leo/ansible-linux-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
Riedel
2026-08-19 09:51:43 +02:00
commit d777c1e975
79 changed files with 2263 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
roles/cis_hardening/templates/audit-baseline.rules.j2 Normal file
View File

@@ -0,0 +1,19 @@
# {{ ansible_managed }}
-D
-b 8192
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity
-w /home/{{ breakglass_username }} -p rwxa -k breakglass-usage
-e 2

9
roles/cis_hardening/templates/audit-level2.rules.j2 Normal file
View File

@@ -0,0 +1,9 @@
# {{ ansible_managed }}
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EACCES -F auid>=1000 -F auid!=unset -k access-denied
-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=unset -k access-denied
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k mounts
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules