Skip to content

Commit a6d55a4

Browse files
dennisotugodennisotugo
authored
Merge pull request #2 from pbokeefe1027/master
100% coverage of all Level 1 CIS Benchmark controls. Assumes AWS CW Agent is installed.
2 parents 2cf76cd + d4b8fa8 commit a6d55a4

19 files changed

+687
-58
lines changed

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,12 @@ A more advanced example, which includes modifications to the default values used
106106
roles:
107107
- ansible-role-cis-amazon-linux-2.cis-amazon-linux
108108
109+
environment:
110+
http_proxy: http://yourproxy.yourorg.com:8080
111+
https_proxy: http://yourproxy.yourorg.com:8080
112+
#if you have VPC endpoints defined, add them on the noproxy line below to use them
113+
#don't forget to noproxy the metadata service if you define proxies at 169.254.169.254
114+
no_proxy: 169.254.169.254
109115
```
110116

111117
Note that the use of ```become: yes``` is required as 99% of tasks require privileged access to execute.

‎facts/all_mounts.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,4 +72,4 @@ def get_mtab_entries():
7272

7373
mounts.append(mount_info)
7474

75-
print json.dumps(mounts)
75+
print (json.dumps(mounts))

‎files/00-firewall.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
iptables -F

‎files/cloud-init-log-permissions.service‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# /etc/systemd/system/cloud-init-log-permissions.service
2+
[Unit]
3+
Description=Correct cloud-init's logfile permissions
4+
5+
# We want to start *AFTER* cloud-init has opened its log files:
6+
After=cloud-init.service
7+
8+
# We want to restart any time cloud-init is restarted (requires RemainAfterExit below):
9+
PartOf=cloud-init.service
10+
11+
[Service]
12+
Type=oneshot
13+
RemainAfterExit=yes
14+
ExecStart=/usr/bin/chmod u=rw,g=r,o= /var/log/cloud-init.log /var/log/cloud-init-output.log
15+
16+
[Install]
17+
WantedBy=multi-user.target

‎files/cloudwatch.conf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# in support of 4.2.4 - least privilege logs
2+
# Paul O'Keefe - paul@megabelle.net
3+
4+
f /opt/aws/amazon-cloudwatch-agent/logs/state/_opt_aws_amazon-cloudwatch-agent_logs_amazon-cloudwatch-agent.log 0640 - - -
5+
f /opt/aws/amazon-cloudwatch-agent/logs/state/_var_log_audit_audit.log 0640 - - -
6+
f /opt/aws/amazon-cloudwatch-agent/logs/state/_var_log_cron 0640 - - -
7+
f /opt/aws/amazon-cloudwatch-agent/logs/state/_var_log_maillog 0640 - - -
8+
f /opt/aws/amazon-cloudwatch-agent/logs/state/_var_log_messages 0640 - - -
9+
d /opt/aws/amazon-cloudwatch-agent/logs/state 0640 - - -
10+
d /opt/aws/amazon-cloudwatch-agent/logs 0740 - - -
11+
d /opt/aws/amazon-cloudwatch-agent/cwagent-otel-collector/logs 0740 - - -
12+
d /var/log/amazon 0740 - - -

‎files/copy_system_auth.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
cd /etc/pam.d
3+
mv system-auth system-auth-local
4+
ln -s system-auth-local system-auth
5+

‎files/etc_iptables‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Generated by Ansible
2+
*filter
3+
:INPUT DROP [0:0]
4+
:FORWARD DROP [0:0]
5+
:OUTPUT DROP [1:285]
6+
-A INPUT -p tcp --dport 25 -m state --state NEW -j ACCEPT
7+
-A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
8+
-A INPUT -p udp --dport 68 -m state --state NEW -j ACCEPT
9+
-A INPUT -p udp --dport 323 -m state --state NEW -j ACCEPT
10+
-A INPUT -i lo -j ACCEPT
11+
-A INPUT -s 127.0.0.0/8 -j DROP
12+
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
13+
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
14+
-A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT
15+
-A OUTPUT -o lo -j ACCEPT
16+
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
17+
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
18+
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT
19+
COMMIT
20+
# end of file

‎files/ssm.conf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# in support of 4.2.4 - least privilege logs
2+
# Paul O'Keefe - paul@megabelle.net
3+
4+
d /var/log/amazon/ssm 0740 - - -
5+
f /var/log/amazon/ssm/amazon-ssm-agent.log 640 - - -
6+
f /var/log/amazon/ssm/AmazonSSMAgent-update.txt 640 - - -
7+
f /var/log/amazon/ssm/errors.log 640 - - -
8+
f /var/log/amazon/amazon-cloudwatch-agent/state/_var_log_secure 640 - - -
9+
f /var/log/lastlog 640 - - -
10+
f /var/log/btmp 640 - - -
11+
f /var/log/sa/sa15 640 - - -
12+
f /var/log/amazon/ssm/patch-configuration/patch-states-configuration.json 640 - - -
13+
f /var/log/amazon/ssm/patch-configuration/patch-inventory-from-last-operation.json 640 - - -

‎tasks/level-1/3.5.1.1.yml‎

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,40 @@
11
# Standards: 0.11
2+
23
---
34

45
# 3.5.1.1 Ensure default deny firewall policy
6+
# do this in a more cloudy way through cloud-init scripts
7+
- name: 3.5.1.1 - Ensure default deny firewall policy(DROP INPUT)
8+
copy:
9+
dest: /var/lib/cloud/scripts/per-once/00-firewall.sh
10+
src: "{{ role_path }}/files/00-firewall.sh"
11+
tags:
12+
- level-1
13+
- section-3
14+
- "3.5.1.1"
15+
- scored
16+
17+
# 3.5.1.1 Ensure default deny firewall policy
18+
# do this in a more cloudy way through cloud-init scripts
19+
- name: 3.5.1.1 - Ensure default deny firewall policy(DROP INPUT)
20+
copy:
21+
dest: /var/lib/cloud/scripts/per-once/00-firewall.sh
22+
content:
23+
iptables -P INPUT DROP
24+
iptables -P OUTPUT DROP
25+
iptables -P FORWARD DROP
26+
tags:
27+
- level-1
28+
- section-3
29+
- "3.5.1.1"
30+
- scored
531

32+
# make the file executable
633
- name: 3.5.1.1 - Ensure default deny firewall policy(DROP INPUT)
7-
iptables:
8-
chain: "{{item}}"
9-
policy: DROP
10-
become: yes
11-
with_items:
12-
- INPUT
13-
- FORWARD
14-
- OUTPUT
34+
file:
35+
path: /var/lib/cloud/scripts/per-once/00-firewall.sh
36+
mode: u=rwx,g=r,o=r
37+
state: touch
1538
tags:
1639
- level-1
1740
- section-3

‎tasks/level-1/3.5.1.2.yml‎

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2,39 +2,53 @@
22
---
33

44
# 3.5.1.2 Ensure loopback traffic is configured
5-
5+
# use cloud init way to do this
66
- name: 3.5.1.2 - Ensure loopback traffic is configured(-i lo)
7-
iptables:
8-
chain: INPUT
9-
in_interface: "lo"
10-
jump: ACCEPT
11-
become: yes
7+
lineinfile:
8+
path: /var/lib/cloud/scripts/per-once/00-firewall.sh
9+
line: iptables -A INPUT -i lo -j ACCEPT
10+
insertafter: EOF
1211
tags:
1312
- level-1
1413
- section-3
15-
- "3.5.1.2"
14+
- "3.5.1.1"
1615
- scored
1716

18-
- name: 3.5.1.2 - Ensure loopback traffic is configured(-o lo)
19-
iptables:
20-
chain: OUTPUT
21-
out_interface: "lo"
22-
jump: ACCEPT
23-
become: yes
17+
# 3.5.1.2 Ensure loopback traffic is configured
18+
# use cloud init way to do this
19+
- name: 3.5.1.2 - Ensure loopback traffic is configured(-i lo)
20+
lineinfile:
21+
path: /var/lib/cloud/scripts/per-once/00-firewall.sh
22+
line: iptables -A OUTPUT -o lo -j ACCEPT
23+
insertafter: EOF
2424
tags:
2525
- level-1
2626
- section-3
27-
- "3.5.1.2"
27+
- "3.5.1.1"
2828
- scored
2929

30-
- name: 3.5.1.2 - Ensure loopback traffic is configured(-i 127.0.0.1/8)
31-
iptables:
32-
chain: INPUT
33-
source: 127.0.0.0/8
34-
jump: DROP
35-
become: yes
30+
# 3.5.1.2 Ensure loopback traffic is configured
31+
# use cloud init way to do this
32+
- name: 3.5.1.2 - Ensure loopback traffic is configured(-i lo)
33+
lineinfile:
34+
path: /var/lib/cloud/scripts/per-once/00-firewall.sh
35+
line: iptables -A INPUT -s 127.0.0.0/8 -j DROP
36+
insertafter: EOF
3637
tags:
3738
- level-1
3839
- section-3
39-
- "3.5.1.2"
40+
- "3.5.1.1"
4041
- scored
42+
43+
# make the file executable
44+
- name: 3.5.1.1 - Ensure default deny firewall policy(DROP INPUT)
45+
file:
46+
path: /var/lib/cloud/scripts/per-once/00-firewall.sh
47+
mode: u=rwx,g=r,o=r
48+
state: touch
49+
tags:
50+
- level-1
51+
- section-3
52+
- "3.5.1.1"
53+
- scored
54+

0 commit comments

Comments
 (0)