Merge pull request #86 from ansible-lockdown/devel

Stig v2r1 to main

Author: uk-bolly

.ansible-lint

@@ -3,21 +3,7 @@
 parseable: true
 quiet: true
 skip_list:
-    - 'schema'
-    - 'no-changed-when'
-    - 'var-spacing'
-    - 'experimental'
-    - 'name[play]'
-    - 'name[casing]'
-    - 'name[template]'
-    - 'key-order[task]'
-    - 'yaml[line-length]'
-    - '204'
-    - '305'
-    - '303'
-    - '403'
-    - '306'
-    - '602'
-    - '208'
+  - 'package-latest'
+  - 'risky-shell-pipe'
 use_default_rules: true
 verbosity: 0

.github/workflows/devel_pipeline_validation.yml

@@ -27,7 +27,7 @@
   jobs:
     # This will create messages for first time contributers and direct them to the Discord server
       welcome:
-        runs-on: self-hosted
+        runs-on: ubuntu-latest
 
         steps:
             - uses: actions/first-interaction@main
@@ -70,7 +70,6 @@
                  echo IAC_BRANCH=main >> $GITHUB_ENV
               fi
 
-
           # Pull in terraform code for linux servers
           - name: Clone GitHub IaC plan
             uses: actions/checkout@v4

.github/workflows/main_pipeline_validation.yml

@@ -23,18 +23,6 @@
   # A workflow run is made up of one or more jobs
   # that can run sequentially or in parallel
   jobs:
-    # This will create messages for first time contributers and direct them to the Discord server
-      welcome:
-        runs-on: self-hosted
-
-        steps:
-            - uses: actions/first-interaction@main
-              with:
-                repo-token: ${{ secrets.GITHUB_TOKEN }}
-                pr-message: |-
-                    Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
-                    Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
-
       # This workflow contains a single job that tests the playbook
       playbook-test:
         # The type of runner that the job will run on

.gitignore

@@ -41,5 +41,8 @@ benchparse/
 *xccdf.xml
 *.retry
 
+# pre-commit cache
+.ansible/
+
 # GitHub Action/Workflow files
 .github/

.pre-commit-config.yaml

@@ -3,8 +3,8 @@
 ##### CI for use by github no need for action to be added
 ##### Inherited
 ci:
-    autofix_prs: false
-    skip: [detect-aws-credentials, ansible-lint ]
+  autofix_prs: false
+  skip: [detect-aws-credentials, ansible-lint ]
 
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -36,12 +36,12 @@ repos:
   - id: detect-secrets
 
 - repo: https://github.com/gitleaks/gitleaks
-  rev: v8.23.3
+  rev: v8.24.0
   hooks:
   - id: gitleaks
 
 - repo: https://github.com/ansible-community/ansible-lint
-  rev: v25.1.2
+  rev: v25.1.3
   hooks:
   - id: ansible-lint
     name: Ansible-lint

.yamllint

@@ -1,31 +1,38 @@
 ---
 extends: default
-
 ignore: |
     tests/
     molecule/
     .github/
     .gitlab-ci.yml
     *molecule.yml
-
 rules:
-    indentation:
-        # Requiring consistent indentation within a file, either indented or not
-        indent-sequences: consistent
-    braces:
-        max-spaces-inside: 1
-        level: error
-    brackets:
-        max-spaces-inside: 1
-        level: error
-    empty-lines:
-        max: 1
-    line-length: disable
-    key-duplicates: enable
-    new-line-at-end-of-file: enable
-    new-lines:
-        type: unix
-    trailing-spaces: enable
-    truthy:
-        allowed-values: ['true', 'false']
-        check-keys: true
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  comments:
+    ignore-shebangs: true
+    min-spaces-from-content: 1 # prettier compatibility
+  comments-indentation: disable
+  empty-lines:
+    max: 1
+  indentation:
+    # Requiring 2 space indentation
+    spaces: 2
+    # Requiring consistent indentation within a file, either indented or not
+    indent-sequences: consistent
+  key-duplicates: enable
+  line-length: disable
+  new-line-at-end-of-file: enable
+  new-lines:
+    type: unix
+  octal-values:
+    forbid-implicit-octal: true # yamllint defaults to false
+    forbid-explicit-octal: true
+  trailing-spaces: enable
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: true

Changelog.md

@@ -1,5 +1,113 @@
 # RHEL9STIG
 
+## 1.4.0 Based on STIG V2R1 Jul24 2024
+
+- Every control ruleid updates due to STiG new CMS
+- Removed as no longer required
+  - RHEL-09-211025
+  - RHEL-09-611016
+  - RHEL-09-611020
+- Following updated NIST relationships
+  - RHEL-09-653010
+  - RHEL-09-213020
+  - RHEL-09-214010
+  - RHEL-09-214015
+  - RHEL-09-214020
+  - RHEL-09-214025
+  - RHEL-09-215010
+  - RHEL-09-215075
+  - RHEL-09-653015
+  - RHEL-09-654215
+  - RHEL-09-654220
+  - RHEL-09-654225
+  - RHEL-09-654230
+  - RHEL-09-654235
+  - RHEL-09-654240
+  - RHEL-09-252010
+  - RHEL-09-252015
+  - RHEL-09-252020
+  - RHEL-09-255035
+  - RHEL-09-255045
+  - RHEL-09-255100
+  - RHEL-09-271045
+  - RHEL-09-271050
+  - RHEL-09-271055
+  - RHEL-09-271060
+  - RHEL-09-654245
+  - RHEL-09-411010
+  - RHEL-09-411015
+  - RHEL-09-411050
+  - RHEL-09-412010
+  - RHEL-09-432015
+  - RHEL-09-432025
+  - RHEL-09-432035
+  - RHEL-09-611010
+  - RHEL-09-611040
+  - RHEL-09-611050
+  - RHEL-09-611055
+  - RHEL-09-611060
+  - RHEL-09-611065
+  - RHEL-09-611070
+  - RHEL-09-611075
+  - RHEL-09-611080
+  - RHEL-09-611085
+  - RHEL-09-611090
+  - RHEL-09-611095
+  - RHEL-09-611100
+  - RHEL-09-611110
+  - RHEL-09-611115
+  - RHEL-09-611120
+  - RHEL-09-611125
+  - RHEL-09-611130
+  - RHEL-09-611135
+  - RHEL-09-611140
+  - RHEL-09-611145
+  - RHEL-09-611150
+  - RHEL-09-611160
+  - RHEL-09-611165
+  - RHEL-09-611170
+  - RHEL-09-611175
+  - RHEL-09-611180
+  - RHEL-09-611185
+  - RHEL-09-631010
+  - RHEL-09-671015
+  - RHEL-09-671025
+  - RHEL-09-291010
+  - RHEL-09-291015
+  - RHEL-09-291020
+
+## 1.3.0 Based on STIG V1r3 Jan24 2024
+
+- RuleIDs updated
+  - RHEL-09-212045
+  - RHEL-09-213060
+  - RHEL-09-215060
+  - RHEL-09-255025
+  - RHEL-09-255030
+  - RHEL-09-255035
+  - RHEL-09-255040
+  - RHEL-09-255045
+  - RHEL-09-255050
+  - RHEL-09-255055
+  - RHEL-09-255080
+  - RHEL-09-255085
+  - RHEL-09-255090
+  - RHEL-09-255095
+  - RHEL-09-255100
+  - RHEL-09-255130
+  - RHEL-09-255135
+  - RHEL-09-255140
+  - RHEL-09-255145
+  - RHEL-09-255150
+  - RHEL-09-255155
+  - RHEL-09-155160
+  - RHEL-09-255165
+  - RHEL-09-255170
+  - RHEL-09-255175
+
+- RHEL-09-255070 removed as duplicate of 255075
+  - RHEL-09-255075 updated
+
 ## 1.2.1 Based on STIG V1R2 Jan24 2024
 
 - precommit updates

README.md

@@ -2,7 +2,7 @@
 
 ## Configure a RHEL9 based system to be complaint with Disa STIG
 
-This role is based on RHEL 9 DISA STIG: [Version 1, Rel 3 released on Apr 24, 2024](https://dl.dod.cyber.mil/wp-content/uploads/stigs/U_RHEL_9_V1R3_STIG.zip).
+This role is based on RHEL 9 DISA STIG: [Version 2, Rel 1 released on Oct 24, 2024](https://dl.dod.cyber.mil/wp-content/uploads/stigs/U_RHEL_9_V2R1_STIG.zip).
 
 ## Initial Release from STIG, still many items that not quite aligned in the documentation
 
@@ -21,6 +21,8 @@ This role is based on RHEL 9 DISA STIG: [Version 1, Rel 3 released on Apr 24, 20
 ![Release Tag](https://img.shields.io/github/v/release/ansible-lockdown/RHEL9-STIG)
 ![Release Date](https://img.shields.io/github/release-date/ansible-lockdown/RHEL9-STIG)
 
+
+
 [![Main Pipeline Status](https://github.com/ansible-lockdown/RHEL9-STIG/actions/workflows/main_pipeline_validation.yml/badge.svg?)](https://github.com/ansible-lockdown/RHEL9-STIG/actions/workflows/main_pipeline_validation.yml)
 
 [![Devel Pipeline Status](https://github.com/ansible-lockdown/RHEL9-STIG/actions/workflows/devel_pipeline_validation.yml/badge.svg?)](https://github.com/ansible-lockdown/RHEL9-STIG/actions/workflows/devel_pipeline_validation.yml)
@@ -29,6 +31,7 @@ This role is based on RHEL 9 DISA STIG: [Version 1, Rel 3 released on Apr 24, 20
 ![Issues Open](https://img.shields.io/github/issues-raw/ansible-lockdown/RHEL9-STIG?label=Open%20Issues)
 ![Issues Closed](https://img.shields.io/github/issues-closed-raw/ansible-lockdown/RHEL9-STIG?label=Closed%20Issues&&color=success)
 ![Pull Requests](https://img.shields.io/github/issues-pr/ansible-lockdown/RHEL9-STIG?label=Pull%20Requests)
+[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit)](https://github.com/pre-commit/pre-commit)
 
 ![License](https://img.shields.io/github/license/ansible-lockdown/RHEL9-STIG?label=License)
 
@@ -59,7 +62,7 @@ This contains rewrites and ID reference changes as per STIG documentation.
 
 ## Auditing
 
-This can be turned on or off within the defaults/main.yml file with the variable rhel7stig_run_audit. The value is false by default, please refer to the wiki for more details. The defaults file also populates the goss checks to check only the controls that have been enabled in the ansible role.
+This can be turned on or off within the defaults/main.yml file with the variable rhel9stig_run_audit. The value is false by default, please refer to the wiki for more details. The defaults file also populates the goss checks to check only the controls that have been enabled in the ansible role.
 
 This is a much quicker, very lightweight, checking (where possible) config compliance and live/running settings.
 
@@ -69,10 +72,6 @@ This audit will not only check the config has the correct setting but aims to ca
 ## Documentation
 
 - [Read The Docs](https://ansible-lockdown.readthedocs.io/en/latest/)
-- [Getting Started](https://www.lockdownenterprise.com/docs/getting-started-with-lockdown#GH_AL_RH9_stig)
-- [Customizing Roles](https://www.lockdownenterprise.com/docs/customizing-lockdown-enterprise#GH_AL_RH9_stig)
-- [Per-Host Configuration](https://www.lockdownenterprise.com/docs/per-host-lockdown-enterprise-configuration#GH_AL_RH9_stig)
-- [Getting the Most Out of the Role](https://www.lockdownenterprise.com/docs/get-the-most-out-of-lockdown-enterprise#GH_AL_RH9_stig)
 
 ## Requirements
 

collections/requirements.yml

@@ -1,14 +1,14 @@
 ---
 
 collections:
-    - name: community.general
-      source: https://github.com/ansible-collections/community.general
-      type: git
+  - name: community.general
+    source: https://github.com/ansible-collections/community.general
+    type: git
 
-    - name: community.crypto
-      source: https://github.com/ansible-collections/community.crypto
-      type: git
+  - name: community.crypto
+    source: https://github.com/ansible-collections/community.crypto
+    type: git
 
-    - name: ansible.posix
-      source: https://github.com/ansible-collections/ansible.posix
-      type: git
+  - name: ansible.posix
+    source: https://github.com/ansible-collections/ansible.posix
+    type: git