-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
36 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,38 +1,63 @@ | ||
Role Name | ||
ANSSI-BP-028 (high) | ||
========= | ||
|
||
A brief description of the role goes here. | ||
Ansible Role for ANSSI-BP-028 (high) | ||
|
||
Profile Description: | ||
This profile contains configurations that align to ANSSI-BP-028 at the high hardening level. | ||
ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. | ||
ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. | ||
A copy of the ANSSI-BP-028 can be found at the ANSSI website: | ||
https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ | ||
|
||
The tasks that are used in this role are generated using OpenSCAP. | ||
See the OpenSCAP project for more details on Ansible playbook generation at [https://github.com/OpenSCAP/openscap](https://github.com/OpenSCAP/openscap) | ||
|
||
To submit a fix or enhancement for an Ansible task that is failing or missing in this role, | ||
see the ComplianceAsCode project at [https://github.com/ComplianceAsCode/content](https://github.com/ComplianceAsCode/content) | ||
|
||
Requirements | ||
------------ | ||
|
||
Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. | ||
- Ansible version 2.9 or higher | ||
|
||
Role Variables | ||
-------------- | ||
|
||
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. | ||
To customize the role to your liking, check out the [list of variables](defaults/main.yml). | ||
|
||
Dependencies | ||
------------ | ||
|
||
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. | ||
N/A | ||
|
||
Example Playbook | ||
Example Role Usage | ||
---------------- | ||
|
||
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: | ||
Run `ansible-galaxy install RedHatOfficial.rhel9_anssi_bp28_high` to | ||
download and install the role. Then, you can use the following playbook snippet to run the Ansible role: | ||
|
||
- hosts: servers | ||
- hosts: all | ||
roles: | ||
- { role: username.rolename, x: 42 } | ||
- { role: RedHatOfficial.rhel9_anssi_bp28_high } | ||
|
||
Next, check the playbook using (on the localhost) the following example: | ||
|
||
ansible-playbook -i "localhost," -c local --check playbook.yml | ||
|
||
To deploy it, use (this may change configuration of your local machine!): | ||
|
||
ansible-playbook -i "localhost," -c local playbook.yml | ||
|
||
License | ||
------- | ||
|
||
BSD | ||
BSD-3-Clause | ||
|
||
Author Information | ||
------------------ | ||
|
||
An optional section for the role authors to include contact information, or a website (HTML is not allowed). | ||
This Ansible remediation role has been generated from the body of security | ||
policies developed by the ComplianceAsCode project. Please see | ||
[https://github.com/complianceascode/content/blob/master/Contributors.md](https://github.com/complianceascode/content/blob/master/Contributors.md) | ||
for an updated list of authors and contributors. |