diff --git a/.gitignore b/.gitignore index 4e3ce79..609a095 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,6 @@ benchparse/ # GitHub Action/Workflow files .github/ + +# Precommit +.ansible/ diff --git a/handlers/main.yml b/handlers/main.yml index 64b0aad..15636b6 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -240,6 +240,8 @@ when: ('"No change" not in discovered_augenrules_check.stdout') or prelim_auditd_immutable_check.rc == 1 ansible.builtin.command: augenrules --load changed_when: true + failed_when: discovered_augenrule_load.rc not in [ 0, 1 ] + register: discovered_augenrule_load - name: Audit_immutable_fact when: diff --git a/tasks/section_1/cis_1.2.2.x.yml b/tasks/section_1/cis_1.2.2.x.yml index cdf842c..92eb1c7 100644 --- a/tasks/section_1/cis_1.2.2.x.yml +++ b/tasks/section_1/cis_1.2.2.x.yml @@ -9,6 +9,14 @@ - rule_1.2.2.1 - NIST800-53R5_SI-2 - patch - ansible.builtin.package: - name: "*" - state: latest + block: + - name: "1.2.2.1 | PATCH | Ensure updates, patches, and additional security software are installedi | Update" + ansible.builtin.package: + name: "*" + state: latest + register: discovered_pkg_updates + + # Resetting connection as ssh stops if patched reset connection kickstarts it + - name: "1.2.2.1 | PATCH | Ensure updates, patches, and additional security software are installed | reset ansible connection if ssh updated" + when: "'openssh-server' in discovered_pkg_updates.stdout" + ansible.builtin.meta: reset_connection diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml index 4327503..f271f9f 100644 --- a/tasks/section_1/cis_1.4.x.yml +++ b/tasks/section_1/cis_1.4.x.yml @@ -18,7 +18,7 @@ dest: "{{ ubtu24cis_grub_user_file }}" owner: root group: root - mode: 'go-w' + mode: '0755' notify: Grub update - name: "1.4.1 | PATCH | Ensure bootloader password is set | allow unrestricted boot" diff --git a/tasks/section_4/cis_4.4.1.x.yml b/tasks/section_4/cis_4.4.1.x.yml index 32b0c0d..9e95182 100644 --- a/tasks/section_4/cis_4.4.1.x.yml +++ b/tasks/section_4/cis_4.4.1.x.yml @@ -48,365 +48,3 @@ ansible.builtin.package: name: ufw state: absent - -- name: "4.4.1.1 | PATCH | Ensure iptables default deny firewall policy" - when: - - ubtu24cis_rule_4_4_1_1 - - ubtu24cis_ipv4_required - - not system_is_ec2 - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.1 - - iptables - block: - - name: "4.4.1.1 | PATCH | Ensure iptables default deny firewall policy | Configure SSH to be allowed in" - ansible.builtin.iptables: - chain: INPUT - protocol: tcp - destination_port: 22 - jump: ACCEPT - ctstate: 'NEW,ESTABLISHED' - notify: Iptables persistent - - - name: "4.4.1.1 | PATCH | Ensure iptables default deny firewall policy | Configure SSH to be allowed out" - ansible.builtin.iptables: - chain: OUTPUT - protocol: tcp - source_port: 22 - jump: ACCEPT - ctstate: 'NEW,ESTABLISHED' - notify: Iptables persistent - - - name: "4.4.1.1 | PATCH | Ensure iptables default deny firewall policy | Enable apt traffic" - ansible.builtin.iptables: - chain: INPUT - ctstate: 'ESTABLISHED' - jump: ACCEPT - notify: Iptables persistent - - - name: "4.4.1.1 | PATCH | Ensure iptables default deny firewall policy | Set drop items" - ansible.builtin.iptables: - policy: DROP - chain: "{{ item }}" - notify: Iptables persistent - with_items: - - INPUT - - FORWARD - - OUTPUT - -- name: "4.4.1.2 | PATCH | Ensure iptables loopback traffic is configured" - when: - - ubtu24cis_rule_4_4_1_2 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.2 - - iptables - block: - - name: "4.4.1.2 | PATCH | Ensure iptables loopback traffic is configured | INPUT loopback ACCEPT" - ansible.builtin.iptables: - action: append - chain: INPUT - in_interface: lo - jump: ACCEPT - notify: Iptables persistent - - - name: "4.4.1.2 | PATCH | Ensure iptables loopback traffic is configured | OUTPUT loopback ACCEPT" - ansible.builtin.iptables: - action: append - chain: OUTPUT - out_interface: lo - jump: ACCEPT - notify: Iptables persistent - - - name: "4.4.1.2 | PATCH | Ensure iptables loopback traffic is configured | OUTPUT loopback ACCEPT" - ansible.builtin.iptables: - action: append - chain: INPUT - source: 127.0.0.0/8 - jump: DROP - notify: Iptables persistent - -- name: "4.4.1.3 | PATCH | Ensure iptables outbound and established connections are configured" - when: - - ubtu24cis_rule_4_4_1_3 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.3 - - iptables - ansible.builtin.iptables: - action: append - chain: '{{ item.chain }}' - protocol: '{{ item.protocol }}' - match: state - ctstate: '{{ item.ctstate }}' - jump: ACCEPT - notify: Iptables persistent - with_items: - - { chain: OUTPUT, protocol: tcp, ctstate: 'NEW,ESTABLISHED' } - - { chain: OUTPUT, protocol: udp, ctstate: 'NEW,ESTABLISHED' } - - { chain: OUTPUT, protocol: icmp, ctstate: 'NEW,ESTABLISHED' } - - { chain: INPUT, protocol: tcp, ctstate: 'ESTABLISHED' } - - { chain: INPUT, protocol: udp, ctstate: 'ESTABLISHED' } - - { chain: INPUT, protocol: icmp, ctstate: 'ESTABLISHED' } - -- name: "4.4.1.4 | AUDIT | Ensure iptables firewall rules exist for all open ports" - when: - - ubtu24cis_rule_4_4_1_4 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - audit - - rule_4.4.1.4 - - iptables - vars: - warn_control_id: '4.4.1.4' - block: - - name: "4.4.1.4 | AUDIT | Ensure iptables firewall rules exist for all open ports | Get list of open ports" - ansible.builtin.command: ss -4tuln - changed_when: false - failed_when: false - check_mode: false - register: discovered_open_ports - - - name: "4.4.1.4 | AUDIT | Ensure iptables firewall rules exist for all open ports | Get list of rules" - ansible.builtin.command: iptables -L INPUT -v -n - changed_when: false - failed_when: false - check_mode: false - register: discovered_current_rules - - - name: "4.4.1.4 | AUDIT | Ensure iptables firewall rules exist for all open ports | Warn about settings" - ansible.builtin.debug: - msg: - - "Warning!! Below is the list the open ports and current rules" - - "Please create a rule for any open port that does not have a current rule" - - "Open Ports:" - - "{{ discovered_open_ports.stdout_lines }}" - - "Current Rules:" - - "{{ discovered_current_rules.stdout_lines }}" - - - name: "4.4.1.4 | AUDIT | Ensure iptables firewall rules exist for all open ports | Set warning count" - ansible.builtin.import_tasks: - file: warning_facts.yml - -# --------------- -# --------------- -# This is not a control however using the iptables module only writes to memery -# if a reboot occurs that means changes can revert. This task will make the -# above iptables settings permanent -# --------------- -# --------------- -# - name: "Make IPTables persistent | Not a control" -# block: -# - name: "Make IPTables persistent | Install iptables-persistent" -# ansible.builtin.package: -# name: iptables-persistent -# state: present - -# - name: "Make IPTables persistent | Save to persistent files" -# ansible.builtin.shell: bash -c "iptables-save > /etc/iptables/rules.v4" -# changed_when: discovered_iptables_save.rc == 0 -# failed_when: discovered_iptables_save.rc > 0 -# register: discovered_iptables_save -# when: -# - ubtu24cis_firewall_package == "iptables" -# - ubtu24cis_save_iptables_cis_rules -# - ubtu24cis_rule_4_4_1_1 or -# ubtu24cis_rule_4_4_1_2 or -# ubtu24cis_rule_4_4_1_3 or -# ubtu24cis_rule_4_4_1_4 - -- name: "4.4.1.1 | PATCH | Ensure ip6tables default deny firewall policy" - when: - - ubtu24cis_rule_4_4_1_1 - - ubtu24cis_ipv6_required - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.1 - - ip6tables - block: - - name: "4.4.1.1 | PATCH | Ensure ip6tables default deny firewall policy | Configure SSH to be allowed out" - ansible.builtin.iptables: - chain: OUTPUT - protocol: tcp - source_port: 22 - jump: ACCEPT - ctstate: 'NEW,ESTABLISHED' - ip_version: ipv6 - notify: Ip6tables persistent - - - name: "4.4.1.1 | PATCH | Ensure ip6tables default deny firewall policy | Enable apt traffic" - ansible.builtin.iptables: - chain: INPUT - ctstate: 'ESTABLISHED' - jump: ACCEPT - ip_version: ipv6 - notify: Ip6tables persistent - - - name: "4.4.1.1 | PATCH | Ensure ip6tables default deny firewall policy | Set drop items" - ansible.builtin.iptables: - policy: DROP - chain: "{{ item }}" - ip_version: ipv6 - notify: Ip6tables persistent - loop: - - INPUT - - FORWARD - - OUTPUT - -- name: "4.4.1.2 | PATCH | Ensure ip6tables loopback traffic is configured" - when: - - ubtu24cis_rule_4_4_1_2 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv6_required - - not ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.2 - - ip6tables - block: - - name: "4.4.1.2 | PATCH | Ensure ip6tables loopback traffic is configured | INPUT loopback ACCEPT" - ansible.builtin.iptables: - action: append - chain: INPUT - in_interface: lo - jump: ACCEPT - ip_version: ipv6 - notify: Ip6tables persistent - - - name: "4.4.1.2 | PATCH | Ensure ip6tables loopback traffic is configured | OUTPUT loopback ACCEPT" - ansible.builtin.iptables: - action: append - chain: OUTPUT - out_interface: lo - jump: ACCEPT - ip_version: ipv6 - notify: Ip6tables persistent - - - name: "4.4.1.2 | PATCH | Ensure ip6tables loopback traffic is configured | INPUT loopback drop" - ansible.builtin.iptables: - action: append - chain: INPUT - source: ::1 - jump: DROP - ip_version: ipv6 - notify: Ip6tables persistent - -- name: "4.4.1.3 | PATCH | Ensure ip6tables outbound and established connections are configured" - when: - - ubtu24cis_rule_4_4_1_3 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv6_required - - not ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - patch - - rule_4.4.1.3 - - ip6tables - ansible.builtin.iptables: - action: append - chain: '{{ item.chain }}' - protocol: '{{ item.protocol }}' - match: state - ctstate: '{{ item.ctstate }}' - jump: ACCEPT - ip_version: ipv6 - notify: Ip6tables persistent - loop: - - { chain: OUTPUT, protocol: tcp, ctstate: 'NEW,ESTABLISHED' } - - { chain: OUTPUT, protocol: udp, ctstate: 'NEW,ESTABLISHED' } - - { chain: OUTPUT, protocol: icmp, ctstate: 'NEW,ESTABLISHED' } - - { chain: INPUT, protocol: tcp, ctstate: 'ESTABLISHED' } - - { chain: INPUT, protocol: udp, ctstate: 'ESTABLISHED' } - - { chain: INPUT, protocol: icmp, ctstate: 'ESTABLISHED' } - -- name: "4.4.1.4 | AUDIT | Ensure ip6tables firewall rules exist for all open ports" - when: - - ubtu24cis_rule_4_4_1_4 - - ubtu24cis_firewall_package == "iptables" - - ubtu24cis_ipv6_required - - not ubtu24cis_ipv4_required - tags: - - level1-server - - level1-workstation - - audit - - rule_4.4.1.4 - - ip6tables - vars: - warn_control_id: '4.4.1.4' - block: - - name: "4.4.1.4 | AUDIT | Ensure ip6tables firewall rules exist for all open ports | Get list of open ports" - ansible.builtin.command: ss -6tuln - changed_when: false - failed_when: false - check_mode: false - register: discovered_open_ports - - - name: "4.4.1.4 | AUDIT | Ensure ip6tables firewall rules exist for all open ports | Get list of rules" - ansible.builtin.command: ip6tables -L INPUT -v -n - changed_when: false - failed_when: false - check_mode: false - register: discovered_current_rules - - - name: "4.4.1.4 | AUDIT | Ensure ip6tables firewall rules exist for all open ports | Warn about settings" - ansible.builtin.debug: - msg: - - "Warning!! Below is the list the open ports and current rules" - - "Please create a rule for any open port that does not have a current rule" - - "Open Ports:" - - "{{ discovered_open_ports.stdout_lines }}" - - "Current Rules:" - - "{{ discovered_current_rules.stdout_lines }}" - - - name: "4.4.1.4 | AUDIT | Ensure ip6tables firewall rules exist for all open ports | Set warning count" - ansible.builtin.import_tasks: - file: warning_facts.yml - -# --------------- -# --------------- -# This is not a control however using the ip6tables module only writes to memery -# if a reboot occurs that means changes can revert. This task will make the -# above ip6tables settings permanent -# --------------- -# --------------- -# via handler -# - name: "Make IP6Tables persistent | Not a control" -# block: -# - name: "Make IP6Tables persistent | Install iptables-persistent" -# ansible.builtin.package: -# name: iptables-persistent -# state: present -# when: "'iptables-persistent' not in ansible_facts.packages" - -# - name: "Make IP6Tables persistent | Save to persistent files" -# ansible.builtin.shell: bash -c "ip6tables-save > /etc/iptables/rules.v6" -# changed_when: discovered_ip6tables_save.rc == 0 -# failed_when: discovered_ip6tables_save.rc > 0 -# register: discovered_ip6tables_save -# when: -# - ubtu24cis_firewall_package == "iptables" -# - ubtu24cis_ipv6_required -# - not ubtu24cis_ipv4_required -# - ubtu24cis_save_iptables_cis_rules -# - ubtu24cis_rule_4_4_1_1 or -# ubtu24cis_rule_4_4_1_2 or -# ubtu24cis_rule_4_4_1_3 or -# ubtu24cis_rule_4_4_1_4 diff --git a/tasks/section_4/main.yml b/tasks/section_4/main.yml index c8ba0ea..3343d38 100644 --- a/tasks/section_4/main.yml +++ b/tasks/section_4/main.yml @@ -15,7 +15,7 @@ file: cis_4.3.x.yml - name: "SECTION | 4.4.1.x | Configure iptables software" - when: ubtu24cis_firewall_package == "nftables" + when: ubtu24cis_firewall_package == "iptables" ansible.builtin.import_tasks: file: cis_4.4.1.x.yml diff --git a/tasks/section_5/cis_5.1.x.yml b/tasks/section_5/cis_5.1.x.yml index 4f2a377..5550e18 100644 --- a/tasks/section_5/cis_5.1.x.yml +++ b/tasks/section_5/cis_5.1.x.yml @@ -187,7 +187,7 @@ - NIST800-53R5_CM-6 - NIST800-53R5_CM-7 - NIST800-53R5_IA-5 - - sshdd + - sshd ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: "{{ item.regexp }}" diff --git a/tasks/section_6/cis_6.2.1.x.yml b/tasks/section_6/cis_6.2.1.x.yml index f016fd9..2580628 100644 --- a/tasks/section_6/cis_6.2.1.x.yml +++ b/tasks/section_6/cis_6.2.1.x.yml @@ -30,7 +30,7 @@ - NIST800-53R5_AU-3 - NIST800-53R5_AU-12 - auditd - ansible.builtin.service: + ansible.builtin.systemd_service: name: auditd state: started enabled: true diff --git a/tasks/section_7/cis_7.2.x.yml b/tasks/section_7/cis_7.2.x.yml index e5a555a..a94f48a 100644 --- a/tasks/section_7/cis_7.2.x.yml +++ b/tasks/section_7/cis_7.2.x.yml @@ -309,7 +309,7 @@ warn_control_id: '7.2.10' block: - name: "7.2.10 | AUDIT | Ensure local interactive user dot files access is configured | Check for files" - ansible.builtin.shell: find /home/ -name "\.*" -perm /g+w,o+w + ansible.builtin.shell: find /home/ /root/ -name "\.*" -type f -perm /u+x,g+wx,o+wx changed_when: false failed_when: discovered_homedir_dot_files.rc not in [ 0, 1 ] check_mode: false @@ -336,5 +336,5 @@ - ubtu24cis_dotperm_ansiblemanaged ansible.builtin.file: path: '{{ item }}' - mode: 'go-w' + mode: 'u-x,go-wx' with_items: "{{ discovered_homedir_dot_files.stdout_lines }}"