new files from source

Infrastrucutre as Code/Ansible/roles/cis_hardening/kernel_hardening/tasks/blacklist_module.yml

@@ -0,0 +1,18 @@
+# blacklist_module.yml
+- name: Check if module {{ mod }} exists on system
+  ansible.builtin.shell: "modprobe -n -v {{ mod }}"
+  register: modprobe_check
+  ignore_errors: true
+
+- name: Blacklist module {{ mod }} in {{ modprobe_blacklist_file }}
+  ansible.builtin.lineinfile:
+    path: "{{ modprobe_blacklist_file }}"
+    line: "install {{ mod }} /bin/false"
+    create: yes
+    state: present
+  when: modprobe_check.rc == 0
+
+- name: Unload module {{ mod }} if currently loaded
+  ansible.builtin.shell: "modprobe -r {{ mod }}"
+  ignore_errors: true
+  when: modprobe_check.rc == 0

Infrastrucutre as Code/Ansible/roles/cis_hardening/kernel_hardening/tasks/main.yml

@@ -0,0 +1,78 @@
+---
+# Kernel & sysctl hardening (CIS network/kernel items)
+
+- name: Ensure IPv4 forwarding is disabled
+  ansible.builtin.sysctl:
+    name: net.ipv4.ip_forward
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Ensure IPv6 forwarding is disabled
+  ansible.builtin.sysctl:
+    name: net.ipv6.conf.all.forwarding
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Ensure source routed packets are not accepted
+  ansible.builtin.sysctl:
+    name: net.ipv4.conf.all.accept_source_route
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Ensure ICMP redirects are not accepted
+  ansible.builtin.sysctl:
+    name: net.ipv4.conf.all.accept_redirects
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Ensure secure ICMP redirects are not accepted
+  ansible.builtin.sysctl:
+    name: net.ipv4.conf.all.secure_redirects
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Ensure Address Space Layout Randomization (ASLR) is enabled
+  ansible.builtin.sysctl:
+    name: kernel.randomize_va_space
+    value: "2"
+    state: present
+    reload: yes
+
+- name: Ensure fs.suid_dumpable is 0 (disable core dumps)
+  ansible.builtin.sysctl:
+    name: fs.suid_dumpable
+    value: "0"
+    state: present
+    reload: yes
+
+- name: Create /etc/modprobe.d/cis_blacklist.conf with common blacklists
+  ansible.builtin.copy:
+    dest: /etc/modprobe.d/cis_blacklist.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      # CIS blacklist
+      install cramfs /bin/true
+      install freevxfs /bin/true
+      install jffs2 /bin/true
+      install hfs /bin/true
+      install hfsplus /bin/true
+      install squashfs /bin/true
+      install udf /bin/true
+
+- name: Regenerate initramfs if modprobe blacklist changed
+  ansible.builtin.command: dracut -f
+  changed_when: false
+  when: ansible_facts.get('os_family') == 'RedHat' or ansible_facts.get('distribution') in ['Rocky', 'RedHat', 'CentOS']
+
+- name: Blacklist all modules
+  include_tasks: blacklist_module.yml
+  loop: "{{ blacklist_modules }}"
+  loop_control:
+    loop_var: mod