What is the idea of the first part of 3.5.1.7?

[jvleminc]

Not sure what the idea is behind these lines in the "Ensure default deny firewall policy" policy.

    - name: 3.5.1.7 Ensure default deny firewall policy
      shell: |
        ufw allow git
        ufw allow in http
        ufw allow in https
        ufw logging on

If any ports need to be opened, this can be done in the last part of 3.5.1.6:

    - name:
      ufw:
        rule: "{{ item.rule }}"
        port: "{{ item.port }}"
        proto: "{{ item.proto }}"
      with_items: "{{ list_of_ports_to_allow }}"

If you agree, I will create a PR to remove that first part, @alivx .

[alivx]

Yes you are right,
You can merge both point into one, like this.
"3.5.1.6 Ensure firewall rules exist for all open ports
3.5.1.7 Ensure default deny firewall policys"

[jvleminc]

PR created: #41. I've also removed another line, which reset the default policy to allow.

I prefer to keep both sections separate, just as in the CIS Guide.

[jvleminc]

PR merged, will mark this discussion as locked.