Merge pull request #83 from ansible-lockdown/template_and_secrets

Template and secrets
ansible-lockdown · Aug 9, 2023 · 5bedad6 · 5bedad6
2 parents 83c4e5c + dadeeab
commit 5bedad6
Show file tree

Hide file tree

Showing 22 changed files with 29 additions and 110 deletions.
diff --git a/.config/.secrets.baseline b/.config/.secrets.baseline
@@ -109,6 +109,12 @@
     },
     {
       "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        ".config/.gitleaks-report.json"
+      ]
     }
   ],
   "results": {
@@ -166,5 +172,5 @@
       }
     ]
   },
-  "generated_at": "2023-08-07T15:38:18Z"
+  "generated_at": "2023-08-09T08:11:03Z"
 }
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
diff --git a/.github/ISSUE_TEMPLATE/feature-request-or-enhancement.md b/.github/ISSUE_TEMPLATE/feature-request-or-enhancement.md
diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
diff --git a/.gitignore b/.gitignore
@@ -12,7 +12,7 @@ delete*
 ignore*
 test_inv
 # temp remove doc while this is built up
-doc/  
+doc/
 # VSCode
 .vscode
 

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -33,15 +33,14 @@ repos:
   rev: v1.4.0
   hooks:
   - id: detect-secrets
-    args: ['--baseline', '.config/.secrets.baseline']
-    exclude: package.lock.json
-
+    args: [ '--baseline', '.config/.secrets.baseline' ]
+    exclude: .config/.gitleaks-report.json
 
 - repo: https://github.com/gitleaks/gitleaks
   rev: v8.17.0
   hooks:
   - id: gitleaks
-    args: ['--baseline-path','.config/.gitleaks-report.json']
+    args: ['--baseline-path', '.config/.gitleaks-report.json']
 
 - repo: https://github.com/ansible-community/ansible-lint
   rev: v6.17.2

diff --git a/README.md b/README.md
@@ -22,7 +22,7 @@
 [![Main Pipeline Status](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/main_pipeline_validation.yml/badge.svg?)](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/main_pipeline_validation.yml)
 
 [![Devel Pipeline Status](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/devel_pipeline_validation.yml/badge.svg?)](https://github.com/ansible-lockdown/RHEL9-CIS/actions/workflows/devel_pipeline_validation.yml)
-![Devel Commits](https://img.shields.io/github/commit-activity/m/ansible-lockdown/RHEL9-CIS/devel?color=dark%20green&label=Devel%20Branch%20commits)
+![Devel Commits](https://img.shields.io/github/commit-activity/m/ansible-lockdown/RHEL9-CIS/devel?color=dark%20green&label=Devel%20Branch%20Commits)
 
 ![Issues Open](https://img.shields.io/github/issues-raw/ansible-lockdown/RHEL9-CIS?label=Open%20Issues)
 ![Issues Closed](https://img.shields.io/github/issues-closed-raw/ansible-lockdown/RHEL9-CIS?label=Closed%20Issues&&color=success)

diff --git a/tasks/section_1/cis_1.2.x.yml b/tasks/section_1/cis_1.2.x.yml
@@ -17,7 +17,7 @@
 
       - name: "1.2.1 | AUDIT | Ensure GPG keys are configured | expected keys fail"
         ansible.builtin.fail:
-            msg: Installed GPG Keys do not meet expected values or keys installed that are not expected
+            msg: Installed GPG Keys do not meet expected values or expected keys are not installed
         when:
             - os_installed_pub_keys.rc == 1 or
               os_gpg_key_check.rc == 1

diff --git a/templates/ansible_vars_goss.yml.j2 b/templates/ansible_vars_goss.yml.j2
@@ -486,7 +486,7 @@ rhel9cis_authselect_custom_profile_create: {{ rhel9cis_authselect_custom_profile
 
 # 5.5.1
 ## PAM
-rhel9cis_pam_password: 
+rhel9cis_pam_password:
   minlen: {{ rhel9cis_pam_password['minlen'] }}
   minclass: {{ rhel9cis_pam_password['minclass'] }}
 rhel9cis_pam_passwd_retry: "3"

diff --git a/templates/audit/98_auditd_exception.rules.j2 b/templates/audit/98_auditd_exception.rules.j2
@@ -1,10 +1,10 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 ### YOUR CHANGES WILL BE LOST!
 
 # This file contains users whose actions are not logged by auditd
-{% if rhel9cis_allow_auditd_uid_user_exclusions %} 
+{% if rhel9cis_allow_auditd_uid_user_exclusions %}
 {% for user in rhel9cis_auditd_uid_exclude %}
 -a never,user -F uid!={{ user }} -F auid!={{ user }}
 {% endfor %}

diff --git a/templates/audit/99_auditd.rules.j2 b/templates/audit/99_auditd.rules.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 ### YOUR CHANGES WILL BE LOST!
 

diff --git a/templates/etc/cron.d/aide.cron.j2 b/templates/etc/cron.d/aide.cron.j2
@@ -1,6 +1,6 @@
-# Run AIDE integrity check 
+# Run AIDE integrity check
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 ### YOUR CHANGES WILL BE LOST!
 # CIS 1.3.2

diff --git a/templates/etc/dconf/db/00-automount_lock.j2 b/templates/etc/dconf/db/00-automount_lock.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 # Lock desktop media-handling automount setting

diff --git a/templates/etc/dconf/db/00-autorun_lock.j2 b/templates/etc/dconf/db/00-autorun_lock.j2
@@ -1,6 +1,6 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
-# Lock desktop media-handling settings 
+# Lock desktop media-handling settings
 /org/gnome/desktop/media-handling/autorun-never
diff --git a/templates/etc/dconf/db/00-media-automount.j2 b/templates/etc/dconf/db/00-media-automount.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 [org/gnome/desktop/media-handling]

diff --git a/templates/etc/dconf/db/00-media-autorun.j2 b/templates/etc/dconf/db/00-media-autorun.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 [org/gnome/desktop/media-handling]

diff --git a/templates/etc/dconf/db/00-screensaver.j2 b/templates/etc/dconf/db/00-screensaver.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 # Specify the dconf path

diff --git a/templates/etc/dconf/db/00-screensaver_lock.j2 b/templates/etc/dconf/db/00-screensaver_lock.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 # Lock desktop screensaver idle-delay setting

diff --git a/templates/etc/dconf/db/gdm.d/01-banner-message.j2 b/templates/etc/dconf/db/gdm.d/01-banner-message.j2
@@ -1,5 +1,5 @@
 ## Ansible controlled file
-# Added as part of ansible-lockdown CIS baseline 
+# Added as part of ansible-lockdown CIS baseline
 # provided by MindPointGroup LLC
 
 [org/gnome/login-screen]

diff --git a/templates/etc/sysctl.d/60-disable_ipv6.conf.j2 b/templates/etc/sysctl.d/60-disable_ipv6.conf.j2
@@ -2,6 +2,6 @@
 
 # IPv6 disable
 {% if rhel9cis_rule_3_1_1 and rhel9cis_ipv6_required %}
-net.ipv6.conf.all.disable_ipv6 = 1 
+net.ipv6.conf.all.disable_ipv6 = 1
 net.ipv6.conf.default.disable_ipv6 = 1
 {% endif %}
diff --git a/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2 b/templates/etc/sysctl.d/60-netipv6_sysctl.conf.j2
@@ -18,4 +18,4 @@ net.ipv6.conf.default.accept_redirects = 0
 net.ipv6.conf.all.accept_ra = 0
 net.ipv6.conf.default.accept_ra = 0
 {% endif %}
-{% endif %}
+{% endif %}
-Original file line number
+Diff line change
@@ Expand Up / @@ -12,7 +12,7 @@ delete* @@
     ignore*
     test_inv
     # temp remove doc while this is built up
-    doc/
+    doc/
     # VSCode
     .vscode
@@ Expand Down @@