• Stars
    star
    473
  • Rank 92,820 (Top 2 %)
  • Language YAML
  • License
    MIT License
  • Created almost 9 years ago
  • Updated about 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Ansible role for Red Hat 7 CIS Baseline

RHEL 7 CIS

Configure a RHEL/Centos 7 machine to be CIS compliant

Based on CIS RedHat Enterprise Linux 7 Benchmark v3.1.1 - 05-21-2021


Org Stars Stars Forks followers Twitter URL

Ansible Galaxy Quality Discord Badge

Devel Build Status Devel Commits

Release Branch Main Build Status Main Release Date Release Tag

Issues Open Issues Closed Pull Requests

License


Looking for support?

Lockdown Enterprise

Ansible support

Community

On our Discord Server to ask questions, discuss features, or just chat with other Ansible-Lockdown users


Caution(s)

This role will make changes to the system which may have unintended consequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.

Check Mode is not supported! The role will complete in check mode without errors, but it is not supported and should be used with caution. The RHEL7-CIS-Audit role or a compliance scanner should be used for compliance checking over check mode.

This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review this role for any site specific changes that are needed.

To use release version please point to main branch and relevant release for the cis benchmark you wish to work with.


Matching a security Level for CIS

It is possible to to only run level 1 or level 2 controls for CIS. This is managed using tags:

  • level1_server
  • level1_workstation
  • level2_server
  • level2_workstation

The control found in defaults main also need to reflect this as this control the testing thet takes place if you are using the audit component.

Coming from a previous release

CIS release always contains changes, it is highly recommended to review the new references and available variables. This have changed significantly since ansible-lockdown initial release. This is now compatible with python3 if it is found to be the default interpreter. This does come with pre-requisites which it configures the system accordingly.

Further details can be seen in the Changelog

Auditing (new)

This can be turned on or off within the defaults/main.yml file with the variable rhel7cis_run_audit. The value is false by default, please refer to the wiki for more details. The defaults file also populates the goss checks to check only the controls that have been enabled in the ansible role.

This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.

A new form of auditing has been developed, by using a small (12MB) go binary called goss along with the relevant configurations to check. Without the need for infrastructure or other tooling. This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove false positives in the process.

Documentation

Requirements

General:

  • Basic knowledge of Ansible, below are some links to the Ansible documentation to help get started if you are unfamiliar with Ansible

  • Functioning Ansible and/or Tower Installed, configured, and running. This includes all of the base Ansible/Tower configurations, needed packages installed, and infrastructure setup.

  • Please read through the tasks in this role to gain an understanding of what each control is doing. Some of the tasks are disruptive and can have unintended consiquences in a live production system. Also familiarize yourself with the variables in the defaults/main.yml file.

Technical Dependencies:

  • Running Ansible/Tower setup (this role is tested against Ansible version 2.9.1 and newer)
  • Python3 Ansible run environment
  • python-def (should be included in RHEL/CentOS 7) - First task sets up the prerequisites (Tag pre-reqs)for python3 and python2 (where required)
    • libselinux-python
    • python3-rpm (package used by py3 to use the rpm pkg)

Role Variables

This role is designed that the end user should not have to edit the tasks themselves. All customizing should be done via the defaults/main.yml file or with extra vars within the project, job, workflow, etc.

Tags

There are many tags available for added control precision. Each control has it's own set of tags noting what level, if it's scored/notscored, what OS element it relates to, if it's a patch or audit, and the rule number.

Below is an example of the tag section from a control within this role. Using this example if you set your run to skip all controls with the tag services, this task will be skipped. The opposite can also happen where you run only controls tagged with services.

      tags:
      - level1-workstation
      - level1-server
      - automated
      - avahi
      - services
      - patch
      - rule_2.2.4

member branches

Community Contribution

We encourage you (the community) to contribute to this role. Please read the rules below.

  • Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge.
  • All community Pull Requests are pulled into the devel branch
  • Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved
  • Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release

Pipeline Testing

uses:

  • ansible-core 2.12
  • ansible collections - pulls in the latest version based on requirements file
  • runs the audit using the devel branch
  • This is an automated test that occurs on pull requests into devel

Credits

This repo originated from work done by Sam Doran

More Repositories

1

RHEL7-STIG

Ansible role for Red Hat 7 STIG Baseline
YAML
283
star
2

RHEL8-CIS

Ansible role for Red Hat 8 CIS Baseline
YAML
262
star
3

UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
YAML
179
star
4

UBUNTU20-CIS

Ansible role for Ubuntu 2004 CIS Baseline
YAML
176
star
5

Windows-2019-CIS

CIS Baseline Ansible Role for Windows 2019
YAML
133
star
6

RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
YAML
113
star
7

RHEL6-STIG

Ansible role for Red Hat 6 DISA STIG
Shell
100
star
8

RHEL8-STIG

Ansible role for Red Hat 8 STIG Baseline
YAML
95
star
9

Windows-2022-CIS

CIS Baseline Ansible Role for Windows 2022
YAML
65
star
10

Windows-2019-STIG

STIG Baseline Ansible Role for Windows 2019
YAML
35
star
11

UBUNTU22-CIS-Audit

Audit for Ubuntu 22 CIS
YAML
34
star
12

RHEL8-CIS-Audit

Audit configurations for RHEL8 CIS - utilising goss
YAML
31
star
13

UBUNTU18-CIS

CIS Baseline Ansible Role for Ubuntu 18
YAML
30
star
14

AMAZON2-CIS

Ansible role for Amazon Linux 2 CIS Baseline
YAML
28
star
15

Windows-2016-CIS

CIS Baseline Ansible Role for Windows 2016
YAML
24
star
16

AMAZON2023-CIS

Ansible role for Amazon2023 CIS Baseline
YAML
24
star
17

RHEL7-CIS-Audit

Audit configurations for RHEL7 CIS
YAML
21
star
18

Kubernetes1.6.1-CIS

CIS Baseline Ansible Role for Kubernetes 1.6.1
21
star
19

RHEL9-CIS-Audit

Audit configurations for RHEL9 CIS
YAML
18
star
20

RHEL7-STIG-Audit

Audit configurations for RHEL7 STIG
YAML
16
star
21

UBUNTU20-CIS-Audit

CIS Audit configurations for Ubuntu20.04LTS - utilising goss
YAML
16
star
22

UBUNTU20-STIG

STIG Baseline Ansible Role for Ubuntu 20
YAML
14
star
23

RHEL8-STIG-Audit

Audit control files for rhel8 stig - utilising goss
YAML
13
star
24

Windows-2012-Member-Server-STIG

Ansible role for the Windows 2012 Member Server STIG
PowerShell
13
star
25

DEBIAN11-CIS

DEBIAN11- CIS Ansible Role
YAML
13
star
26

Windows-10-STIG

STIG Baseline Ansible Role for Windows 10
YAML
12
star
27

APACHE-2.4-CIS

CIS Baseline Ansible Role for Apache 2.4
HTML
10
star
28

POSTGRES-9-STIG

Ansible Role for the Postgresql 9.x DISA STIG
10
star
29

Benchmark-Generator

Benchmark Generator to create skeleton Ansible content from baseline XCCDF files.
Python
9
star
30

POSTGRES-12-CIS

Ansible Role for the Postgresql 12.x CIS
YAML
9
star
31

RHEL9-STIG

Ansible playbook for RHEL9 Disa STIG
Jinja
9
star
32

Windows-2019-CIS-Audit

Standalone audit function for windows 2019 CIS benchmarks based on goss
YAML
8
star
33

AZURE-CIS

Ansible role for Azure platform CIS baseline
Python
8
star
34

Windows-2016-STIG

STIG Baseline Ansible Role for Windows 2016
YAML
8
star
35

ansible-terrapin-ssh

Playbook for linux hosts to scan and remediate the terrapin ssh bug
YAML
8
star
36

KUBERNETES-STIG

YAML
7
star
37

AMAZON2-CIS-Audit

Audit configuration for Amazon Linux 2 CIS
YAML
7
star
38

Windows-2016-CIS-Audit

Audit content for Windows 2016 CIS
YAML
7
star
39

Windows-2022-STIG

STIG Baseline Ansible Role for Windows 2022
YAML
6
star
40

UBUNTU18-STIG

STIG Baseline Ansible Role for Ubuntu 18
YAML
5
star
41

AWS-FOUNDATIONS-CIS

5
star
42

AMAZON2023-CIS-Audit

Goss Audit for AMAZON 2023
YAML
5
star
43

MPG-AL-READTHEDOCS

MindPoint Group Ansible Lockdown ReadTheDocs
4
star
44

UBUNTU18-CIS-Audit

Audit configurations for Ubuntu 1804 CIS - utilising goss
YAML
4
star
45

Windows-2012-Domain-Controller-STIG

Ansible role for the Windows 2012 Domain Controller STIG
PowerShell
4
star
46

TOMCAT-9-STIG

STIG Baseline Ansible Role for Tomcat 9
Jinja
4
star
47

APACHE-2.4-STIG

STIG Baseline Ansible Role for Apache 2.4
HTML
4
star
48

WinFWADV-STIG

STIG Remediation Role for Windows Firewall and Advanced Security
4
star
49

DEBIAN12-CIS

DEBIAN12- CIS Ansible Role
4
star
50

CISCO-IOS-L2S-STIG

STIG Baseline Ansible Role For Cisco IOS L2 Switch
YAML
3
star
51

lockdown-linux

Shell
3
star
52

Windows-2008R2-Member-Server-STIG

Ansible role for the Windows 2008 Member Server STIG
PowerShell
3
star
53

Windows-10-CIS

CIS Baseline Ansible Role for Windows 10 Enterprise
YAML
3
star
54

DEBIAN11-CIS-Audit

Audit to check Debian 11 CIS compliance
YAML
3
star
55

WinFWADV-STIG-Audit

STIG audit Role for Windows Firewall and Advanced Security
YAML
2
star
56

RHEL5-STIG

Ansible role for Red Hat 5 DISA STIG
2
star
57

Windows-11-CIS

CIS Baseline Ansible Role for Windows 11 Enterprise
YAML
2
star
58

github_linux_IaC

workflow data for github actions and linux server testing of LE content
HCL
2
star
59

.github

Ansible lockdown landing page
1
star
60

CISCO-IOS-RTR-STIG

1
star
61

RHEL9-STIG-Audit

RHEL9 Audit for the STIG benchmark
YAML
1
star
62

RHEL9-CIS-TEST

YAML
1
star