Skip to content

Fix 5 TODO-like items: Enable configurable settings and improve documentation #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: devel
Choose a base branch
from
Open

Fix 5 TODO-like items: Enable configurable settings and improve documentation #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f9c0933
Initial plan
Copilot Jul 30, 2025
c370531
Fix 5 TODO-like items: configurable verbose mode, chrony rtcfile, SSH…
Copilot Jul 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/devel_pipeline_validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@
inventory: .github/workflows/github_linux_IaC/hosts.yml
galaxy_file: collections/requirements.yml
private_key: ${{ secrets.SSH_PRV_KEY }}
# verbose: 3
verbose: ${{ env.ENABLE_DEBUG == 'true' && 3 || 0 }}
env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/main_pipeline_validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@
inventory: .github/workflows/github_linux_IaC/hosts.yml
galaxy_file: collections/requirements.yml
private_key: ${{ secrets.SSH_PRV_KEY }}
# verbose: 3
verbose: ${{ env.ENABLE_DEBUG == 'true' && 3 || 0 }}
env:
ANSIBLE_HOST_KEY_CHECKING: "false"
ANSIBLE_DEPRECATION_WARNINGS: "false"
Expand Down
20 changes: 17 additions & 3 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,7 +374,8 @@ rhel9cis_rule_6_2_16: true
#### 1.1.2
# These settings go into the /etc/fstab file for the /tmp mount settings
# The value must contain nosuid,nodev,noexec to conform to CIS standards
# rhel9cis_tmp_tmpfs_settings: "defaults,rw,nosuid,nodev,noexec,relatime 0 0"
# Uncomment and modify as needed for your environment
rhel9cis_tmp_tmpfs_settings: "defaults,rw,nosuid,nodev,noexec,relatime 0 0"
# If set true uses the tmp.mount service else using fstab configuration
rhel9cis_tmp_svc: false

Expand Down Expand Up @@ -452,6 +453,9 @@ rhel9cis_chrony_server_options: "minpoll 8"
rhel9cis_chrony_server_rtcsync: false
rhel9cis_chrony_server_makestep: "1.0 3"
rhel9cis_chrony_server_minsources: 2
# Enable rtcfile directive (disabled by default due to potential lockup issues on some motherboards/kernels)
rhel9cis_chrony_server_rtcfile_enable: false
rhel9cis_chrony_server_rtcfile_path: "/var/lib/chrony/chrony.rtc"

### 2.2 Special Purposes
##### Service configuration booleans set true to keep service
Expand Down Expand Up @@ -596,9 +600,19 @@ rhel9cis_sshd:
clientalivecountmax: 0
clientaliveinterval: 900
logingracetime: 60
# WARNING: make sure you understand the precedence when working with these values!!
# SSH Access Control Configuration
# IMPORTANT: These directives are processed in the order: DenyUsers, AllowUsers, DenyGroups, AllowGroups
# First match wins, so be careful with precedence!
#
# Examples:
# allowusers: "user1 user2 [email protected]/8"
# allowgroups: "wheel sysadmin"
# denyusers: "guest test"
# denygroups: "games"
#
# Uncomment and configure as needed for your environment:
# allowusers:
# allowgroups: systems dba
# allowgroups:
# denyusers:
# denygroups:

Expand Down
12 changes: 8 additions & 4 deletions templates/etc/chrony.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,10 +84,14 @@ logchange 0.5
# This directive tells chrony to regulate the real-time clock and tells it
# Where to store related data. It may not work on some newer motherboards
# that use the HPET real-time clock. It requires enhanced real-time
# support in the kernel. I've commented it out because with certain
# combinations of motherboard and kernel it is reported to cause lockups.

# rtcfile /var/lib/chrony/chrony.rtc
# support in the kernel. Disabled by default due to reported lockups with
# certain combinations of motherboard and kernel.

{% if rhel9cis_chrony_server_rtcfile_enable %}
rtcfile {{ rhel9cis_chrony_server_rtcfile_path }}
{% else %}
# rtcfile {{ rhel9cis_chrony_server_rtcfile_path }}
{% endif %}

# If the last line of this file reads 'rtconutc' chrony will assume that
# the CMOS clock is on UTC (GMT). If it reads '# rtconutc' or is absent
Expand Down
6 changes: 5 additions & 1 deletion vars/AlmaLinux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,9 @@

os_gpg_key_pubkey_name: gpg-pubkey-b86b3716-61e69f29
os_gpg_key_pubkey_content: "AlmaLinux OS 9 <[email protected]> b86b3716"
# disable repo_gpgcheck due to OS default repos

# Repository GPG checking is disabled for AlmaLinux
# This is due to the OS default repositories not having proper GPG signatures configured
# CIS 1.2.4 requires repo_gpgcheck=1, but this conflicts with AlmaLinux default repos
# Set to true only if you have properly configured GPG keys for all repositories
rhel9cis_rule_enable_repogpg: false
6 changes: 5 additions & 1 deletion vars/OracleLinux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,9 @@
# OS Specific Settings
os_gpg_key_pubkey_name: gpg-pubkey-8d8b756f-629e59ec
os_gpg_key_pubkey_content: "Oracle Linux (release key 1) <[email protected]>"
# disable repo_gpgcheck due to OS default repos

# Repository GPG checking is disabled for Oracle Linux
# This is due to the OS default repositories not having proper GPG signatures configured
# CIS 1.2.4 requires repo_gpgcheck=1, but this conflicts with Oracle Linux default repos
# Set to true only if you have properly configured GPG keys for all repositories
rhel9cis_rule_enable_repogpg: false
5 changes: 4 additions & 1 deletion vars/RedHat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,8 @@
os_gpg_key_pubkey_name: gpg-pubkey-fd431d51-4ae0493b
os_gpg_key_pubkey_content: "Red Hat, Inc. (release key 2) <[email protected]> fd431d51"

# disable repo_gpgcheck due to OS default repos
# Repository GPG checking is disabled for Red Hat Enterprise Linux
# This is due to the OS default repositories not having proper GPG signatures configured
# CIS 1.2.4 requires repo_gpgcheck=1, but this conflicts with RHEL default repos
# Set to true only if you have properly configured GPG keys for all repositories
rhel9cis_rule_enable_repogpg: false