Merge pull request #71 from ansible-lockdown/March26_align

March26 align

Author: uk-bolly

.ansible-lint

@@ -1,9 +1,8 @@
 ---
 
-parseable: true
 quiet: true
 skip_list:
-    - 'package-latest'
-    - 'risky-shell-pipe'
+  - 'package-latest'
+  - 'risky-shell-pipe'
 use_default_rules: true
 verbosity: 0

.gitignore

@@ -12,6 +12,14 @@ ignore*
 # VSCode
 .vscode
 vagrant
+.cursor/
+.claude/
+*report.md
+prompt.md
+plan.md
+history.md
+*recommendations.json
+*.pdf
 
 # Byte-compiled / optimized / DLL files
 __pycache__/

.pre-commit-config.yaml

@@ -2,21 +2,26 @@
 ##### CI for use by github no need for action to be added
 ##### Inherited
 ci:
-    autofix_prs: false
-    skip: [detect-aws-credentials, ansible-lint ]
+  autofix_prs: false
+  skip: [detect-aws-credentials, ansible-lint ]
 
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v6.0.0
   hooks:
   # Safety
   - id: detect-aws-credentials
+    name: Detect AWS Credentials
   - id: detect-private-key
+    name: Detect Private Keys
 
   # git checks
   - id: check-merge-conflict
+    name: Check for merge conflicts
   - id: check-added-large-files
+    name: Check for Large files
   - id: check-case-conflict
+    name: Check case conflict
 
   # General checks
   - id: trailing-whitespace
@@ -27,20 +32,23 @@ repos:
     types: [text]
     args: [--markdown-linebreak-ext=md]
   - id: end-of-file-fixer
+    name: Ensure line at end of file
 
 # Scan for passwords
 - repo: https://github.com/Yelp/detect-secrets
   rev: v1.5.0
   hooks:
   - id: detect-secrets
+    name: Detect Secrets test
 
 - repo: https://github.com/gitleaks/gitleaks
   rev: v8.30.0
   hooks:
   - id: gitleaks
+    name: Run Gitleaks test
 
 - repo: https://github.com/ansible-community/ansible-lint
-  rev: v25.12.2
+  rev: v26.1.1
   hooks:
   - id: ansible-lint
     name: Ansible-lint
@@ -51,14 +59,15 @@ repos:
     # https://github.com/ansible/ansible-lint/issues/611
     pass_filenames: false
     always_run: true
-    additional_dependencies:
+    # additional_dependencies:
     # https://github.com/pre-commit/pre-commit/issues/1526
     # If you want to use specific version of ansible-core or ansible, feel
     # free to override `additional_dependencies` in your own hook config
     # file.
-    - ansible-core>=2.10.1
+    # - ansible-core>=2.10.1
 
 - repo: https://github.com/adrienverge/yamllint.git
-  rev: v1.37.1  # or higher tag
+  rev: v1.38.0  # or higher tag
   hooks:
   - id: yamllint
+    name: Check YAML Lint

.yamllint

@@ -1,5 +1,4 @@
 ---
-
 extends: default
 ignore: |
     tests/
@@ -8,32 +7,32 @@ ignore: |
     .gitlab-ci.yml
     *molecule.yml
 rules:
-    braces:
-        max-spaces-inside: 1
-        level: error
-    brackets:
-        max-spaces-inside: 1
-        level: error
-    comments:
-        ignore-shebangs: true
-        min-spaces-from-content: 1 # prettier compatibility
-    comments-indentation: false
-    empty-lines:
-        max: 1
-    indentation:
-        # Requiring 2 space indentation
-        spaces: 4
-        # Requiring consistent indentation within a file, either indented or not
-        indent-sequences: consistent
-    key-duplicates: enable
-    line-length: disable
-    new-line-at-end-of-file: enable
-    new-lines:
-        type: unix
-    octal-values:
-        forbid-implicit-octal: true # yamllint defaults to false
-        forbid-explicit-octal: true
-    trailing-spaces: enable
-    truthy:
-        allowed-values: ['true', 'false']
-        check-keys: true
+  braces:
+    max-spaces-inside: 1
+    level: error
+  brackets:
+    max-spaces-inside: 1
+    level: error
+  comments:
+    ignore-shebangs: true
+    min-spaces-from-content: 1 # prettier compatibility
+  comments-indentation: disable
+  empty-lines:
+    max: 1
+  indentation:
+    # Requiring 2 space indentation
+    spaces: 2
+    # Requiring consistent indentation within a file, either indented or not
+    indent-sequences: consistent
+  key-duplicates: enable
+  line-length: disable
+  new-line-at-end-of-file: enable
+  new-lines:
+    type: unix
+  octal-values:
+    forbid-implicit-octal: true # yamllint defaults to false
+    forbid-explicit-octal: true
+  trailing-spaces: enable
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: true

CONTRIBUTING.rst

@@ -1,4 +1,4 @@
-Contributing to MindPoint Group Projects
+Contributing to Ansible-Lockdown Projects
 ========================================
 
 Rules
@@ -7,19 +7,20 @@ Rules
 2) All commits must have Signed-off-by (Signed-off-by: Joan Doe <joan.doe@email.com>) in the commit message (details in Signing section)
 3) All work is done in your own branch
 4) All pull requests go into the devel branch. There are automated checks for signed commits, signoff in commit message, and functional testing)
-5) Be open and nice to eachother
+5) Be open and nice to each other
 
 Workflow
 --------
 - Your work is done in your own individual branch. Make sure to to Signed-off and GPG sign all commits you intend to merge
 - All community Pull Requests are into the devel branch. There are automated checks for GPG signed, Signed-off in commits, and functional tests before being approved. If your pull request comes in from outside of our repo, the pull request will go into a staging branch. There is info needed from our repo for our CI/CD testing.
 - Once your changes are merged and a more detailed review is complete, an authorized member will merge your changes into the main branch for a new release
+
 Signing your contribution
 -------------------------
 
 We've chosen to use the Developer's Certificate of Origin (DCO) method
 that is employed by the Linux Kernel Project, which provides a simple
-way to contribute to MindPoint Group projects.
+way to contribute to Ansible-Lockdown projects.
 
 The process is to certify the below DCO 1.1 text
 ::
@@ -60,7 +61,6 @@ following text in your contribution commit message:
 
 ::
 
-
 This message can be entered manually, or if you have configured git
 with the correct `user.name` and `user.email`, you can use the `-s`
 option to `git commit` to automatically include the signoff message.

Changelog.md

@@ -0,0 +1,17 @@
+# AMAZON2-CIS Changelog
+
+Benchmark: v3.0.0. March Updates
+
+## Remediation (AMAZON2-CIS)
+
+- **6.1.x:** Paths and titles aligned for 6.1.3–6.1.10; 6.1.12 logic and content improved.
+- **Section 2:** 2.1.12 updated for correct package.
+- **Section 4:** 4.3.4 logic updated; 4.5.1.x var naming and controls updated (exclude connected user).
+- **Section 5:** 5.1.4 improved.
+- **Section 3:** Typo fix in 3.4.3.5; audit logic fixes.
+- **Titles & tags:** Titles updated; tag/level fixes; spelling/typos fixed.
+- **Variables:** Var naming aligned and standardised; vars moved to correct location.
+- **Behaviour:** `skip_reboot` set to true; tmp and wifi discovery logic updated.
+- **Audit/template:** Template added to auditd steps.
+- **Linting:** YAML spacing, layout, and lint alignment; aligned with new standards.
+- **Other:** Git ignore updated; handler name casing and lint updates.

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Ansible Lockdown
+Copyright (c) 2026 Mindpoint Group - A Tyto Athene Company / Ansible Lockdown
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

defaults/main.yml

@@ -22,7 +22,7 @@ os_check: true
 
 # Ability to stop reboot from occurring until convenient
 # set to true if ok to reboot
-skip_reboot: false
+skip_reboot: true
 
 # Change to false if using EFI boot changes 1.1.1.4 to stop vfat
 amazon2cis_legacy_boot: true
@@ -543,6 +543,12 @@ amazon2cis_rule_6_2_11: true
 
 ## Section 1 variables
 
+## Ability to enable debug on mounts to assist in troubleshooting
+# Mount point changes are set based upon facts created in Prelim
+# these then build the variable and options that is passed to the handler to set the
+# mount point for the controls in section1.
+amazon2cis_debug_mount_data: false
+
 # If set true uses the tmp.mount service else using fstab configuration
 amazon2cis_tmp_svc: true
 
@@ -700,6 +706,12 @@ amazon2cis_ipv6_sshd_disable: false
 amazon2cis_sudolog_location: "/var/log/sudo.log"
 amazon2cis_sudo_timestamp_timeout: 15
 
+# 4.3.4 sudoers NOPASSWD
+# Accounts listed below will skip the NOPASSWD check and leave NOPASSWD set
+amazon2cis_sudoers_exclude_nopasswd_list:
+    - ec2-user
+    - vagrant
+
 # Group to be used for su
 # this group needs to exists groups will not be created for remediation this is considered sys admins
 
@@ -758,11 +770,10 @@ amazon2cis_inactive_whitelist:
 amazon2cis_user_skip_list:
     root
 
-amazon2cis_pass:
-    max_days: 365
-    min_days: 1
-    warn_age: 7
-    inactive: 30  # should not be 0 or -1 (little details in control)
+amazon2cis_pass_max_days: 365
+amazon2cis_pass_min_days: 1
+amazon2cis_pass_warn_age: 7
+amazon2cis_pass_inactive: 30  # should not be 0 or -1 (little details in control)
 
 # Session timeout setting file (TMOUT setting can be set in multiple files)
 # Timeout value is in seconds. (60 seconds * 10 = 600)
@@ -793,6 +804,13 @@ amazon2cis_remote_log_protocol: tcp
 amazon2cis_remote_log_retrycount: 100
 amazon2cis_remote_log_queuesize: 1000
 
+
+# 5.2.3.6 exclude listed mountpoints from the find command to locate privileged binaries
+# Allows operator to exclude mounted devices from being considered as within scope to find privileged binaries; mainly in the case of
+# external/temporary mounted USB drives.
+#   amazon2cis_priv_command_excluded_mounts: ["/mnt/backup_disk", "/mnt/usb_external_storage"]
+amazon2cis_priv_command_excluded_mounts: []
+
 # amazon2cis_logrotate sets the daily, weekly, monthly, yearly value for the log rotation
 # To conform to CIS standards this just needs to comply with your site policy
 amazon2cis_logrotate: "daily"
@@ -804,13 +822,12 @@ amazon2cis_audit_back_log_limit: 8192
 amazon2cis_max_log_file_size: 10
 
 # auditd settings
-amazon2cis_auditd:
-    disk_error_action: halt
-    disk_full_action: halt
-    action_mail_acct: root
-    space_left_action: email
-    admin_space_left_action: single
-    max_log_file_action: keep_logs
+amazon2cis_auditd_disk_error_action: halt
+amazon2cis_auditd_disk_full_action: halt
+amazon2cis_auditd_action_mail_acct: root
+amazon2cis_auditd_space_left_action: email
+amazon2cis_auditd_admin_space_left_action: single
+amazon2cis_auditd_max_log_file_action: keep_logs
 
 # This can be used to configure other keys in auditd.conf
 amazon2cis_auditd_extra_conf: {}
@@ -823,15 +840,14 @@ amazon2cis_auditd_extra_conf: {}
 amazon2cis_aide_scan: cron
 amazon2cis_config_aide: true
 # AIDE cron settings
-amazon2cis_aide_cron:
-    cron_user: root
-    cron_file: /etc/cron.d/cis_aide
-    aide_job: '/usr/sbin/aide --check'
-    aide_minute: 0
-    aide_hour: 5
-    aide_day: '*'
-    aide_month: '*'
-    aide_weekday: '*'
+amazon2cis_aide_cron_user: root
+amazon2cis_aide_cron_file: /etc/cron.d/cis_aide
+amazon2cis_aide_cron_job: '/usr/sbin/aide --check'
+amazon2cis_aide_cron_minute: 0
+amazon2cis_aide_cron_hour: 5
+amazon2cis_aide_cron_day: '*'
+amazon2cis_aide_cron_month: '*'
+amazon2cis_aide_cron_weekday: '*'
 
 ##
 ## Section 6 variables
@@ -851,5 +867,14 @@ amazon2cis_ungrouped_adjust: false
 amazon2cis_suid_adjust: false
 amazon2cis_sgid_adjust: false
 
+# 6.1.12
+# This variable is a toggle for enabling/disabling the automated
+# setting of an owner (specified in variable `rhel8cis_unowned_owner`)
+# for all unowned files and directories.
+# Possible values are `true` and `false`.
+amazon2cis_ownership_adjust: true
+amazon2cis_exclude_unowned_search_path: (! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*")
+amazon2cis_unowned_owner: root
+
 # 6.2.12
 amazon2cis_dotperm_ansiblemanaged: true