Skip to content

Commit 2cf8d51

Browse files
georgenalengeorgenalen
authored
Merge pull request #7 from ansible-lockdown/devel
RHEL8 STIG Version 1 Release 1 Signed-off-by: George Nalen <georgen@mindpointgroup.com>
2 parents f3bed6e + 58ee2ea commit 2cf8d51

7 files changed

Lines changed: 2593 additions & 432 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ RHEL 8 DISA STIG
55

66
Configure a RHEL 8 system to be DISA STIG compliant. All findings will be audited by default. Non-disruptive CAT I, CAT II, and CAT III findings will be corrected by default. Disruptive finding remediation can be enabled by setting `rhel8stig_disruption_high` to `yes`.
77

8-
This role is based on RHEL 8 DISA STIG: [Version 1, Rel .01 released on May 11, 2020](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_8_V1R0-1_IDraftSTIG.zip).
8+
This role is based on RHEL 8 DISA STIG: [Version 1, Rel 1 released on January 5, 2021](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_8_V1R1_STIG.zip).
99

1010
Requirements
1111
------------

‎defaults/main.yml‎

Lines changed: 160 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -49,40 +49,41 @@ system_is_ec2: false
4949
# CAT 1 rules
5050
rhel_08_010000: true
5151
rhel_08_010020: true
52-
rhel_08_010030: true
5352
rhel_08_010140: true
5453
rhel_08_010150: true
55-
rhel_08_010170: true
5654
rhel_08_010370: true
57-
rhel_08_010450: true
55+
rhel_08_010371: true
5856
rhel_08_010460: true
5957
rhel_08_010470: true
6058
rhel_08_010820: true
61-
rhel_08_010830: true
6259
rhel_08_020330: true
6360
rhel_08_040000: true
6461
rhel_08_040010: true
6562
rhel_08_040060: true
6663
rhel_08_040170: true
67-
rhel_08_040180: true
64+
rhel_08_040171: true
65+
rhel_08_040172: true
6866
rhel_08_040190: true
6967
rhel_08_040200: true
70-
rhel_08_040340: true
7168
rhel_08_040360: true
7269

7370
# CAT 2 rules
7471
rhel_08_010010: true
72+
rhel_08_010030: true
7573
rhel_08_010040: true
7674
rhel_08_010050: true
7775
rhel_08_010060: true
7876
rhel_08_010070: true
79-
rhel_08_010080: true
8077
rhel_08_010090: true
8178
rhel_08_010100: true
8279
rhel_08_010110: true
8380
rhel_08_010120: true
8481
rhel_08_010130: true
82+
rhel_08_010151: true
8583
rhel_08_010160: true
84+
rhel_08_010161: true
85+
rhel_08_010162: true
86+
rhel_08_010170: true
8687
rhel_08_010180: true
8788
rhel_08_010190: true
8889
rhel_08_010200: true
@@ -92,31 +93,45 @@ rhel_08_010230: true
9293
rhel_08_010240: true
9394
rhel_08_010250: true
9495
rhel_08_010260: true
95-
rhel_08_010270: true
96-
rhel_08_010280: true
9796
rhel_08_010290: true
97+
rhel_08_010291: true
98+
rhel_08_010293: true
99+
rhel_08_010294: true
100+
rhel_08_010295: true
98101
rhel_08_010300: true
99102
rhel_08_010310: true
100103
rhel_08_010320: true
101104
rhel_08_010330: true
102105
rhel_08_010340: true
103106
rhel_08_010350: true
104107
rhel_08_010360: true
105-
# !!!!!!!!!!!!!!!--------------!!!!!!!!!!!!!!!!!!CHANGE TO TRUE BEFORE FINALIZATION. SET TO FALSE TO PREVENT THE VAGRANT USER FROM AUTHENTICATING WHEN USING SUDO
108+
rhel_08_010372: true
109+
rhel_08_010373: true
110+
rhel_08_010374: true
111+
# !!!!!!!!!!!!!!!--------------!!!!!!!!!!!!!!!!!!CHANGE TO TRUE BEFORE FINALIZATION. SET TO FALSE TO PREVENT THE VAGRANT USER FROM AUTHENTICATING WHEN USING SUDO (380/381)
106112
rhel_08_010380: false
113+
rhel_08_010381: false
107114
rhel_08_010390: true
108115
rhel_08_010400: true
109116
rhel_08_010410: true
110117
rhel_08_010420: true
118+
rhel_08_010421: true
119+
rhel_08_010422: true
120+
rhel_08_010423: true
111121
rhel_08_010430: true
122+
rhel_08_010450: true
112123
rhel_08_010480: true
113124
rhel_08_010490: true
114125
rhel_08_010500: true
115126
rhel_08_010510: true
116127
rhel_08_010520: true
128+
rhel_08_010521: true
129+
rhel_08_010543: true
117130
rhel_08_010550: true
118131
rhel_08_010560: true
132+
rhel_08_010561: true
119133
rhel_08_010570: true
134+
rhel_08_010571: true
120135
rhel_08_010580: true
121136
rhel_08_010590: true
122137
rhel_08_010600: true
@@ -127,7 +142,12 @@ rhel_08_010640: true
127142
rhel_08_010650: true
128143
rhel_08_010660: true
129144
rhel_08_010670: true
130-
rhel_08_010680: false
145+
rhel_08_010671: true
146+
rhel_08_010672: true
147+
rhel_08_010673: true
148+
rhel_08_010674: true
149+
rhel_08_010675: true
150+
rhel_08_010680: true
131151
rhel_08_010690: true
132152
rhel_08_010700: true
133153
rhel_08_010710: true
@@ -140,11 +160,25 @@ rhel_08_010770: true
140160
rhel_08_010780: true
141161
rhel_08_010790: true
142162
rhel_08_010800: true
143-
rhel_08_010810: true
163+
rhel_08_010830: true
144164
rhel_08_020000: true
145165
rhel_08_020010: true
166+
rhel_08_020011: true
167+
rhel_08_020012: true
168+
rhel_08_020013: true
169+
rhel_08_020014: true
170+
rhel_08_020015: true
171+
rhel_08_020016: true
172+
rhel_08_020017: true
173+
rhel_08_020018: true
174+
rhel_08_020019: true
175+
rhel_08_020020: true
176+
rhel_08_020021: true
177+
rhel_08_020022: true
178+
rhel_08_020023: true
146179
rhel_08_020030: true
147180
rhel_08_020040: true
181+
rhel_08_020041: true
148182
rhel_08_020050: true
149183
rhel_08_020060: true
150184
rhel_08_020070: true
@@ -164,6 +198,7 @@ rhel_08_020200: true
164198
rhel_08_020210: true
165199
rhel_08_020220: true
166200
rhel_08_020230: true
201+
rhel_08_020231: true
167202
rhel_08_020240: true
168203
rhel_08_020250: true
169204
rhel_08_020260: true
@@ -174,25 +209,33 @@ rhel_08_020300: true
174209
rhel_08_020310: true
175210
rhel_08_020320: true
176211
rhel_08_020350: true
212+
rhel_08_020351: true
213+
rhel_08_020352: true
214+
rhel_08_020353: true
177215
rhel_08_030000: true
178216
rhel_08_030010: true
179217
rhel_08_030020: true
180218
rhel_08_030030: true
181219
rhel_08_030040: true
182220
rhel_08_030050: true
183221
rhel_08_030060: true
222+
rhel_08_030061: true
223+
rhel_08_030062: true
184224
rhel_08_030070: true
185225
rhel_08_030080: true
186226
rhel_08_030090: true
187227
rhel_08_030100: true
188228
rhel_08_030110: true
189-
### When logs folder is set to 600 per STIG auditd fails to start. Need to figure out perms
190229
rhel_08_030120: true
230+
rhel_08_030121: true
231+
rhel_08_030122: true
191232
rhel_08_030130: true
192233
rhel_08_030140: true
193234
rhel_08_030150: true
194235
rhel_08_030160: true
195236
rhel_08_030170: true
237+
rhel_08_030171: true
238+
rhel_08_030172: true
196239
rhel_08_030180: true
197240
rhel_08_030190: true
198241
rhel_08_030200: true
@@ -206,12 +249,26 @@ rhel_08_030270: true
206249
rhel_08_030280: true
207250
rhel_08_030290: true
208251
rhel_08_030300: true
252+
rhel_08_030301: true
253+
rhel_08_030302: true
209254
rhel_08_030310: true
255+
rhel_08_030311: true
256+
rhel_08_030312: true
257+
rhel_08_030313: true
258+
rhel_08_030314: true
259+
rhel_08_030315: true
260+
rhel_08_030316: true
261+
rhel_08_030317: true
210262
rhel_08_030320: true
211263
rhel_08_030330: true
212264
rhel_08_030340: true
213265
rhel_08_030350: true
214266
rhel_08_030360: true
267+
rhel_08_030361: true
268+
rhel_08_030362: true
269+
rhel_08_030363: true
270+
rhel_08_030364: true
271+
rhel_08_030365: true
215272
rhel_08_030370: true
216273
rhel_08_030380: true
217274
rhel_08_030390: true
@@ -240,7 +297,6 @@ rhel_08_030610: true
240297
rhel_08_030620: true
241298
rhel_08_030630: true
242299
rhel_08_030640: true
243-
# !!!!!!!!!---------- handlers are overwriting the config change for this item
244300
rhel_08_030650: true
245301
rhel_08_030660: true
246302
rhel_08_030670: true
@@ -251,45 +307,99 @@ rhel_08_030710: true
251307
rhel_08_030720: true
252308
rhel_08_030730: true
253309
rhel_08_030740: true
310+
rhel_08_040001: true
311+
rhel_08_040002: true
312+
rhel_08_040003: true
254313
rhel_08_040020: true
255314
rhel_08_040030: true
256-
rhel_08_040040: true
257-
rhel_08_040050: true
258315
rhel_08_040070: true
259316
rhel_08_040080: true
260317
rhel_08_040090: true
261318
rhel_08_040100: true
262319
rhel_08_040110: true
320+
rhel_08_040111: true
263321
rhel_08_040120: true
322+
rhel_08_040121: true
323+
rhel_08_040122: true
324+
rhel_08_040123: true
325+
rhel_08_040124: true
326+
rhel_08_040125: true
327+
rhel_08_040126: true
328+
rhel_08_040127: true
329+
rhel_08_040128: true
330+
rhel_08_040129: true
264331
rhel_08_040130: true
332+
rhel_08_040131: true
333+
rhel_08_040132: true
334+
rhel_08_040133: true
335+
rhel_08_040134: true
336+
rhel_08_040135: true
265337
rhel_08_040140: true
266338
rhel_08_040150: true
267339
rhel_08_040160: true
340+
rhel_08_040161: true
341+
rhel_08_040162: true
342+
rhel_08_040180: true
268343
rhel_08_040210: true
269344
rhel_08_040220: true
270345
rhel_08_040230: true
271346
rhel_08_040240: true
272347
rhel_08_040250: true
273348
rhel_08_040260: true
349+
rhel_08_040261: true
350+
rhel_08_040262: true
274351
rhel_08_040270: true
275352
rhel_08_040280: true
353+
rhel_08_040281: true
354+
rhel_08_040282: true
355+
rhel_08_040283: true
356+
rhel_08_040284: true
357+
rhel_08_040285: true
276358
rhel_08_040290: true
277359
rhel_08_040320: true
278360
rhel_08_040330: true
361+
rhel_08_040340: true
362+
rhel_08_040341: true
279363
rhel_08_040350: true
364+
rhel_08_040370: true
365+
rhel_08_040380: true
366+
rhel_08_040390: true
280367

281368
# CAT 3 rules
369+
rhel_08_010171: true
370+
rhel_08_010292: true
371+
rhel_08_010375: true
372+
rhel_08_010376: true
282373
rhel_08_010440: true
283-
rhel_08_010530: true
374+
rhel_08_010471: true
284375
rhel_08_010540: true
285-
rhel_08_020020: true
376+
rhel_08_010541: true
377+
rhel_08_010542: true
378+
rhel_08_020024: true
379+
rhel_08_020042: true
286380
rhel_08_020340: true
381+
rhel_08_030063: true
382+
rhel_08_030601: true
383+
rhel_08_030602: true
384+
rhel_08_030603: true
385+
rhel_08_030741: true
386+
rhel_08_030742: true
387+
rhel_08_040004: true
388+
rhel_08_040021: true
389+
rhel_08_040022: true
390+
rhel_08_040023: true
391+
rhel_08_040024: true
392+
rhel_08_040025: true
393+
rhel_08_040026: true
287394
rhel_08_040300: true
288395
rhel_08_040310: true
289396

290397
# Whether or not to run tasks related to auditing/patching the desktop environment
291398
rhel8stig_gui: false
292399

400+
# Whether or not you need kdump. False will disable service and true will leave service
401+
rhel8stig_kdump_needed: false
402+
293403
# Whether to configure dconf rules unconditionally (ignoring presence of dconf
294404
# or rhel8stig_gui)
295405
rhel8stig_always_configure_dconf: false
@@ -444,13 +554,15 @@ rhel8stig_pam_pwhistory:
444554
remember: 5
445555
retries: 3
446556

447-
# RHEL-08-010320
448-
# RHEL-08-010330
557+
# RHEL-08-020010
558+
# RHEL-08-020011
559+
# RHEL-08-020012
560+
# RHEL-08-020013
449561
# pam_faillock settings - accounts must be locked for max time period after 3 unsuccessful attempts within 15 minutes.
450562
rhel8stig_pam_faillock:
451563
attempts: 3
452564
interval: 900
453-
unlock_time: 900
565+
unlock_time: 0
454566
fail_for_root: yes
455567

456568
# RHEL-08-030670
@@ -493,7 +605,9 @@ rhel8stig_login_defaults:
493605
create_home: 'yes'
494606

495607
# RHEL-08-030690 uncomment and set the value to a remote IP address that can receive audit logs
496-
rhel8stig_audisp_remote_server: 10.10.10.10
608+
rhel8stig_remotelog_server:
609+
server: 10.10.10.10
610+
port: 9999
497611

498612
# RHEL-08-030020
499613
rhel8stig_auditd_mail_acct: root
@@ -531,8 +645,8 @@ rhel8stig_nfs_mounts_query: "[?starts_with(fstype, 'nfs')].mount"
531645

532646
# RHEL-08-010680
533647
rhel8stig_dns_servers:
534-
- 9.9.9.9
535-
- 149.112.112.112
648+
- 8.8.8.8
649+
- 8.8.4.4
536650

537651
rhel8stig_int_gid: 1000
538652

@@ -569,4 +683,25 @@ rhel8stig_custom_firewall_zone: "new_fw_zone"
569683
rhel8stig_white_list_services:
570684
- http
571685
- https
572-
- ssh
686+
- ssh
687+
688+
# RHEL-08-010290
689+
# RHEL-08-010290
690+
# This will be the MACs setting. It is a string that will be the entirety of the MAC's setting in the openssh.config file
691+
# to conform to STIG standard control RHEL-08-010290 this variable must include hmac-sha2-512,hmac-sha2-256
692+
# to conform to STIG standard control RHEL-08-010291 this variable must include aes256-ctr,aes192-ctr,aes128-ctr
693+
rhel8stig_ssh_macs_settings: "hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512
694+
GSSAPIKeyExchange no"
695+
# This will be the CRYPTO_POLICY settings in the opensshserver.conf file. It will be a string for the entirety of the setting
696+
# to conform to STIG standard control RHEL-08-010290 this variable must contain oCiphers=aes256-ctr,aes192-ctr,aes128-ctr -oMACS=hmac-sha2-512,hmac-sha2-256 settings
697+
# to conform to STIG standard control RHEL-08-010291 this variable must cotnain oCiphers=aes256-ctr,aes192-ctr,aes128-ctr
698+
rhel8stig_ssh_server_crypto_settings: "-oCiphers=aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com -oCASignatureAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512"
699+
700+
# RHEL-08-010295
701+
# This will be teh GnuTLS ecryption packages. The task sets the +VERS-ALL: setting, the only items needed are the DoD approved encryptions
702+
# to conform to STIG standards this variable must contain -VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0
703+
rhel8stig_gnutls_encryption: "-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0"
704+
705+
# RHEL-08-020070
706+
# This is the value for the tmux lock after setting. To conform to STIG standards value needs to be set to 900 or less
707+
rhel8stig_tmux_lock_after_time: 900

0 commit comments

Comments
 (0)