mrcharles
fa41137eb4
Port Modules/Security/secharden-scap-stig.sh. Applies baseline STIG controls: - GRUB config permission hardening (root:root, mode 0400), skipped on Pi - Disable and purge autofs service - Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds, sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf) - Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd) - Harden cron permissions (cron.allow 0600, cron.deny removed) - Harden at permissions (at.allow 0600, at.deny removed) This role is the seed for the full DISA STIG/CMMC compliance library. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
111 lines
2.5 KiB
YAML
111 lines
2.5 KiB
YAML
---
|
|
# SCAP/STIG baseline hardening — port of Modules/Security/secharden-scap-stig.sh.
|
|
|
|
# --- GRUB permission hardening (skip on Raspberry Pi) ---
|
|
- name: Harden /boot/grub/grub.cfg permissions (non-Pi only)
|
|
ansible.builtin.file:
|
|
path: /boot/grub/grub.cfg
|
|
owner: root
|
|
group: root
|
|
mode: "0400"
|
|
when: not (is_raspi | bool)
|
|
failed_when: false
|
|
|
|
# --- Disable and purge autofs ---
|
|
- name: Disable autofs
|
|
ansible.builtin.systemd:
|
|
name: autofs
|
|
enabled: false
|
|
state: stopped
|
|
failed_when: false
|
|
|
|
- name: Purge autofs package
|
|
ansible.builtin.apt:
|
|
name: autofs
|
|
state: absent
|
|
purge: true
|
|
failed_when: false
|
|
|
|
# --- Kernel module blacklisting (modprobe.d) ---
|
|
- name: Deploy modprobe blacklists
|
|
ansible.builtin.copy:
|
|
src: "modprobe/{{ item }}"
|
|
dest: "/etc/modprobe.d/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
backup: true
|
|
loop:
|
|
- usb_storage.conf
|
|
- dccp.conf
|
|
- rds.conf
|
|
- sctp.conf
|
|
- tipc.conf
|
|
- cramfs.conf
|
|
- freevxfs.conf
|
|
- hfs.conf
|
|
- hfsplus.conf
|
|
- jffs2.conf
|
|
- squashfs.conf
|
|
- udf.conf
|
|
|
|
# --- Login banners ---
|
|
- name: Deploy login banners
|
|
ansible.builtin.copy:
|
|
src: "banners/{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
backup: true
|
|
loop:
|
|
- {src: issue, dest: /etc/issue}
|
|
- {src: issue.net, dest: /etc/issue.net}
|
|
- {src: motd, dest: /etc/motd}
|
|
|
|
# --- cron permissions ---
|
|
- name: Remove /etc/cron.deny if present
|
|
ansible.builtin.file:
|
|
path: /etc/cron.deny
|
|
state: absent
|
|
|
|
- name: Ensure /etc/cron.allow exists with STIG permissions
|
|
ansible.builtin.file:
|
|
path: /etc/cron.allow
|
|
state: touch
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
access_time: preserve
|
|
modification_time: preserve
|
|
|
|
- name: Harden cron system paths
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
mode: "{{ item.mode }}"
|
|
owner: root
|
|
group: root
|
|
loop:
|
|
- {path: /etc/crontab, mode: "0600"}
|
|
- {path: /etc/cron.hourly, mode: "0700"}
|
|
- {path: /etc/cron.daily, mode: "0700"}
|
|
- {path: /etc/cron.weekly, mode: "0700"}
|
|
- {path: /etc/cron.monthly, mode: "0700"}
|
|
- {path: /etc/cron.d, mode: "0700"}
|
|
|
|
# --- at permissions ---
|
|
- name: Remove /etc/at.deny if present
|
|
ansible.builtin.file:
|
|
path: /etc/at.deny
|
|
state: absent
|
|
|
|
- name: Ensure /etc/at.allow exists with STIG permissions
|
|
ansible.builtin.file:
|
|
path: /etc/at.allow
|
|
state: touch
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
access_time: preserve
|
|
modification_time: preserve
|