• Stars
    star
    283
  • Rank 146,066 (Top 3 %)
  • Language YAML
  • License
    MIT License
  • Created over 8 years ago
  • Updated 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Ansible role for Red Hat 7 STIG Baseline

RHEL 7 DISA STIG

Configure a RHEL7 based system to be complaint with Disa STIG

This role is based on RHEL 7 DISA STIG: Version 3, Rel 11 released on April 27, 2023 .


Org Stars Stars Forks followers Twitter URL

Ansible Galaxy Quality Discord Badge

Devel Build Status Devel Commits

Release Branch Main Build Status Main Release Date Release Tag

Issues Open Issues Closed Pull Requests

License


Looking for support?

Lockdown Enterprise

Ansible support

Community

On our Discord Server to ask questions, discuss features, or just chat with other Ansible-Lockdown users


Configure a RHEL 7 system to be DISA STIG compliant. Non-disruptive CAT I, CAT II, and CAT III findings will be corrected by default. Disruptive finding remediation can be enabled by setting rhel7stig_disruption_high to true.

Updating

Coming from a previous release.

As with all releases and updates, It is suggested to test and align controls. This contains rewrites and ID reference changes as per STIG documentation.

  • The password hash
    • If adopting grub password has to be supplied and variables updated.
    • It no longer tries to create the hash.

More information can be found in the ChangeLog

Auditing (new)

This can be turned on or off within the defaults/main.yml file with the variable run_audit. The value is false by default, please refer to the wiki for more details.

This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.

A new form of auditing has been develeoped, by using a small (12MB) go binary called goss along with the relevant configurations to check. Without the need for infrastructure or other tooling. This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove false positives in the process.

Refer to

Documentation

Requirements

RHEL 7 or CentOS 7 - Other versions are not supported. Access to download or add the goss binary and content to the system if using auditing. options are available on how to get the content to the system.

Dependencies

The following packages must be installed on the controlling host/host where ansible is executed:

  • Python3 (preferred)
  • Ansible 2.9+
  • python2-passlib (or just passlib, if using python3)
  • python-lxml
  • python-xmltodict
  • python-jmespath

Package 'python-xmltodict' is required if you enable the OpenSCAP tool installation and run a report. Packages python(2)-passlib and python-jmespath are required for tasks with custom filters or modules. These are all required on the controller host that executes Ansible.

Role Variables

This role is designed that the end user should not have to edit the tasks themselves. All customizing should be done via the defaults/main.yml file or with extra vars within the project, job, workflow, etc.

Tags

There are many tags available for added control precision. Each control has it's own set of tags noting the control number as well as what parts of the system that control addresses.

Below is an example of the tag section from a control within this role. Using this example if you set your run to skip all controls with the tag dconf, this task will be skipped. The opposite can also happen where you run only controls tagged with dconf.

tags:
      - RHEL-07-010060
      - CAT2
      - CCI-000056
      - SRG-OS-000028-GPOS-00009
      - SV-204396r880746_rule
      - V-204396
      - dconf

Example Audit Summary

This is based on a vagrant image with selections enabled. e.g. No Gui iptables firewall

Note: More tests are run during audit as we check config and running state.

ok: [cent7_bios] => {
    "msg": [
        "The pre remediation results are: Count: 505, Failed: 214, Duration: 14.808s.",
        "The post remediation results are: Count: 505, Failed: 34, Duration: 43.593s.",
        "Full breakdown can be found in /opt",
        ""
    ]
}
  ]
}
PLAY RECAP ****************************************************************************************************************
rhel7test         : ok=369  changed=192  unreachable=0  failed=0  skipped=125  rescued=0  ignored=0  

Branches

  • devel - This is the default branch and the working development branch. Community pull requests will pull into this branch
  • main - This is the release branch
  • reports - This is a protected branch for our scoring reports, no code should ever go here
  • gh_pages - github pages
  • all other branches - Individual community member branches

Containers - Testing

  • system_is_container

This is set to false by defaults/main.yml If discovered it is a container type or ansible_connection == docker it will convert to run to with with true. Some controls will skip is this is true as they are not applicable at all. Others runs a subset of controls found in vars/is_container.yml based on a vendor supplied un altered image.

NON altered vendor image.

  • container_vars_file: is_container.yml

This vars file runs controls are grouped into tags so if the container does later have ssh it could be re-enabled by loading an alternative vars file.

Please Be Aware

  • This does set the single user password for grub this does need to be defined - You can create the hash on a RHEL 7.9 system using the command 'grub2-mkpasswd-pbkdf2'
  • Some controls make changes to sudo, please ensure a sudo password is set for the user and it is added to the way to run your playbook.

Community Contribution

We encourage you (the community) to contribute to this role. Please read the rules below.

  • Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge.
  • All community Pull Requests are pulled into the devel branch
  • Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved
  • Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release.

Pipeline Testing

uses:

  • ansible-core 2.12
  • ansible collections - pulls in the latest version based on requirements file
  • runs the audit using the devel branch
  • This is an automated test that occurs on pull requests into devel

Known Issues

None

Support

This is a community project at its core and will be managed as such.

If you would are interested in dedicated support to assist or provide bespoke setups

Credits

This repo originated from work done by Sam Doran

More Repositories

1

RHEL7-CIS

Ansible role for Red Hat 7 CIS Baseline
YAML
473
star
2

RHEL8-CIS

Ansible role for Red Hat 8 CIS Baseline
YAML
262
star
3

UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
YAML
179
star
4

UBUNTU20-CIS

Ansible role for Ubuntu 2004 CIS Baseline
YAML
176
star
5

Windows-2019-CIS

CIS Baseline Ansible Role for Windows 2019
YAML
133
star
6

RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
YAML
113
star
7

RHEL6-STIG

Ansible role for Red Hat 6 DISA STIG
Shell
100
star
8

RHEL8-STIG

Ansible role for Red Hat 8 STIG Baseline
YAML
95
star
9

Windows-2022-CIS

CIS Baseline Ansible Role for Windows 2022
YAML
65
star
10

Windows-2019-STIG

STIG Baseline Ansible Role for Windows 2019
YAML
35
star
11

UBUNTU22-CIS-Audit

Audit for Ubuntu 22 CIS
YAML
34
star
12

RHEL8-CIS-Audit

Audit configurations for RHEL8 CIS - utilising goss
YAML
31
star
13

UBUNTU18-CIS

CIS Baseline Ansible Role for Ubuntu 18
YAML
30
star
14

AMAZON2-CIS

Ansible role for Amazon Linux 2 CIS Baseline
YAML
28
star
15

Windows-2016-CIS

CIS Baseline Ansible Role for Windows 2016
YAML
24
star
16

AMAZON2023-CIS

Ansible role for Amazon2023 CIS Baseline
YAML
24
star
17

RHEL7-CIS-Audit

Audit configurations for RHEL7 CIS
YAML
21
star
18

Kubernetes1.6.1-CIS

CIS Baseline Ansible Role for Kubernetes 1.6.1
21
star
19

RHEL9-CIS-Audit

Audit configurations for RHEL9 CIS
YAML
18
star
20

RHEL7-STIG-Audit

Audit configurations for RHEL7 STIG
YAML
16
star
21

UBUNTU20-CIS-Audit

CIS Audit configurations for Ubuntu20.04LTS - utilising goss
YAML
16
star
22

UBUNTU20-STIG

STIG Baseline Ansible Role for Ubuntu 20
YAML
14
star
23

RHEL8-STIG-Audit

Audit control files for rhel8 stig - utilising goss
YAML
13
star
24

Windows-2012-Member-Server-STIG

Ansible role for the Windows 2012 Member Server STIG
PowerShell
13
star
25

DEBIAN11-CIS

DEBIAN11- CIS Ansible Role
YAML
13
star
26

Windows-10-STIG

STIG Baseline Ansible Role for Windows 10
YAML
12
star
27

APACHE-2.4-CIS

CIS Baseline Ansible Role for Apache 2.4
HTML
10
star
28

POSTGRES-9-STIG

Ansible Role for the Postgresql 9.x DISA STIG
10
star
29

Benchmark-Generator

Benchmark Generator to create skeleton Ansible content from baseline XCCDF files.
Python
9
star
30

POSTGRES-12-CIS

Ansible Role for the Postgresql 12.x CIS
YAML
9
star
31

RHEL9-STIG

Ansible playbook for RHEL9 Disa STIG
Jinja
9
star
32

Windows-2019-CIS-Audit

Standalone audit function for windows 2019 CIS benchmarks based on goss
YAML
8
star
33

AZURE-CIS

Ansible role for Azure platform CIS baseline
Python
8
star
34

Windows-2016-STIG

STIG Baseline Ansible Role for Windows 2016
YAML
8
star
35

ansible-terrapin-ssh

Playbook for linux hosts to scan and remediate the terrapin ssh bug
YAML
8
star
36

KUBERNETES-STIG

YAML
7
star
37

AMAZON2-CIS-Audit

Audit configuration for Amazon Linux 2 CIS
YAML
7
star
38

Windows-2016-CIS-Audit

Audit content for Windows 2016 CIS
YAML
7
star
39

Windows-2022-STIG

STIG Baseline Ansible Role for Windows 2022
YAML
6
star
40

UBUNTU18-STIG

STIG Baseline Ansible Role for Ubuntu 18
YAML
5
star
41

AWS-FOUNDATIONS-CIS

5
star
42

AMAZON2023-CIS-Audit

Goss Audit for AMAZON 2023
YAML
5
star
43

MPG-AL-READTHEDOCS

MindPoint Group Ansible Lockdown ReadTheDocs
4
star
44

UBUNTU18-CIS-Audit

Audit configurations for Ubuntu 1804 CIS - utilising goss
YAML
4
star
45

Windows-2012-Domain-Controller-STIG

Ansible role for the Windows 2012 Domain Controller STIG
PowerShell
4
star
46

TOMCAT-9-STIG

STIG Baseline Ansible Role for Tomcat 9
Jinja
4
star
47

APACHE-2.4-STIG

STIG Baseline Ansible Role for Apache 2.4
HTML
4
star
48

WinFWADV-STIG

STIG Remediation Role for Windows Firewall and Advanced Security
4
star
49

DEBIAN12-CIS

DEBIAN12- CIS Ansible Role
4
star
50

CISCO-IOS-L2S-STIG

STIG Baseline Ansible Role For Cisco IOS L2 Switch
YAML
3
star
51

lockdown-linux

Shell
3
star
52

Windows-2008R2-Member-Server-STIG

Ansible role for the Windows 2008 Member Server STIG
PowerShell
3
star
53

Windows-10-CIS

CIS Baseline Ansible Role for Windows 10 Enterprise
YAML
3
star
54

DEBIAN11-CIS-Audit

Audit to check Debian 11 CIS compliance
YAML
3
star
55

WinFWADV-STIG-Audit

STIG audit Role for Windows Firewall and Advanced Security
YAML
2
star
56

RHEL5-STIG

Ansible role for Red Hat 5 DISA STIG
2
star
57

Windows-11-CIS

CIS Baseline Ansible Role for Windows 11 Enterprise
YAML
2
star
58

github_linux_IaC

workflow data for github actions and linux server testing of LE content
HCL
2
star
59

.github

Ansible lockdown landing page
1
star
60

CISCO-IOS-RTR-STIG

1
star
61

RHEL9-STIG-Audit

RHEL9 Audit for the STIG benchmark
YAML
1
star
62

RHEL9-CIS-TEST

YAML
1
star