Skip to content
Ansible playbooks for CIS Benchmarks on RHEL/CentOS 7
Branch: master
Clone or download
Pull request Compare This branch is 27 commits ahead of major:master.
Type Name Latest commit message Commit time
Failed to load latest commit information.
tests Changes to run in docker container Mar 5, 2016
.gitmodules Modified .gitmodules Mar 7, 2016
.travis.yml Checks in docker Mar 5, 2016
LICENSE Initial commit Oct 15, 2013 Split section 9 into level 1/2 Aug 19, 2014 Changed Mar 4, 2016
ansible.cfg Fixes and additions Mar 4, 2016
hosts Fixes and additions Mar 4, 2016

Ansible + CIS Benchmarks + RHEL/CentOS 7

Build Status

This is an ansible playbook for automatically applying CIS Security Benchmarks to a system running Red Hat Enterprise Linux 7 or CentOS 7.

What are these benchmarks?

The Center for Internet Security publishes security benchmarks for various systems. Refer to the CIS site as the authoritative site for anything regarding these benchmarks. You can join their community and contribute to the security benchmarks project.

Please be aware that I'm not affiliated with CIS in any way and the data in this repository has absolutely no relation to CIS.

What does this playbook do?

The playbook will attempt to configure your system to meet as many of the CIS security benchmarks as possible. Any benchmarks marked as "not scored" or benchmarks that are only checks will be skipped.

For full details and caveats, refer to the notes.

How do I run it?


Don't run this blindly on an actively running system. The playbook will make serious modifications to your system that could affect its availability.

Basic operation

Perform a dry run first:

ansible-playbook -i hosts -C playbook.yml

If you're really really ready to apply changes, run it in regular mode:

ansible-playbook -i hosts playbook.yml

Advanced options

Tags are available for running a section at a time:

# Test only items from section 4
ansible-playbook -i hosts -C playbook.yml -t section4

# Apply changes only from items in section 4, 5, and 6
ansible-playbook -i hosts playbook.yml -t section4,section5,section6

The checks are also broken up into Level 1 and Level 2 checks:

  • Level 1: Good security improvements with less effects on production workloads
  • Level 2: Strong security improvements with greater effects on production workloads

Running checks for a particular level is easy:

ansible-playbook -i hosts playbook.yml -t level1
ansible-playbook -i hosts playbook.yml -t level2

How is this playbook licensed?

It's licensed under the Apache License 2.0. The quick summary is:

A license that allows you much freedom with the software, including an explicit right to a patent. “State changes” means that you have to include a notice in each file you modified.
You can’t perform that action at this time.