79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
---
|
|
# Kernel & sysctl hardening (CIS network/kernel items)
|
|
|
|
- name: Ensure IPv4 forwarding is disabled
|
|
ansible.builtin.sysctl:
|
|
name: net.ipv4.ip_forward
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure IPv6 forwarding is disabled
|
|
ansible.builtin.sysctl:
|
|
name: net.ipv6.conf.all.forwarding
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure source routed packets are not accepted
|
|
ansible.builtin.sysctl:
|
|
name: net.ipv4.conf.all.accept_source_route
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure ICMP redirects are not accepted
|
|
ansible.builtin.sysctl:
|
|
name: net.ipv4.conf.all.accept_redirects
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure secure ICMP redirects are not accepted
|
|
ansible.builtin.sysctl:
|
|
name: net.ipv4.conf.all.secure_redirects
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure Address Space Layout Randomization (ASLR) is enabled
|
|
ansible.builtin.sysctl:
|
|
name: kernel.randomize_va_space
|
|
value: "2"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Ensure fs.suid_dumpable is 0 (disable core dumps)
|
|
ansible.builtin.sysctl:
|
|
name: fs.suid_dumpable
|
|
value: "0"
|
|
state: present
|
|
reload: yes
|
|
|
|
- name: Create /etc/modprobe.d/cis_blacklist.conf with common blacklists
|
|
ansible.builtin.copy:
|
|
dest: /etc/modprobe.d/cis_blacklist.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
# CIS blacklist
|
|
install cramfs /bin/true
|
|
install freevxfs /bin/true
|
|
install jffs2 /bin/true
|
|
install hfs /bin/true
|
|
install hfsplus /bin/true
|
|
install squashfs /bin/true
|
|
install udf /bin/true
|
|
|
|
- name: Regenerate initramfs if modprobe blacklist changed
|
|
ansible.builtin.command: dracut -f
|
|
changed_when: false
|
|
when: ansible_facts.get('os_family') == 'RedHat' or ansible_facts.get('distribution') in ['Rocky', 'RedHat', 'CentOS']
|
|
|
|
- name: Blacklist all modules
|
|
include_tasks: blacklist_module.yml
|
|
loop: "{{ blacklist_modules }}"
|
|
loop_control:
|
|
loop_var: mod
|