Skip to content

Commit d040e09

Browse files
jovialjovial
committed
Adds Ubuntu Jammy CIS benchmark hardening playbooks
Co-authored-by: "Dawud <[email protected]>"
1 parent b0fbc2d commit d040e09

File tree

6 files changed

+153
-0
lines changed

6 files changed

+153
-0
lines changed

‎doc/source/configuration/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ the various features provided.
1818
wazuh
1919
vault
2020
magnum-capi
21+
security

‎doc/source/configuration/security.rst

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
==================
2+
Security Hardening
3+
==================
4+
5+
CIS Benchmark Hardening
6+
-----------------------
7+
8+
The roles from the `Ansible-Lockdown <https://github.com/ansible-lockdown>`_
9+
project are used to harden hosts in accordance with the CIS benchmark criteria.
10+
It won't get your benchmark score to 100%, but should provide a significant
11+
improvement over an unhardened system. The following operating systems are
12+
supported:
13+
14+
- Rocky 8, RHEL 8, CentOS Stream 8
15+
- Ubuntu 22.04
16+
17+
18+
Configuration
19+
--------------
20+
21+
Some overrides to the role defaults are provided in
22+
``$KAYOBE_CONFIG_PATH/inventory/group_vars/overcloud/cis``. These may not be
23+
suitable for all deployments and so some fine tuning may be required. For
24+
instance, you may want different rules on a network node compared to a
25+
controller. It is best to consult the upstream role documentation for details
26+
about what each variable does. The documentation can be found here:
27+
28+
- `Rocky 8, RHEL 8, CentOS Stream 8 <https://github.com/ansible-lockdown/RHEL8-CIS/tree/1.3.0>`__
29+
- `Ubuntu 22.04 <https://github.com/ansible-lockdown/UBUNTU22-CIS>`__
30+
31+
32+
Running the playbooks
33+
---------------------
34+
35+
As there is potential for unintended side effects when applying the hardening
36+
playbooks, the playbooks are not currently enabled by default. It is recommended
37+
that they are first applied to a representative staging environment to determine
38+
whether or not workloads or API requests are affected by any configuration changes.
39+
40+
The upstream roles do not currently support using
41+
`INJECT_FACTS_AS_VARS=False <https://docs.ansible.com/ansible/latest/reference_appendices/config.html#inject-facts-as-vars>`
42+
so you must enable this feature to be able to run the playbooks. This an be done on
43+
an adhoc basis using the environment variable. An example of how of to do that is
44+
shown below:
45+
46+
.. code-block:: console
47+
48+
ANSIBLE_INJECT_FACT_VARS=True kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/cis.yml
49+

‎etc/kayobe/ansible/cis.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,26 @@
44
hosts: overcloud
55
become: true
66
tasks:
7+
- name: Ensure the cron package is installed on ubuntu
8+
package:
9+
name: cron
10+
state: present
11+
when: ansible_facts.distribution == 'Ubuntu'
12+
713
- name: Remove /etc/motd
814
# See remediation in:
915
# https://github.com/wazuh/wazuh/blob/bfa4efcf11e288c0a8809dc0b45fdce42fab8e0d/ruleset/sca/centos/8/cis_centos8_linux.yml#L777
1016
file:
1117
path: /etc/motd
1218
state: absent
19+
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'
1320

1421
- include_role:
1522
name: ansible-lockdown.rhel8_cis
23+
when: ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '8'
24+
tags: always
25+
26+
- include_role:
27+
name: ansible-lockdown.ubuntu22_cis
28+
when: ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version == '22'
29+
tags: always

‎etc/kayobe/ansible/requirements.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ roles:
1111
- name: ansible-lockdown.rhel8_cis
1212
src: https://github.com/ansible-lockdown/RHEL8-CIS
1313
version: 1.3.0
14+
- name: ansible-lockdown.ubuntu22_cis
15+
src: https://github.com/ansible-lockdown/UBUNTU22-CIS
16+
version: 1.2.0
1417
- name: wazuh-ansible
1518
src: https://github.com/stackhpc/wazuh-ansible
1619
version: stackhpc

‎etc/kayobe/inventory/group_vars/overcloud/cis

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
---
2+
##############################################################################
3+
# RHEL 8 / Centos Stream 8 CIS Hardening Configuration
24

35
# NOTE: kayobe configures NTP. Do not clobber configuration.
46
rhel8cis_time_synchronization: skip
@@ -22,3 +24,82 @@ rhel8cis_crypto_policy: FIPS
2224
# from being displayed.
2325
rhel8cis_rule_1_8_1_1: false
2426
rhel8cis_rule_1_8_1_4: false
27+
28+
##############################################################################
29+
# Ubuntu Jammy CIS Hardening Configuration
30+
31+
# Ubuntu 22 CIS configuration
32+
# Disable changing routing rules
33+
ubtu22cis_is_router: true
34+
35+
# Set Chrony as the time sync tool
36+
ubtu22cis_time_sync_tool: "chrony"
37+
38+
# Disable CIS from configuring the firewall
39+
ubtu22cis_firewall_package: "none"
40+
41+
# Stop CIS from installing Network Manager
42+
ubtu22cis_install_network_manager: false
43+
44+
# Set syslog service to journald
45+
ubtu22cis_syslog_service: journald
46+
47+
# Squashfs is compiled into the kernel
48+
ubtu22cis_rule_1_1_1_2: false
49+
50+
# This updates the system. Let's do this explicitly.
51+
ubtu22cis_rule_1_9: false
52+
53+
# Do not change Chrony Time servers
54+
ubtu22cis_rule_2_1_2_1: false
55+
56+
# Disable CIS from touching sudoers
57+
ubtu22cis_rule_5_3_4: false
58+
59+
# Add stack and kolla to allowed ssh users
60+
ubtu22cis_sshd:
61+
log_level: "INFO"
62+
max_auth_tries: 4
63+
ciphers: "[email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr"
64+
macs: "[email protected],[email protected],hmac-sha2-512,hmac-sha2-256"
65+
kex_algorithms: "curve25519-sha256,[email protected],diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256"
66+
client_alive_interval: 300
67+
client_alive_count_max: 3
68+
login_grace_time: 60
69+
max_sessions: 10
70+
allow_users: "kolla stack ubuntu"
71+
allow_groups: "kolla stack ubuntu"
72+
# This variable, if specified, configures a list of USER name patterns, separated by spaces, to prevent SSH access
73+
# for users whose user name matches one of the patterns. This is done
74+
# by setting the value of `DenyUsers` option in `/etc/ssh/sshd_config` file.
75+
# If an USER@HOST format will be used, the specified user will be restricted only on that particular host.
76+
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
77+
# For more info, see https://linux.die.net/man/5/sshd_config
78+
deny_users: ""
79+
# This variable, if specified, configures a list of GROUP name patterns, separated by spaces, to prevent SSH access
80+
# for users whose primary group or supplementary group list matches one of the patterns. This is done
81+
# by setting the value of `DenyGroups` option in `/etc/ssh/sshd_config` file.
82+
# The allow/deny directives process order: DenyUsers, AllowUsers, DenyGroups, AllowGroups.
83+
# For more info, see https://linux.die.net/man/5/sshd_config
84+
deny_groups: ""
85+
86+
# Do not change /var/lib/docker permissions
87+
ubtu22cis_no_group_adjust: false
88+
ubtu22cis_no_owner_adjust: false
89+
90+
# Enable collecting auditd logs
91+
update_audit_template: true
92+
93+
# Configure log rotation to prevent audit logs from filling the disk
94+
ubtu22cis_auditd:
95+
action_mail_acct: root
96+
space_left_action: syslog
97+
admin_space_left_action: halt
98+
max_log_file_action: rotate
99+
100+
# Disable grub bootloader password. Requires overriding
101+
# ubtu22cis_bootloader_password_hash
102+
ubtu22cis_rule_1_4_1: false
103+
ubtu22cis_rule_1_4_3: false
104+
105+
##############################################################################

‎releasenotes/notes/adds-cis-hardening-for-ubuntu-jammy-d9bf23a34c08f5be.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
features:
3+
- |
4+
Adds support for Ubuntu Jammy to the CIS benchmark hardening playbook:
5+
``cis.yml``. This playbook will need to be manually applied.

0 commit comments

Comments
 (0)