From fbe61b8354470c2180055373c53d382a4d407fbe Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 12:56:22 +0100 Subject: [PATCH 1/6] updated check_keys Signed-off-by: Mark Bolwell --- .yamllint | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.yamllint b/.yamllint index ec46929..65faae6 100644 --- a/.yamllint +++ b/.yamllint @@ -30,4 +30,4 @@ rules: trailing-spaces: enable truthy: allowed-values: ['true', 'false'] - check-keys: false + check-keys: true From 520a115f81369f78ea632f89f68eec783cc7df3d Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 12:56:52 +0100 Subject: [PATCH 2/6] #11 fdisk path updated Signed-off-by: Mark Bolwell --- templates/audit/99_stig_auditd.rules.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/audit/99_stig_auditd.rules.j2 b/templates/audit/99_stig_auditd.rules.j2 index f4f0244..e72c1fc 100644 --- a/templates/audit/99_stig_auditd.rules.j2 +++ b/templates/audit/99_stig_auditd.rules.j2 @@ -145,5 +145,5 @@ -w /bin/kmod -p x -k modules {% endif %} {% if ubtu_20_010298 %} --w /bin/fdisk -p x -k fdisk +-w /sbin/fdisk -p x -k fdisk {% endif %} From d31f50498d42108a41417d56abedc02e55a60270 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 12:59:46 +0100 Subject: [PATCH 3/6] #12 init_module added Signed-off-by: Mark Bolwell --- templates/audit/99_stig_auditd.rules.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/audit/99_stig_auditd.rules.j2 b/templates/audit/99_stig_auditd.rules.j2 index e72c1fc..81fd887 100644 --- a/templates/audit/99_stig_auditd.rules.j2 +++ b/templates/audit/99_stig_auditd.rules.j2 @@ -109,8 +109,8 @@ -a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k privileged-pam_timestamp_check {% endif %} {% if ubtu_20_010179 %} --a always,exit -F arch=b32 -S finit_module -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k module_chng --a always,exit -F arch=b64 -S finit_module -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k module_chng +-a always,exit -F arch=b32 -S init_module,finit_module -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k module_chng +-a always,exit -F arch=b64 -S init_module,finit_module -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k module_chng {% endif %} {% if ubtu_20_010181 %} -a always,exit -F arch=b32 -S delete_module -F auid>={{ ubtu20stig_int_gid }} -F auid!=4294967295 -k module_chng From 63c81074f3381c128b5622cfef1a91fec3ebef8d Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 13:04:21 +0100 Subject: [PATCH 4/6] #13 updated regex Signed-off-by: Mark Bolwell --- tasks/fix-cat1.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/fix-cat1.yml b/tasks/fix-cat1.yml index 8793837..53e2c69 100644 --- a/tasks/fix-cat1.yml +++ b/tasks/fix-cat1.yml @@ -191,7 +191,7 @@ - name: "HIGH | UBTU-20-010048 | PATCH | The Ubuntu operating system must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements." ansible.builtin.lineinfile: path: /etc/ssh/sshd_config - regexp: '^#?\s*X11Forwarding' + regexp: '^#?(\s+|)X11Forwarding' line: "X11Forwarding no" notify: restart sshd when: From 39b59448f0353eaa37a07ec31b11ceb4c804c87e Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 13:11:19 +0100 Subject: [PATCH 5/6] lint updates Signed-off-by: Mark Bolwell --- .ansible-lint | 2 -- handlers/main.yml | 2 +- tasks/fix-cat3.yml | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/.ansible-lint b/.ansible-lint index 057c65e..b717f67 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -6,12 +6,10 @@ skip_list: - 'schema' - 'no-changed-when' - 'var-spacing' - - 'fqcn-builtins' - 'experimental' - 'name[play]' - 'name[casing]' - 'name[template]' - - 'fqcn[action]' - 'key-order[task]' - '204' - '305' diff --git a/handlers/main.yml b/handlers/main.yml index af7e819..19205c3 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -56,7 +56,7 @@ ansible.builtin.shell: augenrules --load - name: restart auditd - service: + ansible.builtin.service: name: auditd state: restarted diff --git a/tasks/fix-cat3.yml b/tasks/fix-cat3.yml index ba56f6c..1254871 100644 --- a/tasks/fix-cat3.yml +++ b/tasks/fix-cat3.yml @@ -373,7 +373,7 @@ - ubtu20stig_auditd_action_mail_acct != "root" - name: "LOW | UBTU-20-010217 | PATCH | The Ubuntu operating system must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity. | Warning Message No Email Set." - debug: + ansible.builtin.debug: msg: - "Warning!! You have not set the email address of the SA(s) and/or ISSO" - "Please set variable ubtu20stig_auditd_action_mail_acct in defaults/main to correct email addres." From 59e056d42e751669090844ae0341532f1cbd11b3 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Thu, 21 Sep 2023 13:12:07 +0100 Subject: [PATCH 6/6] updated Signed-off-by: Mark Bolwell --- ChangeLog.md | 32 ++++++++++++++++++++++++++------ README.md | 1 + 2 files changed, 27 insertions(+), 6 deletions(-) diff --git a/ChangeLog.md b/ChangeLog.md index 7131699..2c7f534 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,14 +1,34 @@ # Changelog +## Release 0.9.1 + +- yamllint update +- ansible-lint updated +- linting +- workflow +- readme layout +- discord link +- precommit added + +Issues + +- thanks to @kfiresmith + - #11 + - #12 +- thanks to €aelx-rowe + - #13 + ## Release 0.9.0 ## April 2023 Updates - - Ansible-lint Check - - Yamllint Updated File - - Yamllint Check - - Updated Module Names To Full - - Updated License - - Updated Readme To New Format + +- Ansible-lint Check +- Yamllint Updated File +- Yamllint Check +- Updated Module Names To Full +- Updated License +- Updated Readme To New Format ## Initial Release + - Updated to release V1R7 diff --git a/README.md b/README.md index d458a29..01c355a 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,7 @@ ![Ansible Galaxy Quality](https://img.shields.io/ansible/quality/61237?label=Quality&&logo=ansible) ![Discord Badge](https://img.shields.io/discord/925818806838919229?logo=discord) + ![Release Branch](https://img.shields.io/badge/Release%20Branch-Main-brightgreen) ![Release Tag](https://img.shields.io/github/v/release/ansible-lockdown/UBUNTU20-STIG) ![Release Date](https://img.shields.io/github/release-date/ansible-lockdown/UBUNTU20-STIG)