Skip to content

Releases: ansible-lockdown/RHEL8-CIS

CIS Version: 3.0.0 - Oct24 Updates

18 Oct 12:28
0576f15
Compare
Choose a tag to compare

Based upon CIS Version: 3.0.0 10th November 2023

Remediate

Rebase to fix some older issues, shows as some updates.
Pre-commit updates
Many improvements to different controls
Audit updates
New workflow pipeline

AUDIT

What's Changed

New Contributors

Full Changelog: 3.0.0...3.0.1

CIS 3.0.0 - 1-10-2023

20 Jun 15:39
a1516d9
Compare
Choose a tag to compare

CIS Version: 3.0.0 10th November 2023

Remediate

V3.0.0 release
Pre-commit updates
Many improvements to different controls
Audit updates
New workflow pipeline

AUDIT

  • Audit only option added
  • New goss binary now supported
  • Audit variables tidied and moved

What's Changed

#356
#358
#366
#370
#371
#373
#374
#383
#385

Final Benchmark 2.0.0 Release

06 Mar 13:46
bc4cdf8
Compare
Choose a tag to compare

CIS Version: 2.0.0 2-23-2022

Remediate

Issues closed and PRs merged - What's changed
Pre-commit updates
Many improvements to different controls
ansible version to 2.11.1

AUDIT

  • Audit only option added
  • New goss binary now supported
  • Audit variables tidied and moved

What's Changed

New Contributors

Full Changelog: 2.5.2...v2.6

RHEL8 CIS - 2.0.0

19 Jul 13:49
9115397
Compare
Choose a tag to compare
  • audit updates

    • pre and post and format type updates
    • #323 thanks to @cobrin preserve copied audit files permissions
    • python 3 only
    • Improvements for workflow and new pipeline methods
    • README updated with badges and labels to use the new workflow
  • pre-commit added and several checks, pre-commit-ci added to repo to ensure content

    • README updated
  • Updates to container discovery and usage within benchmark

  • linting

  • aligned ansible version to 2.10.1 +

  • home directories files change links

  • #304

    • improve passwd check for user only is using sudo thanks to manish on discord community for highlighting issue.

thanks to @bbaassssiiee

  • removed legacy tcp_wrappers information
  • disable ipv6 options
    • #299
    • disable ipv6 for sshd - rhel8cis_ipv6_sshd_disable: false (default) - added to prelim
    • disable ipv6 for chrony - rhel8cis_ipv6_chrony_disable: false (default) - added to prelim
    • turn off ipv6 for localhost - rhel8cis_ipv6_disable_localhost: false (default) - refer https://access.redhat.com/solutions/8709
    • #306
    • #295 crypto policy option updates
    • #296
  • journald
  • #320 thanks to @bbbbaassiieeee set files even if rsyslog chosen

What's Changed

New Contributors

Full Changelog: 2.5.1...2.5.2

Beta test for pamd

25 Apr 15:20
080629a
Compare
Choose a tag to compare
Beta test for pamd Pre-release
Pre-release

thanks to @Crayeth

#278
Added new options to allow ipv6 rules if required although ipv6 disabled
rhel8cis_ipv6_sysctl_force
default: true
thanks to @bbaassssiiee

#279
#280
#281
#284
new option to allow manual changes to pamd files without using authconfig
rhel8cis_5_4_2_risks need sto be set to ACCEPT to run
default: NEVER**

Ansible Galaxy updates

21 Mar 21:14
af2446a
Compare
Choose a tag to compare

What's Changed

Full Changelog: 2.2.0...2.2.1

release 2.2.0

20 Mar 08:22
b07f1d7
Compare
Choose a tag to compare

Summary Review of Changes:
rule 1.1.2.1 improvement
molecule options added with wsl thanks to @bbaassssiiee
updates to tags
workflow updates
lint updates
new warning summary setup

What's Changed

Full Changelog: 2.1.0...2.2.0

Updates and improvements

06 Jul 13:21
0220ed1
Compare
Choose a tag to compare

CIS Version: 2.0.0
CIS Version Release Date: 2-23-2022

Issues Addressed:
@ccravens

  • #160 - Ansible 2.12 Does Not Manage /etc/crontab
  • #183 - should not/cannot edit /etc/crontab
  • #204 - Added CentOS keys (PR)

@flwitten

  • #180 - 1.4.1 Ensure bootloader password is set | always skipped
  • #181 - 1.8.5 | Ensure automatic mounting of removable media is disabled | Typo
  • #182 - /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-official
  • #185 - 4.2.1.x & 4.2.2.x

@ChandlerSwift

  • #187 - 5.6.2 'rhel8cis_passwd' is undefined
  • #192 - 5.6.2 locks out (almost) all non-system accounts, rather than system accounts
  • #195 - Fix path for /etc/group control 6.1.5 (PR)

@scottdoane

  • #203 - 4.2.1.5 conflicts with itself on cron, auth logs

@ztmr

  • #190 - Incorrect container detection fails certain tasks if executed in Podman

@Thulium-Drake

  • #196 - Some handlers conflict with RHEL7-CIS handlers
  • #198 - Fix #197 (PR)
  • #200 - Versioned grub2cfg handler because it works differently in comparison to RHEL7-CIS (PR for issue #196 )
  • #208 - Excluded nobody user from 6.2.10 (PR for issue #207)

@pavloos

  • #186 - Audit not working audit_out_dir is not /var/tmp

@MindPointGroup (@uk-bolly and @georgenalen)

Enhancements:

  • changed crypto to DEFAULT in defaults/main and updated as allowed option
  • 3.4.1.2 - removed enabled option as errors if masked and enable option
  • github workflow added branch option to issues.
  • Dynamic UID discovery
  • several title updates and alignments
  • logic and idempotence improvement
  • tag updates and fixes
  • removed config no longer used
  • dynamic container discovery
  • update container variables and usage
  • firewall services audit template output now works with goss correctly
  • firewall services included cockpit as default
  • 4.2.2.1.4 - changed to be socket service as per documentation
  • update to auditd template
  • uses facts and template new variable
  • update_audit_template (default false)
  • 3.4.1.5 discovery improvement
  • 5.6.1.4 discovery improvement
  • Added a warning comment managed by Ansible to all template files

Benchmark 2.0.0 updates and issue fixes

21 Apr 21:26
068aca0
Compare
Choose a tag to compare
  • CIS Version: 2.0.0 2-23-2022

Issues Addressed:

  • #128 - Current 4.2.3 Ensure permissions on all logfiles are configured remediation will break RHEL8
  • #132 - Tasks 1.1.15 - 1.1.17 skipped
  • #138 - 4.1.17 Ensure the audit configuration is immutable - Not correct set
  • #139 - CIS Control 5.2.13 incorrect value
  • #141 - Running in check mode fails on task 6.2.20
  • #142 - Remove extra quotes that break check mode
  • #143 - Check mode labels missing
  • #146 - Undefined variable in parse_etc_password.yml
  • #147 - Section 6.2.8: file does not have argument warn
  • #155 - Alternative to fail with incompatible OS
  • #156 - Include statements deprecated in Ansible 2.12 - will be removed in 2.16
  • #157 - Section 6.2.9 should not recurse
  • #164 - Please add run_audit tag in tasks/main.yml
  • #165 - ansible_distribution_major_version should be treated as a string and not as an integer
  • #176 - "2.2.10" task uses the wrong when conditional and tags

Enhancements:

  • Benchmarks 2.0.0 updates

Benchmark 1.0.1 updates

15 Sep 16:53
06e12af
Compare
Choose a tag to compare
  • CIS Version: 1.0.1 5-19-2021

Issues Addressed:

  • #110 - tmp.mount support
  • #132 - Tasks 1.1.15 - 1.1.17 skipped

Enhancements:

  • Benchmarks 1.0.1
  • Added Issue Templates
  • Added PR Templates