Repository navigation
Conversation
Member
Author
|
Molecule, full matrix (8 VMs per scenario, no parallel runs):
|
…the profile fedora.linux_system_roles.kernel_settings merges new settings into the profile it wrote before, so a sunrpc.* value from an earlier mariadb_server run stays in it and tuned-adm verify checks it on every run. Without the sunrpc module the run aborted. Load the module for those keys as well, and restart TuneD when the module was missing, since the role only applies an unchanged profile at TuneD start. Verified with fedora.linux_system_roles 1.121.0 on 001-p-mon01 (Rocky 8).
The value only concerns the NFS client: it is the number of RPC slots preallocated per TCP transport, while further slots are allocated on demand up to tcp_max_slot_table_entries (xprt_dynamic_alloc_slot() in net/sunrpc/xprt.c). MariaDB has no use for it, and it loaded the sunrpc module on every database server. state: 'absent' removes it from the TuneD profile of existing hosts.
…val 15 CIS 5.1.20 (Level 1) requires PermitRootLogin no, CIS 5.1.7 a non-zero ClientAliveInterval. A preflight check aborts the run before sshd_config is deployed when Ansible itself logs in as root and the new value would lock it out; setup_basic runs it in its pre_tasks. Molecule logs in as root and keeps prohibit-password in the shared inventory.
…ocked module CIS 1.1.1.10 (Level 1) requires usb-storage to be unavailable, and the CIS audit checks for a blacklist line next to the install line. The run aborts when a USB disk is attached, since dracut copies /etc/modprobe.d into the initramfs and a host booting from it would no longer boot.
…fault The CIS Level 1 sysctls of RHEL 10 (1.5.x, 3.3.x) plus the two BPF settings Lynis asks for, checked against the kernel source. Forwarding, strict rp_filter and accept_ra stay untouched. Ubuntu 22.04 and 24.04 get kernel.kptr_restrict = 1, since TuneD re-applies their /etc/sysctl.d/10-kernel-hardening.conf over its profile (_apply_system_sysctl() in tuned/plugins/plugin_sysctl.py).
Keeps the cron daemon running (CIS 2.4.1.1) and makes /etc/crontab, /etc/cron.deny and the /etc/cron.* directories readable by root only (CIS 2.4.1.2 to 2.4.1.9, Lynis FILE-7524). Runs in setup_basic.
CIS 2.4.2.1 and Lynis FILE-7524. at is setuid root there. On Debian and Ubuntu it is setuid daemon and reads the file as group daemon, so the root:daemon 0640 of the package stays.
… does not follow Where Lynis and CIS cover the same setting, LFOps follows CIS; a suggestion only Lynis makes is skipped only for a technical reason, which each entry carries as a comment into custom.prf. Single values are skipped where Lynis supports it (KRNL-6000, SSH-7408). On 001-p-mon01 the suggestions drop from 35 to 4.
Asks the running system: sshd -T, the sysctl values after the reboot, modprobe for usb-storage, a cron job in the 0700 /etc/cron.d, and a Lynis audit that must not report the sshd, file permission and sysctl defaults.
…ead of installing it LFOps schedules its jobs with systemd timers, and CIS 2.4.1 only applies where cron is installed, so the role no longer installs or starts cron. It sets the CIS modes on the paths that exist and changes nothing on a host without cron, such as the Debian cloud images.
…-6640 BOOT-5264 is suggested on every host with systemd 240 or newer, whatever systemd-analyze security reports. mod_evasive only hooks the access checker of Apache httpd, counts per TCP peer and child process, and is unmaintained upstream since 2017.
…Lynis accepts Lynis rejects a space in any argument before 3.1.6 (SafeInput() in include/functions), which aborted the audit on Debian 13. It looks for each test ID as a substring of --tests, so a slash works as separator. The cron probe only runs where the image ships cron.
markuslf
force-pushed
the
feat/cis-security-defaults
branch
from
October 18, 2026 19:44
bc3e44e to
5284347
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the LFOps defaults closer to the CIS Benchmarks (RHEL 10 v1.0.1, Debian 12 v1.0.1, Level 1 Server) and makes the lynis role accept what LFOps deliberately does differently from Lynis. Where CIS and Lynis cover the same setting, CIS wins; a suggestion only Lynis makes is skipped only for a technical reason, which ends up as a comment in
custom.prf.Breaking Changes
PermitRootLogin no(CIS 5.1.20) andClientAliveInterval 15(CIS 5.1.7). A preflight check aborts the run before sshd is changed when Ansible itself logs in as root;setup_basicruns it in itspre_tasks.usb-storageis blocked (CIS 1.1.1.10), and every blocked module also gets ablacklistline, which the CIS audit checks for. The run aborts when a USB disk is attached, since dracut copies/etc/modprobe.dinto the initramfs.net.core.bpf_jit_harden = 2andkernel.unprivileged_bpf_disabled = 1for Lynis). Forwarding, strictrp_filterandaccept_raare left alone. Ubuntu 22.04 and 24.04 getkernel.kptr_restrict = 1, since TuneD re-applies their/etc/sysctl.d/10-kernel-hardening.confover its profile.Added / Changed / Fixed
setup_basic): makes/etc/crontab,/etc/cron.denyand/etc/cron.*root-only where cron is installed (CIS 2.4.1.x). It neither installs nor starts cron, since LFOps uses systemd timers./etc/at.denyroot-only on the Red Hat family (CIS 2.4.2.1).KRNL-6000:<key>,SSH-7408:<option>). BOOT-5264 is skipped, since Lynis suggests it on every host with systemd 240 or newer. ACCT-9622, ACCT-9626, FILE-6310 and LOGG-2154 stay visible on purpose.sunrpc.tcp_slot_table_entries(NFS client only) and removes it from existing TuneD profiles.sunrpcfor asunrpc.*value an earlier run left in the TuneD profile, instead of failingtuned-adm verify.Testing
setup_basicstops inverify.ymlat the AIDE andabout-mechecks because of the corrupt bytecode in the monitoring-plugins 8.0.0 RPMs (dmesg: "EOFError: marshal data too short" since v8.0.0 monitoring-plugins#1543, fixed upstream, not released yet);mainfails the same way.