feat(security): add SCAP/STIG baseline hardening role

Port Modules/Security/secharden-scap-stig.sh.

Applies baseline STIG controls:
- GRUB config permission hardening (root:root, mode 0400), skipped on Pi
- Disable and purge autofs service
- Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds,
  sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf)
- Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd)
- Harden cron permissions (cron.allow 0600, cron.deny removed)
- Harden at permissions (at.allow 0600, at.deny removed)

This role is the seed for the full DISA STIG/CMMC compliance library.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

This commit is contained in:

mrcharles

2026-07-30 12:16:25 -05:00

parent af18104f7b

commit fa41137eb4

16 changed files with 137 additions and 0 deletions

roles/security_scap_stig/files/modprobe/jffs2.conf

View File

				`@@ -0,0 +1 @@`
				`install jffs2 /bin/true`