harryharcourt / ansible-rhel8-cis-benchmarks Goto Github PK

first of all I need to say it is great job, thank you!

do you know if there is a quick way to check what changed between CIS benchmarks for Redhat/Centos 8.2 (supported by your scripts now) and Redhat/Centos 8.4 - to change/add/remove needed stuff?

Btw. to speedup some tasks execution it would be worth to tune some of them, for example in 1.1.18.yml I recommend changing task:

  - name: 1.1.18 - Ensure sticky bit is set on all world-writable directories - changed_when false
    shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002
    register: shell_output
    changed_when: false

with

  - name: 1.1.18 - Ensure sticky bit is set on all world-writable directories - changed_when false
    shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \)
    register: shell_output
    changed_when: shell_output.stdout_lines | length > 0

G'day Harry,

BTW: Thx for writing this role, I use it extensively and have credited you in my credits...

This is more an RFE, than a bug or issue, and it's just to make the whole CIS benchmark run faster. If a task is skipped, the facts might still be unnecessarily refreshed. e.g.
TASK [Ansible-RHEL8-CIS-Benchmarks : 1.1.14 - Ensure nodev option set on /home partition] ***************************
skipping: [server.local] => (item={'mount': '/', 'device': '/dev/mapper/rhel-root', 'fstype': 'xfs', 'options': 'rw,seclabel,relatime,attr2,inode64,noquota', 'size_total': 38476525568, 'size_available': 35744559104, 'block_size': 4096, 'block_total': 9393683, 'block_available': 8726699, 'block_used': 666984, 'inode_total': 18796544, 'inode_available': 18738753, 'inode_used': 57791, 'uuid': '7b207674-3a3b-4b80-9de3-ba808846ae07'})
skipping: [server.local] => (item={'mount': '/boot', 'device': '/dev/vda1', 'fstype': 'xfs', 'options': 'rw,seclabel,relatime,attr2,inode64,noquota', 'size_total': 1063256064, 'size_available': 812662784, 'block_size': 4096, 'block_total': 259584, 'block_available': 198404, 'block_used': 61180, 'inode_total': 524288, 'inode_available': 523980, 'inode_used': 308, 'uuid': '14db2aba-53cf-4e2d-b8a7-77710eec3748'})

TASK [Ansible-RHEL8-CIS-Benchmarks : Refresh facts] *****************************************************************
ok: [server.local]

Whether it's worth the effort to put the conditionals in the code, is debatable, but I thought I would message you on it.

Hi Harry,

Thank you for your great work.

after applying these rules on RHEL 8.2 some of the users not able to connect SFTP server, as they are using the old ssh key exchange algorithm. I figured out the solution to update the SFTP client, but if you can please help me to know which algorithm is disabled or remove after applying the script?

User is getting the below error.

"Couldn't agree a key exchange algorithm (available: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512)"

G'day Harry,

Again thx for writing this role. There is an issue with RHEL8.2: I have a work-around in my Ansible playbook, but thought you should know...

TASK [Ansible-RHEL8-CIS-Benchmarks : 2.2.2 - Ensure X Window System is absent, exception 123] => yum remove xorg-x11* => erroring on trying to remove linux-firmware. Q: why is it trying to remove it? A: Unknown ATM

The CIS play tries to remove xorg-x11* but fails if it is already absent. Workaround is to exclude test 2.2.2 on systems that have this issue. Also had other issues with this where the removal of xorg-x11* was successful but removes dependant packages installed by other processes - example being grafana, which installs an X11 font package - the hardening goes ahead and REMOVES xorg-x11* including the required font package. Bottom line, there are legitimate reasons to exclude a hardening task from a host - provided other mitigations are in place there shouldn't be any problems.

Hi Harry,

This is great work. I have a question: Is this compatible for Centos 8 CIS Benchmark or should be a different repository for this?
If yes, I will proceed. If not do you know in Github any repository for this?
I have been trying to find it with no success yet :)

Best regards,
Guillermo