• Stars
    star
    100
  • Rank 340,627 (Top 7 %)
  • Language
    Shell
  • License
    MIT License
  • Created over 9 years ago
  • Updated 12 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Ansible role for Red Hat 6 DISA STIG

RHEL 6 DISA STIG

Galaxy

Configure RHEL 6 to be DISA STIG compliant. CAT I findings will be corrected by default. CAT II and CAT III findings can be corrected by setting the appropriate variable to enable those tasks.

Not all findings can be remediated automatically, or they require more complex automation specific to your environment in order to be remediated appropriately. See comments in tasks/cat1.yml, tasks/cat2.yml, tasks/cat3.yml for these findings.

This role will make changes to the system that could break things. This is not an auditing tool but rather a remediation tool to be used for system hardening before or after an audit has been conducted.

Installing from Ansible Galaxy

To install this role with ansible-galaxy use the following command:

ansible-galaxy install -p roles nousdefions.STIG-RHEL6

Based on Red Hat Enterprise Linux 6 STIG Version 1 Release 18 - 2018-01-26.

This repo originated from work done by Sam Doran

Requirements

You should have a general understanding of the nature of the changes this role will make to the system. See the DISA IASE site for details.

Role Variables

There are many role variables defined in defaults/main.yml. Here are the most important ones. Feel free to look through defaults/main.yml to see what other configuration options are available.

Name Default Value Description
rhel6stig_cat1 yes Correct CAT I findings
rhel6stig_cat2 no Correct CAT II findings
rhel6stig_cat3 no Correct CAT III findings
rhel6stig_snmp_community B0re4lis SNMP community string
rhel6stig_pass_min_length 15 Minimum password length
rhel6stig_pass_min_days 1 Minimum password age in days
rhel6stig_pass_max_days 60 Maximum password age in days
rhel6stig_pass_reuse 60 Maximum password age in days
rhel6stig_pam_unix_params sha512 shadow try_first_pass use_authtok remember=24 PAM auth parameters
rhel6stig_pam_cracklib_params pam_unix.so try_first_pass PAM auth parameters
rhel6stig_pam_auth_sufficient try_first_pass retry=3 maxrepeat=3 minlen={{ rhel6stig_pass_min_length }} dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4 PAM cracklib parameters
rhel6stig_selinux_pol targeted SELinux policy to apply
rhel6stig_antivirus_required no Whether Anti-virus is required. To enable this you should configure the AV package settings as well.
rhel6stig_av_package complex AV Package settings
rhel6stig_gpg_key_loc complex GPG Key Location (URL or on disk)
rhel6stig_use_dhcp yes Whether the system should use DHCP or Static IPs.
rhel6stig_update_all_packages yes Perform a yum update for all packages.
rhel6stig_maxlogins 10 Max number of simultaneous system logins.
rhel6stig_root_email_address [email protected] Address where system email is sent.
rhel6stig_xwindows_required no Whether or not X Windows is is use on target systems. Disables some changes if X Windows is not in use.
rhel6stig_ipv6_required yes Whether or not IPv6 is in use of the target system.
rhel6stig_tftp_required no Whether or not TFTP is required. If set to yes, this will prevent the removal of tftp and tftp-server packages. It will also reconfigure the tftp-server to run securely.
rhel6stig_rhnsatellite_required no Whether or not Red Hat Satellite is required in the environment. If not required, rhnsd will be stopped and disabled.
rhel6stig_system_is_router no Whether on not the target system is acting as a router. Skips tasks that would break the system if it is a acting as a router
rhel6stig_bootloader_password [Randomly generated and encrypted string] The new GRUB password to use.
rhel6stig_login_banner [DOD banner] Banner used in /etc/issue and /etc/issue.net

Dependencies

python-jmespath

Example Playbooks

Correct CAT I and CAT II findings but don't apply all updates.

- hosts: all
  become: yes

  vars:
    rhel6stig_update_all_packages: no

  roles:
    - role: nousdefions.STIG-RHEL6
      rhel6stig_cat1: yes
      rhel6stig_cat2: yes
      rhel6stig_cat3: no
      when:
          - ansible_os_family == 'RedHat'
          - ansible_distribution_major_version | version_compare('6', '=')

Prompt for the GRUB password.

- hosts: servers
  become: yes

  vars:
    rhel6stig_update_all_packages: no

  vars:
    rhel6stig_cat1: yes
    rhel6stig_cat2: yes
    rhel6stig_cat3: no

  vars_prompt:
    name: "rhel6stig_bootloader_password"
    prompt: "Enter the bootloader password: "
    private: yes
    confirm: yes

  roles:
     - role: nousdefions.STIG-RHEL6

Tags

Each task is tagged with its category, severity, whether or not it is a patch or audit task, and the finding ID, e.g., V-38462. In addition to these four basic tags that all tasks have, there are human-friendly tags such as "ssh" or "dod_logon_banner".

A number of preliminary tasks that do things such as enumerate services on the system and check for the existence of various files will always run unless explicitly skipped by using --skip tags prelim_tasks.

Some examples of using tags:

# Only run tasks that secure ssh
ansible-playbook site.yml --tags ssh

# Don't change SNMP or postfix
ansible-playbook site.yml --skip-tags postfix,mail,snmp

License

MIT

More Repositories

1

RHEL7-CIS

Ansible role for Red Hat 7 CIS Baseline
YAML
473
star
2

RHEL7-STIG

Ansible role for Red Hat 7 STIG Baseline
YAML
283
star
3

RHEL8-CIS

Ansible role for Red Hat 8 CIS Baseline
YAML
262
star
4

UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
YAML
179
star
5

UBUNTU20-CIS

Ansible role for Ubuntu 2004 CIS Baseline
YAML
176
star
6

Windows-2019-CIS

CIS Baseline Ansible Role for Windows 2019
YAML
133
star
7

RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
YAML
113
star
8

RHEL8-STIG

Ansible role for Red Hat 8 STIG Baseline
YAML
95
star
9

Windows-2022-CIS

CIS Baseline Ansible Role for Windows 2022
YAML
65
star
10

Windows-2019-STIG

STIG Baseline Ansible Role for Windows 2019
YAML
35
star
11

UBUNTU22-CIS-Audit

Audit for Ubuntu 22 CIS
YAML
34
star
12

RHEL8-CIS-Audit

Audit configurations for RHEL8 CIS - utilising goss
YAML
31
star
13

UBUNTU18-CIS

CIS Baseline Ansible Role for Ubuntu 18
YAML
30
star
14

AMAZON2-CIS

Ansible role for Amazon Linux 2 CIS Baseline
YAML
28
star
15

Windows-2016-CIS

CIS Baseline Ansible Role for Windows 2016
YAML
24
star
16

AMAZON2023-CIS

Ansible role for Amazon2023 CIS Baseline
YAML
24
star
17

RHEL7-CIS-Audit

Audit configurations for RHEL7 CIS
YAML
21
star
18

Kubernetes1.6.1-CIS

CIS Baseline Ansible Role for Kubernetes 1.6.1
21
star
19

RHEL9-CIS-Audit

Audit configurations for RHEL9 CIS
YAML
18
star
20

RHEL7-STIG-Audit

Audit configurations for RHEL7 STIG
YAML
16
star
21

UBUNTU20-CIS-Audit

CIS Audit configurations for Ubuntu20.04LTS - utilising goss
YAML
16
star
22

UBUNTU20-STIG

STIG Baseline Ansible Role for Ubuntu 20
YAML
14
star
23

RHEL8-STIG-Audit

Audit control files for rhel8 stig - utilising goss
YAML
13
star
24

Windows-2012-Member-Server-STIG

Ansible role for the Windows 2012 Member Server STIG
PowerShell
13
star
25

DEBIAN11-CIS

DEBIAN11- CIS Ansible Role
YAML
13
star
26

Windows-10-STIG

STIG Baseline Ansible Role for Windows 10
YAML
12
star
27

APACHE-2.4-CIS

CIS Baseline Ansible Role for Apache 2.4
HTML
10
star
28

POSTGRES-9-STIG

Ansible Role for the Postgresql 9.x DISA STIG
10
star
29

Benchmark-Generator

Benchmark Generator to create skeleton Ansible content from baseline XCCDF files.
Python
9
star
30

POSTGRES-12-CIS

Ansible Role for the Postgresql 12.x CIS
YAML
9
star
31

RHEL9-STIG

Ansible playbook for RHEL9 Disa STIG
Jinja
9
star
32

Windows-2019-CIS-Audit

Standalone audit function for windows 2019 CIS benchmarks based on goss
YAML
8
star
33

AZURE-CIS

Ansible role for Azure platform CIS baseline
Python
8
star
34

Windows-2016-STIG

STIG Baseline Ansible Role for Windows 2016
YAML
8
star
35

ansible-terrapin-ssh

Playbook for linux hosts to scan and remediate the terrapin ssh bug
YAML
8
star
36

KUBERNETES-STIG

YAML
7
star
37

AMAZON2-CIS-Audit

Audit configuration for Amazon Linux 2 CIS
YAML
7
star
38

Windows-2016-CIS-Audit

Audit content for Windows 2016 CIS
YAML
7
star
39

Windows-2022-STIG

STIG Baseline Ansible Role for Windows 2022
YAML
6
star
40

UBUNTU18-STIG

STIG Baseline Ansible Role for Ubuntu 18
YAML
5
star
41

AWS-FOUNDATIONS-CIS

5
star
42

AMAZON2023-CIS-Audit

Goss Audit for AMAZON 2023
YAML
5
star
43

MPG-AL-READTHEDOCS

MindPoint Group Ansible Lockdown ReadTheDocs
4
star
44

UBUNTU18-CIS-Audit

Audit configurations for Ubuntu 1804 CIS - utilising goss
YAML
4
star
45

Windows-2012-Domain-Controller-STIG

Ansible role for the Windows 2012 Domain Controller STIG
PowerShell
4
star
46

TOMCAT-9-STIG

STIG Baseline Ansible Role for Tomcat 9
Jinja
4
star
47

APACHE-2.4-STIG

STIG Baseline Ansible Role for Apache 2.4
HTML
4
star
48

WinFWADV-STIG

STIG Remediation Role for Windows Firewall and Advanced Security
4
star
49

DEBIAN12-CIS

DEBIAN12- CIS Ansible Role
4
star
50

CISCO-IOS-L2S-STIG

STIG Baseline Ansible Role For Cisco IOS L2 Switch
YAML
3
star
51

lockdown-linux

Shell
3
star
52

Windows-2008R2-Member-Server-STIG

Ansible role for the Windows 2008 Member Server STIG
PowerShell
3
star
53

Windows-10-CIS

CIS Baseline Ansible Role for Windows 10 Enterprise
YAML
3
star
54

DEBIAN11-CIS-Audit

Audit to check Debian 11 CIS compliance
YAML
3
star
55

WinFWADV-STIG-Audit

STIG audit Role for Windows Firewall and Advanced Security
YAML
2
star
56

RHEL5-STIG

Ansible role for Red Hat 5 DISA STIG
2
star
57

Windows-11-CIS

CIS Baseline Ansible Role for Windows 11 Enterprise
YAML
2
star
58

github_linux_IaC

workflow data for github actions and linux server testing of LE content
HCL
2
star
59

.github

Ansible lockdown landing page
1
star
60

CISCO-IOS-RTR-STIG

1
star
61

RHEL9-STIG-Audit

RHEL9 Audit for the STIG benchmark
YAML
1
star
62

RHEL9-CIS-TEST

YAML
1
star