anku33/RHEL9-CIS-Audit
1
0
Fork 0
mirror of https://github.com/ansible-lockdown/RHEL9-CIS-Audit.git synced 2026-06-01 18:40:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update cis311 with sysctl and kernel check

Browse Source 
Signed-off-by: Frederick Witty <frederick.witty@gotyto.com>
This commit is contained in:
Frederick Witty
2025-12-24 14:06:41 -05:00
parent ff32403911
commit 8ce0aefb55
1 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
section_3/cis_3.1/cis_3.1.1.yml
+39
View File
@@ -51,5 +51,44 @@ command:
NIST800-53R5:
- CM-7
{{ end }}
{{ if eq .Vars.rhel9cis_ipv6_disable_method: "sysctl" }}
ipv6_disabled_sysctl:
title: 3.1.1 | Ensure IPv6 status is identified
exec: sysctl -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
exit-status: 0
stdout:
- 'net.ipv6.conf.all.disable_ipv6 = 1'
- 'net.ipv6.conf.default.disable_ipv6 = 1'
meta:
server: 1
workstation: 1
CIS_ID:
- 3.1.1
CISv8: 4.8
CISv8_IG1: false
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- CM-7
{{ end }}
{{ if eq .Vars.rhel9cis_ipv6_disable_method: "kernel" }}
ipv6_disabled_kernel:
title: 3.1.1 | Ensure IPv6 status is identified
exec: grubby --info=ALL | grep 'ipv6.disable'
exit-status: 0
stdout:
- 'ipv6.disable=1'
meta:
server: 1
workstation: 1
CIS_ID:
- 3.1.1
CISv8: 4.8
CISv8_IG1: false
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- CM-7
{{ end }}
{{ end }}
{{ end }}