357 lines
11 KiB
YAML
357 lines
11 KiB
YAML
---
|
|
|
|
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.1
|
|
- filesystems
|
|
- cramfs
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install cramfs(\\s|$)"
|
|
line: "install cramfs /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist cramfs(\\s|$)"
|
|
line: "blacklist cramfs"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Disable cramfs"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: cramfs
|
|
state: absent
|
|
|
|
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.2
|
|
- filesystems
|
|
- freevxfs
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install freevxfs(\\s|$)"
|
|
line: "install freevxfs /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist freevxfs(\\s|$)"
|
|
line: "blacklist freevxfs"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: freevxfs
|
|
state: absent
|
|
|
|
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_3
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.3
|
|
- filesystems
|
|
- hfs
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install hfs(\\s|$)"
|
|
line: "install hfs /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist hfs(\\s|$)"
|
|
line: "blacklist hfs"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: hfs
|
|
state: absent
|
|
|
|
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_4
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.4
|
|
- filesystems
|
|
- hfsplus
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install hfsplus(\\s|$)"
|
|
line: "install hfsplus /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist hfsplus(\\s|$)"
|
|
line: "blacklist hfsplus"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: hfsplus
|
|
state: absent
|
|
|
|
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_5
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.5
|
|
- filesystems
|
|
- jffs2
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install jffs2(\\s|$)"
|
|
line: "install jffs2 /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist jffs2(\\s|$)"
|
|
line: "blacklist jffs2"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: jffs2
|
|
state: absent
|
|
|
|
- name: "1.1.1.6 | PATCH | Ensure overlayfs kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_6
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- rule_1.1.1.6
|
|
- filesystems
|
|
- overlayfs
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.6 | PATCH | Ensure overlayfs kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install overlayfs(\\s|$)"
|
|
line: "install overlayfs /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.6 | PATCH | Ensure overlayfs kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist overlayfs(\\s|$)"
|
|
line: "blacklist overlayfs"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.6 | PATCH | Ensure overlayfs kernel module is not available | Disable overlayfs"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: overlayfs
|
|
state: absent
|
|
|
|
- name: "1.1.1.7 | PATCH | Ensure squashfs kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_7
|
|
- not prelim_squashfs_builtin
|
|
- prelim_snap_pkg_mgr.rc != 0
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- rule_1.1.1.7
|
|
- filesystems
|
|
- squashfs
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.7 | PATCH | Ensure squashfs kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install squashfs(\\s|$)"
|
|
line: "install squashfs /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.7 | PATCH | Ensure squashfs kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist squashfs(\\s|$)"
|
|
line: "blacklist squashfs"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.7 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: squashfs
|
|
state: absent
|
|
|
|
- name: "1.1.1.8 | PATCH | Ensure udf kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_8
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- patch
|
|
- rule_1.1.1.8
|
|
- filesystems
|
|
- udf
|
|
- NIST800-53R5_CM-7
|
|
block:
|
|
- name: "1.1.1.8 | PATCH | Ensure udf kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install udf(\\s|$)"
|
|
line: "install udf /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.8 | PATCH | Ensure udf kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist udf(\\s|$)"
|
|
line: "blacklist udf"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.8 | PATCH | Ensure udf kernel module is not available | Disable udf"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: udf
|
|
state: absent
|
|
|
|
- name: "1.1.1.9 | PATCH | Ensure usb-storage kernel module is not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_9
|
|
tags:
|
|
- level1-server
|
|
- level2-workstation
|
|
- patch
|
|
- rule_1.1.1.9
|
|
- filesystems
|
|
- usb
|
|
- NIST800-53R5_SI-3
|
|
block:
|
|
- name: "1.1.1.9 | PATCH | Ensure usb-storage kernel module is not available | Edit modprobe config"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/CIS.conf
|
|
regexp: "^(#)?install usb-storage(\\s|$)"
|
|
line: "install usb-storage /bin/true"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.9 | PATCH | Ensure usb-storage kernel module is not available | blacklist"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/modprobe.d/blacklist.conf
|
|
regexp: "^(#)?blacklist usb-storage(\\s|$)"
|
|
line: "blacklist usb-storage"
|
|
create: true
|
|
mode: 'go-rwx'
|
|
|
|
- name: "1.1.1.9 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
|
|
when:
|
|
- not system_is_container
|
|
community.general.modprobe:
|
|
name: usb-storage
|
|
state: absent
|
|
|
|
- name: "1.1.1.10 | PATCH | Ensure unused filesystems kernel modules are not available"
|
|
when:
|
|
- ubtu24cis_rule_1_1_1_10
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.1.1.10
|
|
- filesystems
|
|
vars:
|
|
warn_control_id: '1.1.1.10'
|
|
block:
|
|
- name: "1.1.1.10 | PATCH | Ensure unused filesystems kernel modules are not available | Add discovery script"
|
|
ansible.builtin.template:
|
|
src: fs_with_cves.sh.j2
|
|
dest: /var/fs_with_cves.sh
|
|
owner: root
|
|
group: root
|
|
mode: 'u+x,go-wx'
|
|
|
|
- name: "1.1.1.10 | AUDIT | Ensure unused filesystems kernel modules are not available | Run discovery script"
|
|
ansible.builtin.command: /var/fs_with_cves.sh
|
|
changed_when: false
|
|
failed_when: discovered_fs_modules_loaded.rc not in [ 0, 99 ]
|
|
register: discovered_fs_modules_loaded
|
|
|
|
- name: "1.1.1.10 | AUDIT | Ensure unused filesystems kernel modules are not available | Output Warning"
|
|
when: discovered_fs_modules_loaded.stdout | length > 0
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
"Warning!! Discovered loaded Filesystem modules that need attention. This is a manual task
|
|
{{ discovered_fs_modules_loaded.stdout_lines }}"
|
|
|
|
- name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Capture Warning"
|
|
when: discovered_fs_modules_loaded.stdout | length > 0
|
|
ansible.builtin.import_tasks:
|
|
file: warning_facts.yml
|