Skip to content

Commit c872280

Browse files
jovialmnasiadkaMoteHueAlex-Welshmarkgoddard
authored
Adds Ubuntu Jammy & Rocky 9 CIS benchmark hardening playbooks (#685)
* Adds Ubuntu Jammy CIS benchmark hardening playbooks Co-authored-by: "Dawud <dawud@stackhpc.com>" * Use fork of role to support inject_facts_as_vars=False * Add support for Rocky 9 CIS hardening Co-authored-by: Michał Nasiadka <michal@stackhpc.com> * Whitespace fix * Whitespace fix * Matt's code review Co-authored-by: Matt Crees <mattc@stackhpc.com> * Add rhel9 auditd configuration * Move auditd config to new location * ... * Update cis * Apply suggestions from code review Co-authored-by: Alex-Welsh <112560678+Alex-Welsh@users.noreply.github.com> Co-authored-by: Mark Goddard <mark@stackhpc.com> Co-authored-by: Matt Crees <mattc@stackhpc.com> * Apply suggestions from code review * Apply suggestions from code review * Rename section * Fix indentation * Apply suggestions from code review * Remove instructions to enable inject_facts_as_vars --------- Co-authored-by: Michał Nasiadka <michal@stackhpc.com> Co-authored-by: Matt Crees <mattc@stackhpc.com> Co-authored-by: Alex-Welsh <112560678+Alex-Welsh@users.noreply.github.com> Co-authored-by: Mark Goddard <mark@stackhpc.com>
1 parent 5d66109 commit c872280

File tree

6 files changed

+205
-0
lines changed

6 files changed

+205
-0
lines changed

‎doc/source/configuration/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ the various features provided.
1818
wazuh
1919
vault
2020
magnum-capi
21+
security-hardening

‎doc/source/configuration/security-hardening.rst‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
==================
2+
Security Hardening
3+
==================
4+
5+
CIS Benchmark Hardening
6+
-----------------------
7+
8+
The roles from the `Ansible-Lockdown <https://github.com/ansible-lockdown>`_
9+
project are used to harden hosts in accordance with the CIS benchmark criteria.
10+
It won't get your benchmark score to 100%, but should provide a significant
11+
improvement over an unhardened system. A typical score would be 70%.
12+
13+
The following operating systems are supported:
14+
15+
- Rocky 8, RHEL 8, CentOS Stream 8
16+
- Ubuntu 22.04
17+
- Rocky 9
18+
19+
Configuration
20+
--------------
21+
22+
Some overrides to the role defaults are provided in
23+
``$KAYOBE_CONFIG_PATH/inventory/group_vars/overcloud/cis``. These may not be
24+
suitable for all deployments and so some fine tuning may be required. For
25+
instance, you may want different rules on a network node compared to a
26+
controller. It is best to consult the upstream role documentation for details
27+
about what each variable does. The documentation can be found here:
28+
29+
- `Rocky 8, RHEL 8, CentOS Stream 8 <https://github.com/ansible-lockdown/RHEL8-CIS/tree/1.3.0>`__
30+
- `Ubuntu 22.04 <https://github.com/ansible-lockdown/UBUNTU22-CIS>`__
31+
- `Rocky 9 <https://github.com/ansible-lockdown/RHEL9-CIS>`__
32+
33+
Running the playbooks
34+
---------------------
35+
36+
As there is potential for unintended side effects when applying the hardening
37+
playbooks, the playbooks are not currently enabled by default. It is recommended
38+
that they are first applied to a representative staging environment to determine
39+
whether or not workloads or API requests are affected by any configuration changes.
40+
41+
.. code-block:: console
42+
43+
kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/cis.yml
44+

‎etc/kayobe/ansible/cis.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,31 @@
44
hosts: overcloud
55
become: true
66
tasks:
7+
- name: Ensure the cron package is installed on ubuntu
8+
package:
9+
name: cron
10+
state: present
11+
when: ansible_facts.distribution == 'Ubuntu'
12+
713
- name: Remove /etc/motd
814
# See remediation in:
915
# https://github.com/wazuh/wazuh/blob/bfa4efcf11e288c0a8809dc0b45fdce42fab8e0d/ruleset/sca/centos/8/cis_centos8_linux.yml#L777
1016
file:
1117
path: /etc/motd
1218
state: absent
19+
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'
1320

1421
- include_role:
1522
name: ansible-lockdown.rhel8_cis
23+
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'
24+
tags: always
25+
26+
- include_role:
27+
name: ansible-lockdown.rhel9_cis
28+
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '9'
29+
tags: always
30+
31+
- include_role:
32+
name: ansible-lockdown.ubuntu22_cis
33+
when: ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version == '22'
34+
tags: always

‎etc/kayobe/ansible/requirements.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,16 @@ roles:
1515
- name: ansible-lockdown.rhel8_cis
1616
src: https://github.com/ansible-lockdown/RHEL8-CIS
1717
version: 1.3.0
18+
- name: ansible-lockdown.ubuntu22_cis
19+
src: https://github.com/ansible-lockdown//UBUNTU22-CIS
20+
#FIXME: Waiting for https://github.com/ansible-lockdown/UBUNTU22-CIS/pull/132
21+
# to be in a tagged release
22+
version: c91a1038fd218f727075d21b2d0880751322b162
23+
- name: ansible-lockdown.rhel9_cis
24+
src: https://github.com/ansible-lockdown/RHEL9-CIS
25+
#FIXME: Waiting for https://github.com/ansible-lockdown/RHEL9-CIS/pull/54
26+
# to be in a tagged release.
27+
version: 3525cb6aab12a3d1e34aa8432ed77dd76be6a44a
1828
- name: wazuh-ansible
1929
src: https://github.com/stackhpc/wazuh-ansible
2030
version: stackhpc

‎etc/kayobe/inventory/group_vars/overcloud/cis‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
---
2+
##############################################################################
3+
# Common CIS Hardening Configuration
4+
5+
# Enable collecting auditd logs
6+
update_audit_template: true
7+
8+
##############################################################################
9+
# RHEL 8 / Centos Stream 8 CIS Hardening Configuration
210

311
# NOTE: kayobe configures NTP. Do not clobber configuration.
412
rhel8cis_time_synchronization: skip
@@ -22,3 +30,121 @@ rhel8cis_crypto_policy: FIPS
2230
# from being displayed.
2331
rhel8cis_rule_1_8_1_1: false
2432
rhel8cis_rule_1_8_1_4: false
33+
34+
##############################################################################
35+
# Rocky 9 CIS Hardening Configuration
36+
37+
# Allow IP forwarding
38+
rhel9cis_is_router: true
39+
40+
# Skip configuration of chrony
41+
rhel9cis_rule_2_1_1: false
42+
rhel9cis_rule_2_1_2: false
43+
44+
# Skip configuration of the firewall
45+
rhel9cis_firewall: None
46+
rhel9cis_rule_3_4_1_2: false
47+
48+
# Don't configure selinux
49+
rhel9cis_selinux_disable: true
50+
51+
# NOTE: FUTURE breaks wazuh agent repo metadata download
52+
rhel9cis_crypto_policy: FIPS
53+
54+
# Skip package updates
55+
rhel9cis_rule_1_9: false
56+
57+
# Disable requirement for password when using sudo
58+
rhel9cis_rule_5_3_4: false
59+
60+
# Disable check for root password being set, we should be locking root passwords instead.
61+
# Please double-check yourself with: sudo passwd -S root
62+
rhel9cis_rule_5_6_6: false
63+
64+
# Configure log rotation to prevent audit logs from filling the disk
65+
rhel9cis_auditd:
66+
space_left_action: syslog
67+
action_mail_acct: root
68+
admin_space_left_action: halt
69+
max_log_file_action: rotate
70+
71+
# Max size of audit logs (MB)
72+
rhel9cis_max_log_file_size: 1024
73+
74+
##############################################################################
75+
# Ubuntu Jammy CIS Hardening Configuration
76+
77+
# Ubuntu 22 CIS configuration
78+
# Disable changing routing rules
79+
ubtu22cis_is_router: true
80+
81+
# Set Chrony as the time sync tool
82+
ubtu22cis_time_sync_tool: "chrony"
83+
84+
# Disable CIS from configuring the firewall
85+
ubtu22cis_firewall_package: "none"
86+
87+
# Stop CIS from installing Network Manager
88+
ubtu22cis_install_network_manager: false
89+
90+
# Set syslog service to journald
91+
ubtu22cis_syslog_service: journald
92+
93+
# Squashfs is compiled into the kernel
94+
ubtu22cis_rule_1_1_1_2: false
95+
96+
# This updates the system. Let's do this explicitly.
97+
ubtu22cis_rule_1_9: false
98+
99+
# Do not change Chrony Time servers
100+
ubtu22cis_rule_2_1_2_1: false
101+
102+
# Disable CIS from touching sudoers
103+
ubtu22cis_rule_5_3_4: false
104+
105+
# Add stack and kolla to allowed ssh users
106+
ubtu22cis_sshd:
107+
log_level: "INFO"
108+
max_auth_tries: 4
109+
ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
110+
macs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
111+
kex_algorithms: "curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256"
112+
client_alive_interval: 300
113+
client_alive_count_max: 3
114+
login_grace_time: 60
115+
max_sessions: 10
116+
allow_users: "kolla stack ubuntu"
117+
allow_groups: "kolla stack ubuntu"
118+
# This variable, if specified, configures a list of USER name patterns, separated by spaces, to prevent SSH access
119+
# for users whose user name matches one of the patterns. This is done
120+
# by setting the value of `DenyUsers` option in `/etc/ssh/sshd_config` file.
121+
# If an USER@HOST format will be used, the specified user will be restricted only on that particular host.
122+
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
123+
# For more info, see https://linux.die.net/man/5/sshd_config
124+
deny_users: ""
125+
# This variable, if specified, configures a list of GROUP name patterns, separated by spaces, to prevent SSH access
126+
# for users whose primary group or supplementary group list matches one of the patterns. This is done
127+
# by setting the value of `DenyGroups` option in `/etc/ssh/sshd_config` file.
128+
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
129+
# For more info, see https://linux.die.net/man/5/sshd_config
130+
deny_groups: ""
131+
132+
# Do not change /var/lib/docker permissions
133+
ubtu22cis_no_group_adjust: false
134+
ubtu22cis_no_owner_adjust: false
135+
136+
# Configure log rotation to prevent audit logs from filling the disk
137+
ubtu22cis_auditd:
138+
action_mail_acct: root
139+
space_left_action: syslog
140+
admin_space_left_action: halt
141+
max_log_file_action: rotate
142+
143+
# Max size of audit logs (MB)
144+
ubtu22cis_max_log_file_size: 1024
145+
146+
# Disable grub bootloader password. Requires overriding
147+
# ubtu22cis_bootloader_password_hash
148+
ubtu22cis_rule_1_4_1: false
149+
ubtu22cis_rule_1_4_3: false
150+
##############################################################################

‎releasenotes/notes/adds-cis-hardening-for-ubuntu-jammy-d9bf23a34c08f5be.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
features:
3+
- |
4+
Adds support for Ubuntu Jammy and Rocky 9 to the CIS benchmark hardening playbook:
5+
``cis.yml``. This playbook will need to be manually applied.

0 commit comments

Comments
 (0)