Skip to content
This repository has been archived by the owner on Nov 23, 2019. It is now read-only.

Disable prelinking, unlink binaries, modify AIDE init parameters #3

Closed
wants to merge 2 commits into from
Closed

Disable prelinking, unlink binaries, modify AIDE init parameters #3

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
88eb120
Update section 1 to use -B for aide --init
beefsalad Aug 12, 2014
1206435
disable prelinking
beefsalad Aug 12, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions cis/section_01.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
---
# CIS Benchmarks Section 1

- name: 1.3.1 Disable Prelinking
lineinfile: dest=/etc/sysconfig/prelink regexp=^PRELINKING= line=PRELINKING=no
- name: 1.3.1 Unlink
shell: /usr/sbin/prelink -ua && touch /etc/sysconfig/prelinking.disabled
creates: /etc/sysconfig/prelinking.disabled
- name: 1.3.1 Install AIDE
action: yum name=aide state=present
- name: "EXTRA: Initializing AIDE if needed (takes a short while)"
action: shell /usr/sbin/aide --init &&
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
creates=/var/lib/aide/aide.db.gz
action: shell /usr/sbin/aide --init -B 'database_out=file:/var/lib/aide/aide.db.gz'
creates=/var/lib/aide/aide.db.gz
- name: 1.3.2 Implement Periodic Execution of File Integrity
action: cron name="Run AIDE (CIS 1.3.2)" minute="0" hour="5" job="/usr/sbin/aide --check"
- name: 1.4.2/1.4.3 Set the SELinux State/Policy (install targeted)
Expand All @@ -24,4 +27,4 @@
- name: 1.6.2 Configure ExecShield
sysctl: name=kernel.exec-shield value=1 state=present
- name: 1.6.3 Enable Randomized Virtual Memory Region Placement
sysctl: name=kernel.randomize_va_space value=2 state=present
sysctl: name=kernel.randomize_va_space value=2 state=present