All @@ -80,8 +80,8 @@
- selinux
- patch
- rule_1.6.1.5
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_SI-6
- NIST800-53R5_AC-3
- NIST800-53R5_SI-6

- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist"
block:
Expand Down Expand Up @@ -109,8 +109,8 @@
- audit
- services
- rule_1.6.1.6
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

- name: "1.6.1.7 | PATCH | Ensure SETroubleshoot is not installed"
ansible.builtin.package:
Expand All @@ -124,8 +124,8 @@
- selinux
- patch
- rule_1.6.1.7
- nist_sp800-53r5_AC-3
- nist_sp800-53r5_MP-2
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2

- name: "1.6.1.8 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
ansible.builtin.package:
Expand All @@ -137,4 +137,4 @@
- level1-server
- patch
- rule_1.6.1.8
- nist_sp800-53r5_SI-4
- NIST800-53R5_SI-4
Loading