From fa41137eb457c851a464a0123ccca0863e76e815 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Thu, 30 Jul 2026 12:16:25 -0500
Subject: [PATCH] feat(security): add SCAP/STIG baseline hardening role
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port Modules/Security/secharden-scap-stig.sh.

Applies baseline STIG controls:
- GRUB config permission hardening (root:root, mode 0400), skipped on Pi
- Disable and purge autofs service
- Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds,
  sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf)
- Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd)
- Harden cron permissions (cron.allow 0600, cron.deny removed)
- Harden at permissions (at.allow 0600, at.deny removed)

This role is the seed for the full DISA STIG/CMMC compliance library.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
---
 roles/security_scap_stig/files/banners/issue  |   5 +
 .../files/banners/issue.net                   |   5 +
 roles/security_scap_stig/files/banners/motd   |   5 +
 .../files/modprobe/cramfs.conf                |   1 +
 .../files/modprobe/dccp.conf                  |   1 +
 .../files/modprobe/freevxfs.conf              |   1 +
 .../files/modprobe/hfs.conf                   |   1 +
 .../files/modprobe/hfsplus.conf               |   1 +
 .../files/modprobe/jffs2.conf                 |   1 +
 .../files/modprobe/rds.conf                   |   1 +
 .../files/modprobe/sctp.conf                  |   1 +
 .../files/modprobe/squashfs.conf              |   1 +
 .../files/modprobe/tipc.conf                  |   1 +
 .../files/modprobe/udf.conf                   |   1 +
 .../files/modprobe/usb_storage.conf           |   1 +
 roles/security_scap_stig/tasks/main.yml       | 110 ++++++++++++++++++
 16 files changed, 137 insertions(+)
 create mode 100644 roles/security_scap_stig/files/banners/issue
 create mode 100644 roles/security_scap_stig/files/banners/issue.net
 create mode 100644 roles/security_scap_stig/files/banners/motd
 create mode 100644 roles/security_scap_stig/files/modprobe/cramfs.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/dccp.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/freevxfs.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/hfs.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/hfsplus.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/jffs2.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/rds.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/sctp.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/squashfs.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/tipc.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/udf.conf
 create mode 100644 roles/security_scap_stig/files/modprobe/usb_storage.conf
 create mode 100644 roles/security_scap_stig/tasks/main.yml

diff --git a/roles/security_scap_stig/files/banners/issue b/roles/security_scap_stig/files/banners/issue
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/issue
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/banners/issue.net b/roles/security_scap_stig/files/banners/issue.net
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/issue.net
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/banners/motd b/roles/security_scap_stig/files/banners/motd
new file mode 100644
index 0000000..42b3729
--- /dev/null
+++ b/roles/security_scap_stig/files/banners/motd
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
diff --git a/roles/security_scap_stig/files/modprobe/cramfs.conf b/roles/security_scap_stig/files/modprobe/cramfs.conf
new file mode 100644
index 0000000..b77c93a
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/cramfs.conf
@@ -0,0 +1 @@
+install cramfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/dccp.conf b/roles/security_scap_stig/files/modprobe/dccp.conf
new file mode 100644
index 0000000..d453550
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/dccp.conf
@@ -0,0 +1 @@
+install dccp /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/freevxfs.conf b/roles/security_scap_stig/files/modprobe/freevxfs.conf
new file mode 100644
index 0000000..72d4aec
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/freevxfs.conf
@@ -0,0 +1 @@
+install freevxfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/hfs.conf b/roles/security_scap_stig/files/modprobe/hfs.conf
new file mode 100644
index 0000000..a991f49
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/hfs.conf
@@ -0,0 +1 @@
+install hfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/hfsplus.conf b/roles/security_scap_stig/files/modprobe/hfsplus.conf
new file mode 100644
index 0000000..9cba83f
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/hfsplus.conf
@@ -0,0 +1 @@
+install hfsplus /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/jffs2.conf b/roles/security_scap_stig/files/modprobe/jffs2.conf
new file mode 100644
index 0000000..63360f3
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/jffs2.conf
@@ -0,0 +1 @@
+install jffs2 /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/rds.conf b/roles/security_scap_stig/files/modprobe/rds.conf
new file mode 100644
index 0000000..650abee
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/rds.conf
@@ -0,0 +1 @@
+install rds /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/sctp.conf b/roles/security_scap_stig/files/modprobe/sctp.conf
new file mode 100644
index 0000000..960a200
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/sctp.conf
@@ -0,0 +1 @@
+install sctp /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/squashfs.conf b/roles/security_scap_stig/files/modprobe/squashfs.conf
new file mode 100644
index 0000000..c177037
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/squashfs.conf
@@ -0,0 +1 @@
+install squashfs /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/tipc.conf b/roles/security_scap_stig/files/modprobe/tipc.conf
new file mode 100644
index 0000000..260e2ad
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/tipc.conf
@@ -0,0 +1 @@
+install tipc /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/udf.conf b/roles/security_scap_stig/files/modprobe/udf.conf
new file mode 100644
index 0000000..4894688
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/udf.conf
@@ -0,0 +1 @@
+install udf /bin/true
diff --git a/roles/security_scap_stig/files/modprobe/usb_storage.conf b/roles/security_scap_stig/files/modprobe/usb_storage.conf
new file mode 100644
index 0000000..38a1e49
--- /dev/null
+++ b/roles/security_scap_stig/files/modprobe/usb_storage.conf
@@ -0,0 +1 @@
+install usb-storage /bin/true
diff --git a/roles/security_scap_stig/tasks/main.yml b/roles/security_scap_stig/tasks/main.yml
new file mode 100644
index 0000000..fce8692
--- /dev/null
+++ b/roles/security_scap_stig/tasks/main.yml
@@ -0,0 +1,110 @@
+---
+# SCAP/STIG baseline hardening — port of Modules/Security/secharden-scap-stig.sh.
+
+# --- GRUB permission hardening (skip on Raspberry Pi) ---
+- name: Harden /boot/grub/grub.cfg permissions (non-Pi only)
+  ansible.builtin.file:
+    path: /boot/grub/grub.cfg
+    owner: root
+    group: root
+    mode: "0400"
+  when: not (is_raspi | bool)
+  failed_when: false
+
+# --- Disable and purge autofs ---
+- name: Disable autofs
+  ansible.builtin.systemd:
+    name: autofs
+    enabled: false
+    state: stopped
+  failed_when: false
+
+- name: Purge autofs package
+  ansible.builtin.apt:
+    name: autofs
+    state: absent
+    purge: true
+  failed_when: false
+
+# --- Kernel module blacklisting (modprobe.d) ---
+- name: Deploy modprobe blacklists
+  ansible.builtin.copy:
+    src: "modprobe/{{ item }}"
+    dest: "/etc/modprobe.d/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - usb_storage.conf
+    - dccp.conf
+    - rds.conf
+    - sctp.conf
+    - tipc.conf
+    - cramfs.conf
+    - freevxfs.conf
+    - hfs.conf
+    - hfsplus.conf
+    - jffs2.conf
+    - squashfs.conf
+    - udf.conf
+
+# --- Login banners ---
+- name: Deploy login banners
+  ansible.builtin.copy:
+    src: "banners/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - {src: issue, dest: /etc/issue}
+    - {src: issue.net, dest: /etc/issue.net}
+    - {src: motd, dest: /etc/motd}
+
+# --- cron permissions ---
+- name: Remove /etc/cron.deny if present
+  ansible.builtin.file:
+    path: /etc/cron.deny
+    state: absent
+
+- name: Ensure /etc/cron.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/cron.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve
+
+- name: Harden cron system paths
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    mode: "{{ item.mode }}"
+    owner: root
+    group: root
+  loop:
+    - {path: /etc/crontab, mode: "0600"}
+    - {path: /etc/cron.hourly, mode: "0700"}
+    - {path: /etc/cron.daily, mode: "0700"}
+    - {path: /etc/cron.weekly, mode: "0700"}
+    - {path: /etc/cron.monthly, mode: "0700"}
+    - {path: /etc/cron.d, mode: "0700"}
+
+# --- at permissions ---
+- name: Remove /etc/at.deny if present
+  ansible.builtin.file:
+    path: /etc/at.deny
+    state: absent
+
+- name: Ensure /etc/at.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/at.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve