Skip to content

Adds CIS benchmark hardening #288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 21, 2023
Merged

Adds CIS benchmark hardening #288

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions etc/kayobe/ansible/cis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
---

- name: Security hardening
hosts: overcloud
become: true
tasks:
- name: Remove /etc/motd
# See remediation in:
# https://github.com/wazuh/wazuh/blob/bfa4efcf11e288c0a8809dc0b45fdce42fab8e0d/ruleset/sca/centos/8/cis_centos8_linux.yml#L777
file:
path: /etc/motd
state: absent

- include_role:
name: ansible-lockdown.rhel8_cis
3 changes: 3 additions & 0 deletions etc/kayobe/ansible/requirements.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,6 @@ collections:
version: 0.4.1
roles:
- src: stackhpc.vxlan
- name: ansible-lockdown.rhel8_cis
src: https://github.com/ansible-lockdown/RHEL8-CIS
version: 1.3.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is from July 2021, would be nice to update to 2.1.0 when there is time to validate it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Newer versions do not support CentOS Stream anymore, but it would be good to have a newer version on Ubuntu/Rocky.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doh. Probably something to update in zed/Antelope then.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that it doesn't support inject_facts_as_vars = False.

Copy link
Contributor

@markgoddard markgoddard Feb 22, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm. The playbook should at least have a comment to that effect. I suggested to @GregWhiteyBialas to use the config lookup plugin to check that the option is true for the Wazuh playbook.

4 changes: 4 additions & 0 deletions etc/kayobe/inventory/group_vars/controllers/cis
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---

rhel8cis_is_router: true

24 changes: 24 additions & 0 deletions etc/kayobe/inventory/group_vars/overcloud/cis
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---

# NOTE: kayobe configures NTP. Do not clobber configuration.
rhel8cis_time_synchronization: skip
rhel8cis_rule_2_2_1_1: false
rhel8cis_rule_2_2_1_2: false

# NOTE: disable CIS rolefirewall configuration
rhel8cis_firewall: skip
rhel8cis_rule_3_4_1_1: false

# NOTE: kayobe does not currently support selinux
rhel8cis_selinux_disable: true

# NOTE: This updates the system. Let's do this explicitly.
rhel8cis_rule_1_9: false

# NOTE: FUTURE breaks wazuh agent repo metadata download
rhel8cis_crypto_policy: FIPS

# NOTE: We will remove /etc/motd instead. This prevents a duplicate warning
# from being displayed.
rhel8cis_rule_1_8_1_1: false
rhel8cis_rule_1_8_1_4: false