Merge pull request #125 from ansible-lockdown/pub_dec25_tweaks

Pub dec25 tweaks

Author: frederickw082922

Changelog.md

@@ -2,11 +2,31 @@
 
 ## Based on CIS v1.0.0
 
+## based on benchmark CIS 1.0.0
+precommit update Public issues address
+
+4.2.5 ufw port variables and improvements to include ntp and protocol options
+
+Many thanks to @DianaMariaDDM for the issues or PRs for following:
+- #109 6.3.1 - Enhancements
+- #110 6.2.3.6 - improvement to privilege command collection
+- #111 6.3.2 - template for service fixed
+- #112 7.1.2 - Enhancements
+- #113 variable documentation tidy up
+- #114 sshd tidy up of variables
+- #119 tidy up typos
+- #120 3.3.3.1/5/8 - fix variables used
+- #121 6.1.1.4 added missing control
+- #122 separate 6.2.4.1/2/3
+- #124 removed unused template
+
 ### 1.0.5 - based on benchmark CIS 1.0.0
-#92 1.1.1.7 logic improved and updating inline with audit branches - thanks @jbruno
-#93 ufw logic improved thanks to @ToonSpinTUe
-#94 Fixed var names dailychecktimer thanks to #94 @huan086
-pre-commit updates
+
+- #92 1.1.1.7 logic improved and updating inline with audit branches - thanks @jbruno
+- #93 ufw logic improved thanks to @ToonSpinTUe
+- #94 Fixed var names dailychecktimer thanks to #94 @huan086
+- pre-commit updates
+
 typo fixes
 
 1.0.4 - based on Benchmark CIS 1.0.0
@@ -39,7 +59,6 @@ thanks to @huan086
 - 76
 - 77
 
-
 ### 1.0.3 - based on Benchmark CIS 1.0.0
 pre-commit updates
 password data variable update - 7.2.10

defaults/main.yml

@@ -804,13 +804,20 @@ ubtu24cis_firewall_package: "ufw"
 ubtu24cis_ufw_use_sysctl: true
 
 ## Control 4.1.5 - Ensure ufw outbound connections are configured
-# The value of this variable represents the ports for the firewall to allow oubound traffic from.
+# The value of this variable represents the ports for the firewall to allow outbound traffic from.
 # If you want to allow outbound traffic on all ports, set the variable to  `all`, e.g.,
 # `ubtu24cis_ufw_allow_out_ports: "all"`.
 ubtu24cis_ufw_allow_out_ports:
-  - 53
-  - 80
-  - 443
+  - port: 53
+    proto: tcp
+  - port: 53
+    proto: udp
+  - port: 80
+    proto: tcp
+  - port: 123
+    proto: udp
+  - port: 443
+    proto: tcp
 
 ## Controls 4.2.x - nftables
 # Nftables is not supported in this role. Some tasks have parts of them commented out, this is one example
@@ -824,27 +831,27 @@ ubtu24cis_ufw_allow_out_ports:
 ## Section 5 Control Variables
 ##
 ## Controls 5.1.x -- various sshd settings
-ubtu24cis_sshd_default_log_level: "INFO"
-ubtu24cis_sshd_default_max_auth_tries: 4
-ubtu24cis_sshd_default_max_sessions: 8
-ubtu24cis_sshd_default_login_grace_time: 60
-ubtu24cis_sshd_default_client_alive_interval: 300
-ubtu24cis_sshd_default_client_alive_count_max: 3
+ubtu24cis_sshd_log_level: "INFO"
+ubtu24cis_sshd_max_auth_tries: 4
+ubtu24cis_sshd_max_sessions: 8
+ubtu24cis_sshd_login_grace_time: 60
+ubtu24cis_sshd_client_alive_interval: 300
+ubtu24cis_sshd_client_alive_count_max: 3
 # Removed chacha20-poly1305 due to cve2023-48795
 # all Ciphers, KEX and Macs set to FIPS 140
 # This will nee dto be adjusted according to your site requirements
-ubtu24cis_sshd_default_ciphers:
+ubtu24cis_sshd_ciphers:
   - aes256-gcm@openssh.com
   - aes128-gcm@openssh.com
   - aes256-ctr
   - aes192-ctr
   - aes128-ctr
-ubtu24cis_sshd_default_macs:
+ubtu24cis_sshd_macs:
   - hmac-sha1
   - hmac-sha2-256
   #  - hmac-sha2-384  # hashed out seen as bad ssh2 MAC
   - hmac-sha2-512
-ubtu24cis_sshd_default_kex_algorithms:
+ubtu24cis_sshd_kex_algorithms:
   - ecdh-sha2-nistp256
   - ecdh-sha2-nistp384
   - ecdh-sha2-nistp521
@@ -853,41 +860,6 @@ ubtu24cis_sshd_default_kex_algorithms:
   - diffie-hellman-group18-sha512
   - diffie-hellman-group14-sha256
 
-# SSH Settings
-# This variable is used to control the verbosity of the logging produced by the SSH server.
-# The options for setting it are as follows:
-# - `QUIET`: Minimal logging;
-# - `FATAL`: logs only fatal errors;
-# - `ERROR`: logs error messages;
-# - `INFO`: logs informational messages in addition to errors;
-# - `VERBOSE`: logs a higher level of detail, including login attempts and key exchanges;
-# - `DEBUG`: generates very detailed debugging information including sensitive information.
-ubtu24cis_sshd_log_level: "{{ ubtu24cis_sshd_default_log_level }}"
-# This variable specifies the maximum number of authentication attempts that are
-# allowed for a single SSH session.
-ubtu24cis_sshd_max_auth_tries: "{{ ubtu24cis_sshd_default_max_auth_tries }}"
-# This variable specifies the encryption algorithms that can be used for securing
-# data transmission.
-ubtu24cis_sshd_ciphers: "{{ ubtu24cis_sshd_default_ciphers }}"
-# This variable specifies a list of message authentication code algorithms (MACs) that are allowed for verifying
-# the integrity of data exchanged.
-ubtu24cis_sshd_macs: "{{ ubtu24cis_sshd_default_macs }}"
-# This variable is used to state the key exchange algorithms used to establish secure encryption
-# keys during the initial connection setup.
-ubtu24cis_sshd_kex_algorithms: "{{ ubtu24cis_sshd_default_kex_algorithms }}"
-# This variable sets the time interval in seconds between sending "keep-alive"
-# messages from the server to the client. These types of messages are intended to
-# keep the connection alive and prevent it being terminated due to inactivity.
-ubtu24cis_sshd_client_alive_interval: "{{ ubtu24cis_sshd_default_client_alive_interval }}"
-# This variable sets the maximum number of unresponsive "keep-alive" messages
-# that can be sent from the server to the client before the connection is considered
-# inactive and thus, closed.
-ubtu24cis_sshd_client_alive_count_max: "{{ ubtu24cis_sshd_default_client_alive_count_max }}"
-# This variable specifies the amount of seconds allowed for successful authentication to
-# the SSH server.
-ubtu24cis_sshd_login_grace_time: "{{ ubtu24cis_sshd_default_login_grace_time }}"
-# This variables is used to set the maximum number of open sessions per connection.
-ubtu24cis_sshd_max_sessions: "{{ ubtu24cis_sshd_default_max_sessions }}"
 # This variable, if specified, configures a list of USER name patterns, separated by spaces, to allow SSH
 # access for users whose user name matches one of the patterns. This is done
 # by setting the value of `AllowUsers` option in `/etc/ssh/sshd_config` file.

tasks/section_4/cis_4.2.x.yml

@@ -110,9 +110,11 @@
       community.general.ufw:
         rule: allow
         direction: out
-        to_port: '{{ item }}'
-      with_items:
-        - "{{ ubtu24cis_ufw_allow_out_ports }}"
+        proto: "{{ item.proto }}"
+        to_port: '{{ item.port }}'
+      loop: "{{ ubtu24cis_ufw_allow_out_ports }}"
+      loop_control:
+        label: "{{ item.port }}"
       notify: Reload ufw
 
     - name: "4.2.5 | PATCH | Ensure ufw outbound connections are configured | Allow all"

tasks/section_5/cis_5.1.x.yml

@@ -105,7 +105,7 @@
       when: "ubtu24cis_sshd_allow_users| default('') | length > 0 "
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
-        regexp: '(?i)^(#|)\s*AllowUsers'
+        regexp: '(?i)^(#?)\s*AllowUsers'
         line: 'AllowUsers {{ ubtu24cis_sshd_allow_users }}'
         validate: 'sshd -t -f %s'
       notify: Restart sshd
@@ -114,7 +114,7 @@
       when: "ubtu24cis_sshd_allow_groups| default('') | length > 0"
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
-        regexp: '(?i)^(#|)\s*AllowGroups'
+        regexp: '(?i)^(#?)\s*AllowGroups'
         line: 'AllowGroups {{ ubtu24cis_sshd_allow_groups }}'
         validate: 'sshd -t -f %s'
       notify: Restart sshd
@@ -123,7 +123,7 @@
       when: "ubtu24cis_sshd_deny_users| default('') | length > 0"
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
-        regexp: '(?i)^(#|)\s*DenyUsers'
+        regexp: '(?i)^(#?)\s*DenyUsers'
         line: 'DenyUsers {{ ubtu24cis_sshd_deny_users }}'
         validate: 'sshd -t -f %s'
       notify: Restart sshd
@@ -194,8 +194,8 @@
     line: "{{ item.line }}"
     validate: 'sshd -t -f %s'
   with_items:
-    - { regexp: '^ClientAliveInterval', line: 'ClientAliveInterval {{ ubtu24cis_sshd_client_alive_interval | default(ubtu24cis_sshd_default_client_alive_interval) }}' }
-    - { regexp: '^ClientAliveCountMax', line: 'ClientAliveCountMax {{ ubtu24cis_sshd_client_alive_count_max | default(ubtu24cis_sshd_default_client_alive_count_max) }}' }
+    - { regexp: '^ClientAliveInterval', line: 'ClientAliveInterval {{ ubtu24cis_sshd_client_alive_interval }}' }
+    - { regexp: '^ClientAliveCountMax', line: 'ClientAliveCountMax {{ ubtu24cis_sshd_client_alive_count_max }}' }
   notify: Restart sshd
 
 - name: "5.1.8 | PATCH | Ensure sshd DisableForwarding is enabled"
@@ -209,7 +209,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*DisableForwarding
+    regexp: (?i)^(#?)\s*DisableForwarding
     line: 'DisableForwarding yes'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -229,7 +229,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*GSSAPIAuthentication
+    regexp: (?i)^(#?)\s*GSSAPIAuthentication
     line: 'GSSAPIAuthentication no'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -249,7 +249,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*HostbasedAuthentication
+    regexp: (?i)^(#?)\s*HostbasedAuthentication
     line: 'HostbasedAuthentication no'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -269,7 +269,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*IgnoreRhosts
+    regexp: (?i)^(#?)\s*IgnoreRhosts
     line: 'IgnoreRhosts yes'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -285,8 +285,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*KexAlgorithms
-    line: "KexAlgorithms {{ ubtu24cis_sshd_kex_algorithms | default(ubtu24cis_sshd_default_kex_algorithms) | join(',') }}"
+    regexp: (?i)^(#?)\s*KexAlgorithms
+    line: "KexAlgorithms {{ ubtu24cis_sshd_kex_algorithms | join(',') }}"
     insertafter: '^# Ciphers and keying'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -302,8 +302,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*LoginGraceTime
-    line: 'LoginGraceTime {{ ubtu24cis_sshd_login_grace_time | default(ubtu24cis_sshd_default_login_grace_time) }}'
+    regexp: (?i)^(#?)\s*LoginGraceTime
+    line: 'LoginGraceTime {{ ubtu24cis_sshd_login_grace_time }}'
     insertafter: '^# Authentication'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -321,8 +321,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*LogLevel
-    line: 'LogLevel {{ ubtu24cis_sshd_log_level | default(ubtu24cis_sshd_default_log_level) }}'
+    regexp: (?i)^(#?)\s*LogLevel
+    line: 'LogLevel {{ ubtu24cis_sshd_log_level }}'
     insertafter: '^# Logging'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -342,8 +342,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*MACs
-    line: "MACs {{ ubtu24cis_sshd_macs | default(ubtu24cis_sshd_default_macs) | join(',') }}"
+    regexp: (?i)^(#?)\s*MACs
+    line: "MACs {{ ubtu24cis_sshd_macs | join(',')}}"
     insertafter: '^# Ciphers and keying'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -359,8 +359,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*MaxAuthTries
-    line: 'MaxAuthTries {{ ubtu24cis_sshd_max_auth_tries | default(ubtu24cis_sshd_default_max_auth_tries) }}'
+    regexp: (?i)^(#?)\s*MaxAuthTries
+    line: 'MaxAuthTries {{ ubtu24cis_sshd_max_auth_tries }}'
     insertafter: '^# Authentication'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -380,8 +380,8 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*MaxSessions
-    line: 'MaxSessions {{ ubtu24cis_sshd_max_sessions | default(ubtu24cis_sshd_default_max_sessions) }}'
+    regexp: (?i)^(#?)\s*MaxSessions
+    line: 'MaxSessions {{ ubtu24cis_sshd_max_sessions }}'
     insertafter: '^# Authentication'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -401,7 +401,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*MaxStartups
+    regexp: (?i)^(#?)\s*MaxStartups
     line: 'MaxStartups 10:30:60'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -421,7 +421,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*PermitEmptyPasswords
+    regexp: (?i)^(#?)\s*PermitEmptyPasswords
     line: 'PermitEmptyPasswords no'
     insertafter: '# To disable tunneled clear text passwords'
     validate: 'sshd -t -f %s'
@@ -438,7 +438,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*PermitRootLogin
+    regexp: (?i)^(#?)\s*PermitRootLogin
     line: 'PermitRootLogin no'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -458,7 +458,7 @@
     - sshd
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*PermitUserEnvironment
+    regexp: (?i)^(#?)\s*PermitUserEnvironment
     line: 'PermitUserEnvironment no'
     validate: 'sshd -t -f %s'
   notify: Restart sshd
@@ -479,7 +479,7 @@
     - pam
   ansible.builtin.lineinfile:
     path: /etc/ssh/sshd_config
-    regexp: (?i)^(#|)\s*UsePAM
+    regexp: (?i)^(#?)\s*UsePAM
     line: 'UsePAM yes'
     insertafter: '^# and ChallengeResponseAuthentication'
     validate: 'sshd -t -f %s'

tasks/section_6/cis_6.1.1.x.yml

@@ -96,3 +96,49 @@
         - '^(\s*RuntimeMaxUse\s*=)'
         - '^(\s*RuntimeKeepFree\s*=.*)'
         - '^(\s*MaxFileSec\s*=.*)'
+
+- name: "6.1.1.4 | PATCH | Ensure only one logging system is in use"
+  when: ubtu24cis_rule_6_1_1_4
+  tags:
+    - level1-server
+    - level1-workstation
+    - patch
+    - journald
+    - rule_6.1.1.4
+    - NIST800-53R5_AU-2
+    - NIST800-53R5_AU-7
+    - NIST800-53R5_AU-12
+  block:
+    - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If journald"
+      when: ubtu24cis_syslog_service == "journald"
+      block:
+        - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If journald"
+          ansible.builtin.systemd:
+            name: systemd-journald.service
+            state: started
+            enabled: true
+
+        - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If journald"
+          when: "'rsyslog' in ansible_facts.packages"
+          ansible.builtin.systemd:
+            name: rsyslog.service
+            state: stopped
+            enabled: false
+
+    - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If rsyslog"
+      when: ubtu24cis_syslog_service == "rsyslog"
+      block:
+        - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If rsyslog"
+          ansible.builtin.systemd:
+            name: rsyslog.service
+            state: started
+            enabled: true
+
+        - name: "6.1.1.4 | PATCH | Ensure only one logging system is in use | If rsyslog"
+          when: "'systemd-journal' in ansible_facts.packages"
+          ansible.builtin.systemd:
+            name: systemd-journald.service
+            state: stopped
+            enabled: false
+          failed_when: discovered_missing_service.changed or "'Could not find' not in discovered_missing_service.msg"
+          register: discovered_missing_service