Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure PAM Enforces Password Requirements - Minimum Different Categor… #93

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Ensure PAM Enforces Password Requirements - Minimum Different Categor… #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
98296ed
Ensure PAM Enforces Password Requirements - Minimum Different Categor…
peteryang May 24, 2022
ffff506
customize configuration
peteryang May 24, 2022
afad53f
The man page sshd_config(5) contains a list of supported ciphers. The…
peteryang May 24, 2022
c03734a
I do not want to put CIS hardening in project folder.
peteryang May 24, 2022
c7f3f69
change location for my own project
peteryang May 24, 2022
1ae37aa
fix path error
peteryang May 24, 2022
1be241a
ignore_errors value should be boolean true
peteryang May 24, 2022
487c4ef
ignore_errors: true replace yes
peteryang May 24, 2022
ba7d6a2
change root_password
peteryang May 24, 2022
7387bd4
package_ufw_removed
peteryang May 24, 2022
7481543
change localhost to loopback-only
peteryang May 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 17 additions & 10 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,16 @@ set_bootloader_credentials: no
bootloader_credentials: { user: "root", password: "b00tl04derPwd" }
# 1.4.3 Ensure authentication required for single user mode
set_root_password: yes
root_password: r00tP4ssw0rd
root_password: SingTel5G@SingTel5G
## 1.7.1 Ensure permissions on /etc/motd are configured: allow for custom motd template (if the file doesn't exist, the
## default template in files/templates/motd.j2 will be used)
custom_motd_file_path: "{{ inventory_dir }}/custom_templates/motd_custom.txt"
custom_motd_file_path: "{{ inventory_dir }}/../custom_templates/motd_custom.txt"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this change?

## 1.7.2 Ensure permissions on /etc/issue are configured: allow for custom issue template (if the file doesn't exist, the
## default template in files/templates/issue.j2 will be used)
custom_issue_file_path: "{{ inventory_dir }}/custom_templates/issue_custom.txt"
custom_issue_file_path: "{{ inventory_dir }}/../custom_templates/issue_custom.txt"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this change?

## 1.7.3 Ensure permissions on /etc/issue.net are configured: allow for custom issue.net template (if the file doesn't exist, the
## default template in files/templates/issue.net.j2 will be used)
custom_issue_net_file_path: "{{ inventory_dir }}/custom_templates/issue_net_custom.txt"
custom_issue_net_file_path: "{{ inventory_dir }}/../custom_templates/issue_net_custom.txt"

# Section 2 Settings
##Setting for systemd-timesyncd
Expand Down Expand Up @@ -96,10 +96,17 @@ remove_RPC: yes
disable_wifi: no
IPv6_is_enabled: no
enable_firewall: yes
UFWEnable: yes # Running both ufw and the services included in the iptables-persistent package may lead to conflict
UFWEnable: no # Running both ufw and the services included in the iptables-persistent package may lead to conflict
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why changing this?

## 3.5.1.6 Ensure firewall rules exist for all open ports | defined ports
firewall_list_of_ports_to_allow:
- { rule: "allow", port: "8080", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp" }
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why should we add these strange ports by default?

- { rule: "allow", port: "80", proto: "tcp" }
- { rule: "allow", port: "81", proto: "tcp" }
- { rule: "allow", port: "443", proto: "tcp" }
- { rule: "allow", port: "1880", proto: "tcp" }
- { rule: "allow", port: "1883", proto: "tcp" }
- { rule: "allow", port: "8883", proto: "tcp" }
- { rule: "allow", port: "5432", proto: "tcp" }
## 3.5.1.6 Ensure firewall rules exist for all open ports | keep_alived
firewall_allow_keep_alive: no

Expand All @@ -124,14 +131,14 @@ grub_backlog_limit: 8192

# Section 5 settings
## 5.1.8 Ensure cron is restricted to authorized users
allowd_hosts: "ALL: 0.0.0.0/0.0.0.0, 192.168.2.0/255.255.255.0"
allowd_hosts: "ALL: 0.0.0.0/0.0.0.0, 10.2.0.0/255.255.0.0"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reason for this change?

## 5.2.13 Ensure only strong MAC algorithms are used
ssh_MACs: "[email protected],[email protected],hmac-sha2-512,hmac-sha2-256"
## 5.2.14 Ensure only strong Key Exchange algorithms are used
ssh_key_algorithms: "curve25519-sha256,[email protected],diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256"
ssh_ciphers: [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
ssh_ciphers: [email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
## 5.2.17 Ensure SSH access is limited
allowed_users: ubuntu root #Put None or list of users space between each user
allowed_users: adminuser #Put None or list of users space between each user
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it will work in the default version of ubuntu; the user adminusr is not existed; so keeping it as ubuntu and root and the user can change it when they apply this playbook

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep, we need ubuntu and root here as defaults

allowed_groups: None
deny_users: None
deny_groups: None
Expand All @@ -148,7 +155,7 @@ pass_warn_age: 7
pass_min_days: 1
## 5.4.1.1 Ensure password expiration is 365 days or less
list_of_os_users:
- ubuntu
- adminuser
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

keep it for the default user ubuntu,

## 5.4.1.4 Ensure inactive password lock is 30 days or less
##Note: A value of -1 would disable this setting
account_inactive: 30
Expand Down
16 changes: 8 additions & 8 deletions tasks/section_1_Initial_Setup.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@
modprobe:
name: vfat
state: absent
ignore_errors: yes
ignore_errors: true
when: disable_fat
tags:
- section1
Expand Down Expand Up @@ -420,7 +420,7 @@
shell: |
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null
register: worldWriteableList
ignore_errors: yes
ignore_errors: true
- name: 1.1.22 Ensure sticky bit is set on all world-writable directories | fix
script: 1_1_22.sh
when: worldWriteableList.stdout_lines |length > 0
Expand All @@ -443,7 +443,7 @@
service:
name: autofs
enabled: false
ignore_errors: yes
ignore_errors: true
- name: 1.1.23 Disable Automounting | package remove
apt:
name: autofs
Expand Down Expand Up @@ -567,7 +567,7 @@
lineinfile:
dest: /etc/sudoers
state: present
regexp: "^Defaults logfile.*"
regexp: "^#?\\s*Defaults logfile.*"
line: 'Defaults logfile="/var/log/sudo.log"'
validate: "visudo -cf %s"
tags:
Expand Down Expand Up @@ -793,7 +793,7 @@
shell: |
dmesg | grep -E "NX|XD" | grep " active"
register: xdnx
ignore_errors: yes
ignore_errors: true
- name: 1.5.1 Ensure XD/NX support is enabled
debug:
msg: |
Expand All @@ -802,7 +802,7 @@
If necessary configure your bootloader to load the new kernel and reboot the system.
You may need to enable NX or XD support in your bios.
{{ xdnx.stdout_lines }}
ignore_errors: yes
ignore_errors: true
tags:
- section1
- level_1_server
Expand All @@ -829,7 +829,7 @@
block:
- name: 1.5.3 Ensure prelink is not installed
command: prelink -ua
ignore_errors: yes
ignore_errors: true
- name: 1.5.3 Ensure prelink is not installed
apt:
name: prelink
Expand Down Expand Up @@ -1080,7 +1080,7 @@
- name: 1.9 Ensure updates, patches, and additional security software are installed
apt:
upgrade: dist
ignore_errors: yes
ignore_errors: true
tags:
- section1
- level_1_server
Expand Down
4 changes: 2 additions & 2 deletions tasks/section_2_Services.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,7 +363,7 @@
lineinfile:
dest: /etc/postfix/main.cf
regexp: "^(#)?inet_interfaces"
line: "inet_interfaces = localhost"
line: "inet_interfaces = loopback-only"
when: postfix.stat.exists
tags:
- section2
Expand All @@ -376,7 +376,7 @@
apt:
name: rsync
state: absent
ignore_errors: yes
ignore_errors: true
when: remove_rsyncservice
tags:
- section2
Expand Down
2 changes: 1 addition & 1 deletion tasks/section_4_Logging_and_Auditing.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,7 +326,7 @@
notify:
- audit rules load
- auditd restart
ignore_errors: yes
ignore_errors: true
tags:
- section4
- level_2_server
Expand Down
13 changes: 7 additions & 6 deletions tasks/section_5_Access_Authentication_and_Authorization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
file:
path: /etc/cron.deny
state: absent
ignore_errors: yes
ignore_errors: true
- stat:
path: /etc/cron.allow
register: cfile
Expand All @@ -119,7 +119,7 @@
file:
path: /etc/at.deny
state: absent
ignore_errors: yes
ignore_errors: true
- stat:
path: /etc/at.allow
register: cfile
Expand Down Expand Up @@ -523,14 +523,15 @@
state: present
create: yes
dest: /etc/security/pwquality.conf
regexp: "^{{ item.key }}"
regexp: "^#?\\s*{{ item.key }}"
line: "{{ item.key }} = {{ item.value }}"
with_items:
- { key: "minlen", value: "14" }
- { key: "dcredit", value: "-1" }
- { key: "ucredit", value: "-1" }
- { key: "ocredit", value: "-1" }
- { key: "lcredit", value: "-1" }
- { key: "minclass", value: "4" }
tags:
- section5
- level_1_server
Expand Down Expand Up @@ -634,7 +635,7 @@
- name: 5.5.1.3 Ensure password expiration warning days is 7 or more | chage --warndays
command: "chage --warndays {{ pass_warn_age }} {{ item }}"
with_items: "{{ list_of_os_users }}"
ignore_errors: yes
ignore_errors: true
tags:
- section5
- level_1_server
Expand All @@ -650,7 +651,7 @@
- name: 5.5.1.4 Ensure inactive password lock is 30 days or less | useradd
command: "chage --inactive {{ account_inactive }} {{ item }}"
with_items: "{{ list_of_os_users }}"
ignore_errors: yes
ignore_errors: true
tags:
- section5
- level_1_server
Expand Down Expand Up @@ -800,7 +801,7 @@
copy:
dest: "{{ outputfiles }}/5.6"
content: "{{ securetty }}"
ignore_errors: yes
ignore_errors: true
tags:
- section5
- level_1_server
Expand Down