This Ansible script is under development and is considered a work in progress.
This Ansible script can be used to harden a Amazon Linux 2 machine to be CIS compliant to meet level 1 or level 2 requirements.
This role will make significant changes to systems and could break the running operations of machines. Considering using this script on a test machine before using the script against other production level systems for remediation. Use this script at your own risk and no warranty is attached for the usage of this script as dictated by the license.
Ansible 2.7+
Amazon Linux 2
By default SElinux is disabled via grub in amazon linux.
The tasks in Section 1.6 of this role will enable SELinux. Alternatively, it can be manually enabled by following these steps:
edit /boot/grub/menu.lst
Modifiy selinux=0 to selinux=1
vi /etc/selinux/config
update the SELINUX to enforcing save and Quit!!
Also install the following package to allow the ansible SElinux module to function on the host.
yum install libselinux-python
A reboot will be neccessary for the changes to take effect.
role: CIS_awslinux2_Benchmark
tags:
level1
level2
always
prelim_tasks
post_tasks
section1
section2
section3
section4
section5
section6
Refer to defaults/main.yml for other vars
Refer to CIS_awslinux2_Benchmark_(level1, level1_and_level2, or level2).ymls for sample playbook.ymls. Change the role to match role folder name.
ansible-playbook -i inventory CIS_awslinux2_Benchmark/CIS_awslinux2_Benchmark-L1-L2.yml -vv
This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at https://mozilla.org/MPL/2.0/.