feat(security): add SCAP/STIG baseline hardening role

Port Modules/Security/secharden-scap-stig.sh. Applies baseline STIG controls: - GRUB config permission hardening (root:root, mode 0400), skipped on Pi - Disable and purge autofs service - Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds, sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf) - Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd) - Harden cron permissions (cron.allow 0600, cron.deny removed) - Harden at permissions (at.allow 0600, at.deny removed) This role is the seed for the full DISA STIG/CMMC compliance library. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
2026-07-30 12:16:25 -05:00
parent af18104f7b
commit fa41137eb4
16 changed files with 137 additions and 0 deletions
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1,5 @@
+This system is the property of Known Element Enterprises LLC.
+
+Authorized uses only. All activity may be monitored and reported.
+
+All activities subject to monitoring/recording/review in real time and/or at a later time.
@@ -0,0 +1 @@
+install cramfs /bin/true
@@ -0,0 +1 @@
+install dccp /bin/true
@@ -0,0 +1 @@
+install freevxfs /bin/true
@@ -0,0 +1 @@
+install hfs /bin/true
@@ -0,0 +1 @@
+install hfsplus /bin/true
@@ -0,0 +1 @@
+install jffs2 /bin/true
@@ -0,0 +1 @@
+install rds /bin/true
@@ -0,0 +1 @@
+install sctp /bin/true
@@ -0,0 +1 @@
+install squashfs /bin/true
@@ -0,0 +1 @@
+install tipc /bin/true
@@ -0,0 +1 @@
+install udf /bin/true
@@ -0,0 +1 @@
+install usb-storage /bin/true
@@ -0,0 +1,110 @@
+---
+# SCAP/STIG baseline hardening — port of Modules/Security/secharden-scap-stig.sh.
+
+# --- GRUB permission hardening (skip on Raspberry Pi) ---
+- name: Harden /boot/grub/grub.cfg permissions (non-Pi only)
+  ansible.builtin.file:
+    path: /boot/grub/grub.cfg
+    owner: root
+    group: root
+    mode: "0400"
+  when: not (is_raspi | bool)
+  failed_when: false
+
+# --- Disable and purge autofs ---
+- name: Disable autofs
+  ansible.builtin.systemd:
+    name: autofs
+    enabled: false
+    state: stopped
+  failed_when: false
+
+- name: Purge autofs package
+  ansible.builtin.apt:
+    name: autofs
+    state: absent
+    purge: true
+  failed_when: false
+
+# --- Kernel module blacklisting (modprobe.d) ---
+- name: Deploy modprobe blacklists
+  ansible.builtin.copy:
+    src: "modprobe/{{ item }}"
+    dest: "/etc/modprobe.d/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - usb_storage.conf
+    - dccp.conf
+    - rds.conf
+    - sctp.conf
+    - tipc.conf
+    - cramfs.conf
+    - freevxfs.conf
+    - hfs.conf
+    - hfsplus.conf
+    - jffs2.conf
+    - squashfs.conf
+    - udf.conf
+
+# --- Login banners ---
+- name: Deploy login banners
+  ansible.builtin.copy:
+    src: "banners/{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  loop:
+    - {src: issue, dest: /etc/issue}
+    - {src: issue.net, dest: /etc/issue.net}
+    - {src: motd, dest: /etc/motd}
+
+# --- cron permissions ---
+- name: Remove /etc/cron.deny if present
+  ansible.builtin.file:
+    path: /etc/cron.deny
+    state: absent
+
+- name: Ensure /etc/cron.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/cron.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve
+
+- name: Harden cron system paths
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    mode: "{{ item.mode }}"
+    owner: root
+    group: root
+  loop:
+    - {path: /etc/crontab, mode: "0600"}
+    - {path: /etc/cron.hourly, mode: "0700"}
+    - {path: /etc/cron.daily, mode: "0700"}
+    - {path: /etc/cron.weekly, mode: "0700"}
+    - {path: /etc/cron.monthly, mode: "0700"}
+    - {path: /etc/cron.d, mode: "0700"}
+
+# --- at permissions ---
+- name: Remove /etc/at.deny if present
+  ansible.builtin.file:
+    path: /etc/at.deny
+    state: absent
+
+- name: Ensure /etc/at.allow exists with STIG permissions
+  ansible.builtin.file:
+    path: /etc/at.allow
+    state: touch
+    owner: root
+    group: root
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve