rosshamilton1 / cissec

Kickstart profiles for CentOS 7 to help meet CIS benchmarks + shell script to audit

Files:

centos7-cis.ks

minimal.ks

cis-audit

centos7-cis.ks: kickstart file for CentOS 7, aims to provide a starting point for a Linux admin to build a host which meets the CIS CentOS 7 benchmarks

minimal.ks: A minimal kickstart file is provided so people can test their setup (PXE/DHCP etc) with a minimal amount of configuration going on.

cis-audit: A bash script to audit whether a host conforms to the CIS benchmarks.

Aforementioned CIS benchmarks should be able to be found here https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_7_Benchmark_v1.1.0.pdf

I'm not affliated with the Center for Internet Security in any way. Use any material from this repository at your own risk.

centos7-cis.ks will need extensive customising to suit a particular user's environment. There's a lot of config in there because it suits me. e.g. CIS 6.4 /etc/securetty, change it to suit yourself.

Feel free to get in touch about this. Particularly with any errors or bugs!

Ross Hamilton <ross.x.hamilton AT gmail.com>

cissec's Issues

Grub Password

Hello,
What is the default grub password for the kickstart script

set superusers="bootuser" password_pbkdf2 bootuser grub.pbkdf2.sha512.10000.FE4D934335A0A9CB1B8E748713D1BDE766BB4041DEB297DB11674A1270BFC9B934C054B1BFEE8839AF9AE7DAD1F70D34D919FB617F09606636AC0EBE680F48FF.E01B493CA2F06BB62E03164F97FC98D6DB6A61BA5603DB299F98B5A08DE519C48730ECBBA0EB86BCE0DCFB02AF4C6EE19D9DF17F214CAE502D2078B4B8C59AC7
Thank you

Hangs

I have tried your script on a new Centos 7 build from PXE boot and it hangs at "Running Post-Installation scripts" and never completes (left it overnight). Any ideas?

CIS Updated to v2.1.0

The benchmark was updated, any plans to update this repo too?