search

ansible-lockdown / RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
https://ansible-lockdown.readthedocs.io
MIT License
113 stars 86 forks source link

Align RHEL9 hardening to RHEL8 to pass OpenSCAP check #153

Closed jLemmings closed 6 months ago

jLemmings commented 8 months ago

Overall Review of Changes: OpenSCAP checks if the sudo logfile definition exists in /etc/sudoers. If the path is wrapped with quotes the check fails. The RHEL8 CIS task does it without quotes: https://github.com/ansible-lockdown/RHEL8-CIS/blob/devel/tasks/section_5/cis_5.3.x.yml#L35

image

Issue Fixes: No open issue.

Enhancements: OpenSCAP will accept the hardening.

How has this been tested?: N/A

jLemmings commented 7 months ago

@uk-bolly Any comment regarding this PR?

uk-bolly commented 7 months ago

hi @jLemmings

Thank you for taking the time to raise this PR. While openscap may not need quotes, CIS does ask for it to be quoted. We often find that many scanners are very brittle in checks not allowing for differing ways of doing things. While this may fix the openscap scan it may break another scan for someone else. So we choose to adhere to documented control. Unfortunatley for this reason, we will leave as it current is, or we end up trying to make the code fit all the different scanner out there. I hope that makes sense.

many thanks once again

uk-bolly

uk-bolly commented 6 months ago

closing PR as unable to complete, different scanners looking for different restrictive values, unable to accomodate all. Written as close to documented controls