ansible-lockdown / rhel7-cis-audit

Audit configurations for RHEL7 CIS

RHEL/CentOS 7 Goss config

Overview

based on CIS 3.1.1

Set of configuration files and directories to run the first stages of CIS of RHEL/CentOS 7 servers

This is configured in a directory structure level.

This could do with further testing but sections 1.x should be complete

Goss is run based on the goss.yml file in the top level directory. This specifies the configuration.

Join us

On our Discord Server to ask questions, discuss features, or just chat with other Ansible-Lockdown users

Requirements

You must have goss available to your host you would like to test.

You must have sudo/root access to the system as some commands require privilege information.

Assuming you have already clone this repository you can run goss from where you wish.

Please refer to the audit documentation for usage.

• Audit Documents

This also works alongside the Ansible Lockdown RHEL7-CIS role

Which will:

• install
• audit
• remediate
• audit

variables

these are found in vars/cis.yml Please refer to the file for all options and their meanings

CIS listed variable for every control/benchmark can be turned on/off or section

• other controls enable_selinux run_heavy_tasks

• bespoke options If a site has specific options e.g. password complexity these can also be set.

Usage

You must have goss available to your host you would like to test.

You must have root access to the system as some commands require privilege information.

• Run as root not sudo due to sudo and shared memory access

Assuming you have already clone this repository you can run goss from where you wish.

• full check

# {{path to your goss binary}} --vars {{ path to the vars file }} -g {{path to your clone of this repo }}/goss.yml --validate

example:

# /usr/local/bin/goss --vars ../vars/cis.yml -g /home/bolly/rh7_cis_goss/goss.yml validate
......FF....FF................FF...F..FF.............F........................FSSSS.............FS.F.F.F.F.........FFFFF....

Failures/Skipped:

Title: 1.6.1 Ensure core dumps are restricted (Automated)_sysctl
Command: suid_dumpable_2: exit-status:
Expected
    <int>: 1
to equal
    <int>: 0
Command: suid_dumpable_2: stdout: patterns not found: [fs.suid_dumpable = 0]


Title: 1.4.2 Ensure filesystem integrity is regularly checked (Automated)
Service: aidecheck: enabled:
Expected
    <bool>: false
to equal
    <bool>: true
Service: aidecheck: running:
Expected
    <bool>: false
to equal
    <bool>: true

< ---------cut ------- >

Title: 1.1.22 Ensure sticky bit is set on all world-writable directories
Command: version: exit-status:
Expected
    <int>: 0
to equal
    <int>: 123

Total Duration: 5.102s
Count: 124, Failed: 21, Skipped: 5

• running a particular section of tests

# /usr/local/bin/goss -g /home/bolly/rh7_cis_goss/section_1/cis_1.1/cis_1.1.22.yml  validate
............

Total Duration: 0.033s
Count: 12, Failed: 0, Skipped: 0

• changing the output

# /usr/local/bin/goss -g /home/bolly/rh7_cis_goss/section_1/cis_1.1/cis_1.1.22.yml  validate -f documentation
Title: 1.1.20 Check for removeable media nodev
Command: floppy_nodev: exit-status: matches expectation: [0]
Command: floppy_nodev: stdout: matches expectation: [OK]
< -------cut ------- >
Title: 1.1.20 Check for removeable media noexec
Command: floppy_noexec: exit-status: matches expectation: [0]
Command: floppy_noexec: stdout: matches expectation: [OK]


Total Duration: 0.022s
Count: 12, Failed: 0, Skipped: 0

Variables

The variable files

sections_2/service.yml allows you to tune it further for specific environments.

In this case installed or skipped using the standard name for a package to be installed or _skip to skip a test.

Extra settings

Some sections can have several options in that case the skip flag maybe passed to the test. e.g.

• section_1/cis/1.8 - need to review the MOTD and issue files for bespoke content
• section_1/cis_1.10/cis_1.10.yml - Has gdm either not installed or configured default to not installed and skipped configured.
• section_2/cis_2.2/cis_chrony_2.2.1.1.yml - this is chosen between ntp of chrony in the goss file

further information

• goss documentation
• CIS standards

Outstanding

• 3.5.3.1.x - iptables and ip6tables not completed although not rh7 default fw
• manual or not scored tasks are not included

rhel7-cis-audit's Issues

if conditions needs before related code block

When exluding a rule like 1.1.2, because I haven't a separate /tmp Partition, the Audit Playbook can't parse output, because "/tmp" mount is not found on system.

mount:
  /tmp:
  {{ if .Vars.rhel7cis_rule_1_1_2 }}

Solution: Move condition before command or code block:

mount:
  {{ if .Vars.rhel7cis_rule_1_1_2 }}
  /tmp:

multiple files are affected.

AND condition are not working as expected

If first condition is true and second condition is false, result is true and code block will be executed:
{{ if ((.Vars.rhel7cis_config_aide) and .Vars.rhel7cis_level1) }}

I did not found a working solution (braces on different possitions), so I implemented a simple workaround with just multiple if conditions:

{{ if .Vars.rhel7cis_config_aide }}
{{ if .Vars.rhel7cis_level1 }}

Missing meta/main.yml causes galaxy-install to fail

Describe the Issue
This role does not appear to have a meta/main.yml file.

Expected Behavior
Starting galaxy role install process

changing role RHEL7_cis_audit from to unspecified
Actual Behavior
[WARNING]: - RHEL7-CIS-Audit was NOT installed successfully: this role does not appear to have a meta/main.yml file.

Control(s) Affected
Using it in a project.

Environment (please complete the following information):

not relevant here.

Additional Notes
Anything additional goes here

Possible Solution
Add file meta/main.yml.

Audit can only be run via ./run_audit.sh

Sorry if the question is invalid. It's my first time using goss and I'm trying to test using this repo

When running goss, it is claiming that I'm missing a variable

/usr/local/bin/goss --vars /tmp/CIS.yml -g RHEL7-CIS-Audit/goss.yml validate
Error: template: test:46:38: executing "test" at <.Vars.machine_uuid>: map has no entry for key "machine_uuid"

This is based on a pure clone of this repo and a copy of CIS.yml

Looking around, I noticed that ./run_audit.sh is setting the requested variables, but this is not mentioned in the readme.

Is this the expected way to use this repo?

I did experiment is setting the variables in the places expected by that script, but I'm having to read through the code to see what it expects so it's not ideal.

Expected Behavior

The commands to use this repo mentioned in the readme should work