• Stars
    star
    176
  • Rank 216,987 (Top 5 %)
  • Language YAML
  • License
    MIT License
  • Created about 4 years ago
  • Updated 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Ansible role for Ubuntu 2004 CIS Baseline

Ubuntu 20 CIS

Build Status Build Status Release

Configure Ubuntu 20 machine to be CIS v1.1.0 compliant. There are some intrusive tasks that have a toggle in defaults main.yml to disable to automated fix

Join us

On our Discord Server to ask questions, discuss features, or just chat with other Ansible-Lockdown users

Caution(s)

This role will make changes to the system that could break things. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.

This role was developed against a clean install of the Operating System. If you are implimenting to an existing system please review this role for any site specific changes that are needed.

NFtables is not supported in the role.

Based on CIS_Ubuntu_Linux_20.04_LTS_Benchmark.

Documentation

Requirements

General:

Technical Dependencies:

  • It is suggested that the server is patched in the normal manner before running this role.

  • Running Ansible/Tower setup (this role is tested against Ansible version 2.9.1 and newer)

  • Python3 Ansible run environment

Auditing (new)

This can be turned on or off within the defaults/main.yml file with the variable run_audit. The value is false by default, please refer to the wiki for more details.

This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.

A new form of auditing has been developed, by using a small (12MB) go binary called goss along with the relevant configurations to check. Without the need for infrastructure or other tooling. This audit will not only check the config has the correct setting but aims to capture if it is running with that configuration also trying to remove false positives in the process.

Refer to UBUNTU20-CIS-Audit.

Role Variables

This role is designed that the end user should not have to edit the tasks themselves. All customizing should be done via the defaults/main.yml file or with extra vars within the project, job, workflow, etc. These variables can be found here in the Main Variables Wiki page. All variables are listed there along with descriptions.

Branches

  • devel - This is the default branch and the working development branch. Community pull requests will pull into this branch
  • main - This is the release branch
  • reports - This is a protected branch for our scoring reports, no code should ever go here
  • gh-pages - This is the github pages branch
  • all other branches - Individual community member branches

Community Contribution

We encourage you (the community) to contribute to this role. Please read the rules below.

  • Your work is done in your own individual branch. Make sure to Signed-off and GPG sign all commits you intend to merge.
  • All community Pull Requests are pulled into the devel branch
  • Pull Requests into devel will confirm your commits have a GPG signature, Signed-off, and a functional test before being approved
  • Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release

Pipeline Testing

uses:

  • ansible-core 2.12
  • ansible collections - pulls in the latest version based on requirements file
  • runs the audit using the devel branch
  • This is an automated test that occurs on pull requests into devel

Support

This is a community project at its core and will be managed as such.

If you would are interested in dedicated support to assist or provide bespoke setups

More Repositories

1

RHEL7-CIS

Ansible role for Red Hat 7 CIS Baseline
YAML
473
star
2

RHEL7-STIG

Ansible role for Red Hat 7 STIG Baseline
YAML
283
star
3

RHEL8-CIS

Ansible role for Red Hat 8 CIS Baseline
YAML
262
star
4

UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
YAML
179
star
5

Windows-2019-CIS

CIS Baseline Ansible Role for Windows 2019
YAML
133
star
6

RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
YAML
113
star
7

RHEL6-STIG

Ansible role for Red Hat 6 DISA STIG
Shell
100
star
8

RHEL8-STIG

Ansible role for Red Hat 8 STIG Baseline
YAML
95
star
9

Windows-2022-CIS

CIS Baseline Ansible Role for Windows 2022
YAML
65
star
10

Windows-2019-STIG

STIG Baseline Ansible Role for Windows 2019
YAML
35
star
11

UBUNTU22-CIS-Audit

Audit for Ubuntu 22 CIS
YAML
34
star
12

RHEL8-CIS-Audit

Audit configurations for RHEL8 CIS - utilising goss
YAML
31
star
13

UBUNTU18-CIS

CIS Baseline Ansible Role for Ubuntu 18
YAML
30
star
14

AMAZON2-CIS

Ansible role for Amazon Linux 2 CIS Baseline
YAML
28
star
15

Windows-2016-CIS

CIS Baseline Ansible Role for Windows 2016
YAML
24
star
16

AMAZON2023-CIS

Ansible role for Amazon2023 CIS Baseline
YAML
24
star
17

RHEL7-CIS-Audit

Audit configurations for RHEL7 CIS
YAML
21
star
18

Kubernetes1.6.1-CIS

CIS Baseline Ansible Role for Kubernetes 1.6.1
21
star
19

RHEL9-CIS-Audit

Audit configurations for RHEL9 CIS
YAML
18
star
20

RHEL7-STIG-Audit

Audit configurations for RHEL7 STIG
YAML
16
star
21

UBUNTU20-CIS-Audit

CIS Audit configurations for Ubuntu20.04LTS - utilising goss
YAML
16
star
22

UBUNTU20-STIG

STIG Baseline Ansible Role for Ubuntu 20
YAML
14
star
23

RHEL8-STIG-Audit

Audit control files for rhel8 stig - utilising goss
YAML
13
star
24

Windows-2012-Member-Server-STIG

Ansible role for the Windows 2012 Member Server STIG
PowerShell
13
star
25

DEBIAN11-CIS

DEBIAN11- CIS Ansible Role
YAML
13
star
26

Windows-10-STIG

STIG Baseline Ansible Role for Windows 10
YAML
12
star
27

APACHE-2.4-CIS

CIS Baseline Ansible Role for Apache 2.4
HTML
10
star
28

POSTGRES-9-STIG

Ansible Role for the Postgresql 9.x DISA STIG
10
star
29

Benchmark-Generator

Benchmark Generator to create skeleton Ansible content from baseline XCCDF files.
Python
9
star
30

POSTGRES-12-CIS

Ansible Role for the Postgresql 12.x CIS
YAML
9
star
31

RHEL9-STIG

Ansible playbook for RHEL9 Disa STIG
Jinja
9
star
32

Windows-2019-CIS-Audit

Standalone audit function for windows 2019 CIS benchmarks based on goss
YAML
8
star
33

AZURE-CIS

Ansible role for Azure platform CIS baseline
Python
8
star
34

Windows-2016-STIG

STIG Baseline Ansible Role for Windows 2016
YAML
8
star
35

ansible-terrapin-ssh

Playbook for linux hosts to scan and remediate the terrapin ssh bug
YAML
8
star
36

KUBERNETES-STIG

YAML
7
star
37

AMAZON2-CIS-Audit

Audit configuration for Amazon Linux 2 CIS
YAML
7
star
38

Windows-2016-CIS-Audit

Audit content for Windows 2016 CIS
YAML
7
star
39

Windows-2022-STIG

STIG Baseline Ansible Role for Windows 2022
YAML
6
star
40

UBUNTU18-STIG

STIG Baseline Ansible Role for Ubuntu 18
YAML
5
star
41

AWS-FOUNDATIONS-CIS

5
star
42

AMAZON2023-CIS-Audit

Goss Audit for AMAZON 2023
YAML
5
star
43

MPG-AL-READTHEDOCS

MindPoint Group Ansible Lockdown ReadTheDocs
4
star
44

UBUNTU18-CIS-Audit

Audit configurations for Ubuntu 1804 CIS - utilising goss
YAML
4
star
45

Windows-2012-Domain-Controller-STIG

Ansible role for the Windows 2012 Domain Controller STIG
PowerShell
4
star
46

TOMCAT-9-STIG

STIG Baseline Ansible Role for Tomcat 9
Jinja
4
star
47

APACHE-2.4-STIG

STIG Baseline Ansible Role for Apache 2.4
HTML
4
star
48

WinFWADV-STIG

STIG Remediation Role for Windows Firewall and Advanced Security
4
star
49

DEBIAN12-CIS

DEBIAN12- CIS Ansible Role
4
star
50

CISCO-IOS-L2S-STIG

STIG Baseline Ansible Role For Cisco IOS L2 Switch
YAML
3
star
51

lockdown-linux

Shell
3
star
52

Windows-2008R2-Member-Server-STIG

Ansible role for the Windows 2008 Member Server STIG
PowerShell
3
star
53

Windows-10-CIS

CIS Baseline Ansible Role for Windows 10 Enterprise
YAML
3
star
54

DEBIAN11-CIS-Audit

Audit to check Debian 11 CIS compliance
YAML
3
star
55

WinFWADV-STIG-Audit

STIG audit Role for Windows Firewall and Advanced Security
YAML
2
star
56

RHEL5-STIG

Ansible role for Red Hat 5 DISA STIG
2
star
57

Windows-11-CIS

CIS Baseline Ansible Role for Windows 11 Enterprise
YAML
2
star
58

github_linux_IaC

workflow data for github actions and linux server testing of LE content
HCL
2
star
59

.github

Ansible lockdown landing page
1
star
60

CISCO-IOS-RTR-STIG

1
star
61

RHEL9-STIG-Audit

RHEL9 Audit for the STIG benchmark
YAML
1
star
62

RHEL9-CIS-TEST

YAML
1
star