Repository navigation
Conversation
ideaship
force-pushed
the
ubuntu24-cis
branch
4 times, most recently
from
October 11, 2026 06:06
6234a4f to
1bf0b01
Compare
OSISM 11 integrates ansible-lockdown/UBUNTU24-CIS as "osism apply ubuntu24-cis" and, with enable_cis_hardening: true, in bootstrap and maintenance. The role's own defaults (1.7.0) apply Level 1 and Level 2 with disruption_high and a ufw firewall, which would break an OSISM node. all/099-ubuntu24-cis.yml carries the values OSISM ships instead: the Level 1 server profile without the controls that conflict with how OSISM runs a node. Operators tighten it in configuration.yml. Not changed, and documented in the OSISM 11 release notes instead: 1.5.5 and 2.2.4/2.2.6 uninstall apport and the telnet and ftp clients, which removes the ubuntu-server and ubuntu-standard metapackages; the next maintenance run's autoremove then takes the packages they pulled in (open-vm-tools, fwupd, udisks2, tcpdump, nano, ...). Whether OSISM keeps any of them is left open. - Firewall: section 4 is off. firewall_package: none alone would still run the 4.1.1 audit. - disruption_high is off, which also skips locking system accounts (5.4.2.7, 5.4.2.8). - Routing sysctls: is_router skips the forwarding and redirect rules (3.3.1, 3.3.2, 3.3.8). 3.3.7 (rp_filter=1) and 3.3.11 (accept_ra=0) are not guarded by is_router and are turned off explicitly. 3.3.7 writes /etc/sysctl.conf, which systemd loads after sysctl.d, so it would override osism.services.frr's rp_filter=2 after a reboot. - tcp_syncookies: osism.commons.sysctl sets it to 0 on the rabbitmq group, which 3.3.10 would reset to 1 on every run, so 3.3.10 is off. - Logging: the role's journald default sets ForwardToSyslog=no and enables systemd-journal-upload to a placeholder host. OSISM ships host logs journald -> rsyslog -> fluentd, so syslog_service is rsyslog and 6.1.3.6 (forwarding to the same placeholder) is off. - Time sync: 2.3.3.1 adds the NIST servers and 2.3.3.2 a user line to chrony.conf, which osism.services.chrony owns and rewrites; both are off. Ubuntu's chronyd runs as _chrony already. - rsync: 2.1.13 removes the rsync package by default, which breaks every rsync to the hosts (tbng's checks, the testbed's manager setup). rsync_mask keeps the client and masks the daemon, which is what the rule is about. - Files OSISM roles own are left to them, so that repeated maintenance runs do not rewrite them back and forth: login banners (1.6.1-1.6.3, osism.commons.motd), journald.conf (6.1.1.3 would also override OSISM's journald sizing with a drop-in; 6.1.3.3) and the rsyslog logrotate file (6.1.3.8). - AIDE is off; its scans would walk /var/lib/docker and Ceph hosts. - File sweeps report instead of fixing. Docker volume and Ceph data is owned by container users without a host account. With ownership_adjust, 7.1.12 chowns all of it to root, which on a test cluster broke MariaDB, the Ceph OSDs, Prometheus and the manager's Redis. no_world_write_adjust would make 7.1.11 strip world-write from the same data. suid_sgid_adjust is already off upstream and is pinned so that 7.1.13 never strips SUID bits inside container layers. The unowned-file search also excludes /var/lib/docker, /var/lib/ceph and /var/log/ceph, on top of the role's own exclusions. Container image layers alone are some 380k files per node; looping over them made 7.1.12 take most of a two-hour maintenance run and buried the few dozen host files the report is meant to show. - Level 2: the role defines ubtu24cis_level_2 but no task reads it, levels are selected by tags only. The 61 rules tagged level2-server and not level1-server in 1.7.0 are set to false one by one, between "# BEGIN level2" and "# END level2". Among them are 1.1.1.6 (blacklists overlayfs, breaks Docker), 5.2.4 (sudo with password, breaks the operator user and cephadm) and all of 6.2 (auditd). osism/release's ubuntu24_cis_level2 drift check compares the block with the pinned role version, so a role bump that adds Level 2 rules is flagged. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
force-pushed
the
ubuntu24-cis
branch
from
October 18, 2026 13:52
1bf0b01 to
cf50730
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
all/099-ubuntu24-cis.yml, the OSISM defaults for the UBUNTU24-CIS role (osism apply ubuntu24-cis,enable_cis_hardening): the CIS Level 1 server profile without the controls that break an OSISM node or rewrite files OSISM roles own. Operators tighten it withubtu24cis_*variables inenvironments/configuration.yml.The commit message lists every setting with its reason. In short:
disruption_high.rp_filter, router advertisements andtcp_syncookiesstay with OSISM (is_router, 3.3.7, 3.3.11, 3.3.10).journald.confand the rsyslog logrotate file stay with the OSISM roles that own them.# BEGIN level2and# END level2; osism/release'subuntu24_cis_level2drift check keeps that block in step with the pinned role.Should merge before the osism/release PR.
Part of:
🤖 Generated with Claude Code