search

ansible-lockdown / RHEL7-CIS

Ansible role for Red Hat 7 CIS Baseline
https://ansible-lockdown.readthedocs.io/en/latest/
MIT License
473 stars 303 forks source link

Support for CentOS rule 1.2.1 and 1.2.2 #215

Closed jlosito closed 3 years ago

jlosito commented 3 years ago

I have a couple of CentOS 7 boxes in my garage I use this role against and notice that there's a couple of steps which get skipped but maybe should be executed. I believe the steps which get skipped, some are linked below, are compatible with both RHEL 7 and CentOS 7. The only steps I can think of off of the top of my head which would not be compatible are around the subscription manager.

https://github.com/ansible-lockdown/RHEL7-CIS/blob/devel/tasks/section_1/cis_1.2.x.yml#L7 https://github.com/ansible-lockdown/RHEL7-CIS/blob/devel/tasks/section_1/cis_1.2.x.yml#L19

I'm guessing these steps are skipped because the ansible_distribution is technically CentOS and not RedHat on my machines. 

$ ansible-playbook -i inventory/hosts cis.yml --limit myhost --tags rule_1.2.2
...
...
TASK [rhel7-cis : MANUAL| 1.2.2 | Ensure package manager repositories are configured] **********************************
skipping: [myhost]

Step 1.2.2 should be compatible on a CentOS 7 box since all it's doing is running a yum repolist. Step 1.2.1 on the other hand might be slightly different on a CentOS box. I believe these would be the equivalent keys that are being checked for a RHEL 7 machine.

$ find /etc/pki/rpm-gpg/ -name '*RPM-GPG-KEY*' -type f
/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Debug-7
/etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-Testing-7

The comment linked below from another contributor states that the intention of this role is for it to be compatible with CentOS 7 as much as possible if I'm reading it correctly. If so, can we add something like when: (ansible_distribution == "RedHat") or (ansible_distribution == "CentOS") to rule 1.2.2 for now?

https://github.com/ansible-lockdown/RHEL7-CIS/issues/84#issuecomment-373838460

uk-bolly commented 3 years ago

Hi @jlosito

Thanks for highlighting this, i have added ability for 1.2.1 to look at CentOS and also 1.2.2 is now also outputting the findings. Both of these are classed as manual steps, these we cover by outputting any findings if needed so they can be checked against site specific documented settings that they would need to adhere to.

regards

uk-bolly

jlosito commented 3 years ago

@uk-bolly @georgenalen I guess I'll close this ticket out since the fix has been merged.