From 7d578d6c0ff60b5e44d01314b931763e0fbf2903 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 17:19:40 +0200 Subject: [PATCH 1/7] Fix typo in comment --- etc/kayobe/inventory/group_vars/cis-hardening/cis | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 2226183669..486417062e 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -69,7 +69,7 @@ rhel9cis_auditd: # Max size of audit logs (MB) rhel9cis_max_log_file_size: 1024 -# Disable setting of boatloader password. This requires setting the variable +# Disable setting of bootloader password. This requires setting the variable # `rhel9cis_bootloader_password_hash` rhel9cis_set_boot_pass: false From f7f97c17f0e7ccd051f99fa87771cc70e3d2d1b4 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 17:36:55 +0200 Subject: [PATCH 2/7] Bump ansible-lockdown.rhel10_cis to 1.1.0 release --- etc/kayobe/ansible/requirements.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/kayobe/ansible/requirements.yml b/etc/kayobe/ansible/requirements.yml index 2690b17a37..dd5b61f1a2 100644 --- a/etc/kayobe/ansible/requirements.yml +++ b/etc/kayobe/ansible/requirements.yml @@ -21,7 +21,7 @@ roles: version: v1.3.4 - name: ansible-lockdown.rhel10_cis src: https://github.com/ansible-lockdown/RHEL10-CIS - version: 1.0.2 + version: 1.1.0 - name: wazuh-ansible src: https://github.com/stackhpc/wazuh-ansible version: stackhpc-v4.10.0 From 4e1f2966f40e5af692809faaa166331010d72444 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 18:01:23 +0200 Subject: [PATCH 3/7] Avoid duplicating SSH banner When connecting via SSH to a CIS-hardened host, the following message is displayed: Authorized users only. All activity may be monitored and reported. Authorized users only. All activity may be monitored and reported. SSH is configured by ansible-lockdown with `Banner /etc/issue.net`, which will print the content of /etc/issue.net which contains this line. The authentication flow then goes through the default /etc/pam.d/sshd, which includes pam_motd.so, printing the content of /etc/motd. Remove Banner from sshd configuration to avoid duplicating the warning. A side-effect is that no message is displayed when using non-interactive sessions, e.g. when running `ssh `. --- etc/kayobe/inventory/group_vars/cis-hardening/cis | 3 +++ 1 file changed, 3 insertions(+) diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 486417062e..1e67e733c4 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -122,6 +122,9 @@ rhel10cis_rule_1_2_2_1: false rhel10cis_rule_2_3_1: false rhel10cis_rule_2_3_2: false +# Avoid duplicate banner (already enabled by pam_motd) +rhel10cis_rule_5_1_5: false + # Disable requirement for password when using sudo rhel10cis_rule_5_2_4: false From 654f1e3bb902249f5a749d68a301ea78c75b4437 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 18:02:09 +0200 Subject: [PATCH 4/7] Avoid halting system when disk is full This is to avoid catastrophic outages if several audit log partitions were to become full at the same time. --- etc/kayobe/inventory/group_vars/cis-hardening/cis | 3 +++ 1 file changed, 3 insertions(+) diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 1e67e733c4..43018d7713 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -88,6 +88,9 @@ rhel10cis_auditd_max_log_file_size: 1024 rhel10cis_auditd_max_log_file: 10 rhel10cis_auditd_space_left_action: syslog +# Prevent system from halting if disk is full +rhel10cis_auditd_disk_full_action: suspend + # Set an authselect profile name (required) rhel10cis_authselect_custom_profile_name: "stack" From 014e28f951243655a0ca0247685dd5782adad780 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 18:29:49 +0200 Subject: [PATCH 5/7] Fix check for FIPS ed25519 keys The check was using the rhel9cis_crypto_policy variable even for Rocky Linux 10 hosts. --- etc/kayobe/ansible/maintenance/cis.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/kayobe/ansible/maintenance/cis.yml b/etc/kayobe/ansible/maintenance/cis.yml index c14f0c1185..ffbe895432 100644 --- a/etc/kayobe/ansible/maintenance/cis.yml +++ b/etc/kayobe/ansible/maintenance/cis.yml @@ -12,7 +12,9 @@ that: - ssh_key_type != 'ed25519' fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems - when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS' + when: + - ansible_facts.os_family == 'RedHat' + - (os_release | string == '9' and rhel9cis_crypto_policy == 'FIPS') or (os_release | string == '10' and rhel10cis_crypto_policy == 'FIPS') - name: Ensure the cron package is installed on ubuntu ansible.builtin.package: From 766ba07bb951f054519e795bd6655ae9a6dfb85e Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 18:34:53 +0200 Subject: [PATCH 6/7] Switch crypto policy to DEFAULT on RHEL10 This restores compatibility with ed25519 SSH keys. --- etc/kayobe/inventory/group_vars/cis-hardening/cis | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 43018d7713..25c9855e85 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -95,8 +95,9 @@ rhel10cis_auditd_disk_full_action: suspend rhel10cis_authselect_custom_profile_name: "stack" # Set crypto policy +# NOTE: FIPS breaks ed25519 SSH keys # NOTE: FUTURE breaks wazuh agent repo metadata download -rhel10cis_crypto_policy: FIPS +rhel10cis_crypto_policy: DEFAULT # Skip configuration of the firewall rhel10cis_firewall: None From 947e6719e68d0241cd1e4538a6db0546c6174106 Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 23 Jul 2026 19:14:22 +0200 Subject: [PATCH 7/7] Add release note for RHEL10 CIS changes --- .../rhel10-cis-updates-f884f27770013f91.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml diff --git a/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml b/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml new file mode 100644 index 0000000000..929c689ffa --- /dev/null +++ b/releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml @@ -0,0 +1,22 @@ +--- +upgrade: + - | + Bumps the ``ansible-lockdown.rhel10_cis`` role to the 1.1.0 release. + - | + Switches default RHEL 10 crypto policy from ``FIPS`` to ``DEFAULT`` + (``rhel10cis_crypto_policy: DEFAULT``). This only applies to the initial + CIS hardening execution because of `ansible-lockdown/RHEL10-CIS#111 + `__. +fixes: + - | + Fixes compatibility with ed25519 SSH keys by changing the default RHEL 10 + crypto policy from ``FIPS`` to ``DEFAULT``. + - | + Fixes assertion check for ed25519 SSH keys in CIS playbook to correctly + check ``rhel10cis_crypto_policy`` on Rocky Linux 10 hosts. + - | + Sets ``rhel10cis_auditd_disk_full_action: suspend`` to prevent hosts from + halting if audit log partitions become full. + - | + Disables CIS rule 5.1.5 (``rhel10cis_rule_5_1_5: false``) in SSH + configuration to avoid duplicate banners on interactive SSH login.