---
# Kernel & sysctl hardening (CIS network/kernel items)

- name: Ensure IPv4 forwarding is disabled
  ansible.builtin.sysctl:
    name: net.ipv4.ip_forward
    value: "0"
    state: present
    reload: yes

- name: Ensure IPv6 forwarding is disabled
  ansible.builtin.sysctl:
    name: net.ipv6.conf.all.forwarding
    value: "0"
    state: present
    reload: yes

- name: Ensure source routed packets are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.accept_source_route
    value: "0"
    state: present
    reload: yes

- name: Ensure ICMP redirects are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.accept_redirects
    value: "0"
    state: present
    reload: yes

- name: Ensure secure ICMP redirects are not accepted
  ansible.builtin.sysctl:
    name: net.ipv4.conf.all.secure_redirects
    value: "0"
    state: present
    reload: yes

- name: Ensure Address Space Layout Randomization (ASLR) is enabled
  ansible.builtin.sysctl:
    name: kernel.randomize_va_space
    value: "2"
    state: present
    reload: yes

- name: Ensure fs.suid_dumpable is 0 (disable core dumps)
  ansible.builtin.sysctl:
    name: fs.suid_dumpable
    value: "0"
    state: present
    reload: yes

- name: Create /etc/modprobe.d/cis_blacklist.conf with common blacklists
  ansible.builtin.copy:
    dest: /etc/modprobe.d/cis_blacklist.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      # CIS blacklist
      install cramfs /bin/true
      install freevxfs /bin/true
      install jffs2 /bin/true
      install hfs /bin/true
      install hfsplus /bin/true
      install squashfs /bin/true
      install udf /bin/true

- name: Regenerate initramfs if modprobe blacklist changed
  ansible.builtin.command: dracut -f
  changed_when: false
  when: ansible_facts.get('os_family') == 'RedHat' or ansible_facts.get('distribution') in ['Rocky', 'RedHat', 'CentOS']

- name: Blacklist all modules
  include_tasks: blacklist_module.yml
  loop: "{{ blacklist_modules }}"
  loop_control:
    loop_var: mod