Skip to content

Update RHEL10 CIS configuration #2452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
priteau wants to merge 7 commits into
base: stackhpc/2025.1
Choose a base branch
from
Open

Update RHEL10 CIS configuration #2452

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7d578d6
Fix typo in comment
priteau Jul 23, 2026
f7f97c1
Bump ansible-lockdown.rhel10_cis to 1.1.0 release
priteau Jul 23, 2026
4e1f296
Avoid duplicating SSH banner
priteau Jul 23, 2026
654f1e3
Avoid halting system when disk is full
priteau Jul 23, 2026
014e28f
Fix check for FIPS ed25519 keys
priteau Jul 23, 2026
766ba07
Switch crypto policy to DEFAULT on RHEL10
priteau Jul 23, 2026
947e671
Add release note for RHEL10 CIS changes
priteau Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion etc/kayobe/ansible/maintenance/cis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@
that:
- ssh_key_type != 'ed25519'
fail_msg: FIPS policy does not currently support ed25519 SSH keys on RHEL family systems
when: ansible_facts.os_family == 'RedHat' and rhel9cis_crypto_policy == 'FIPS'
when:
- ansible_facts.os_family == 'RedHat'
- (os_release | string == '9' and rhel9cis_crypto_policy == 'FIPS') or (os_release | string == '10' and rhel10cis_crypto_policy == 'FIPS')

- name: Ensure the cron package is installed on ubuntu
ansible.builtin.package:
Expand Down
2 changes: 1 addition & 1 deletion etc/kayobe/ansible/requirements.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ roles:
version: v1.3.4
- name: ansible-lockdown.rhel10_cis
src: https://github.com/ansible-lockdown/RHEL10-CIS
version: 1.0.2
version: 1.1.0
- name: wazuh-ansible
src: https://github.com/stackhpc/wazuh-ansible
version: stackhpc-v4.10.0
Expand Down
11 changes: 9 additions & 2 deletions etc/kayobe/inventory/group_vars/cis-hardening/cis
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ rhel9cis_auditd:
# Max size of audit logs (MB)
rhel9cis_max_log_file_size: 1024

# Disable setting of boatloader password. This requires setting the variable
# Disable setting of bootloader password. This requires setting the variable
# `rhel9cis_bootloader_password_hash`
rhel9cis_set_boot_pass: false

Expand All @@ -88,12 +88,16 @@ rhel10cis_auditd_max_log_file_size: 1024
rhel10cis_auditd_max_log_file: 10
rhel10cis_auditd_space_left_action: syslog

# Prevent system from halting if disk is full
rhel10cis_auditd_disk_full_action: suspend
Comment on lines +91 to +92

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔵 Trivial

Monitor the auditability trade-off of suspend.

This prevents a host halt, but audit logging stops while the partition is full. Confirm that monitoring detects this state and that log-space recovery is automatic.

@seunghun1ee seunghun1ee Jul 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not setting it to syslog like we did before?


# Set an authselect profile name (required)
rhel10cis_authselect_custom_profile_name: "stack"

# Set crypto policy
# NOTE: FIPS breaks ed25519 SSH keys
# NOTE: FUTURE breaks wazuh agent repo metadata download
rhel10cis_crypto_policy: FIPS
rhel10cis_crypto_policy: DEFAULT

# Skip configuration of the firewall
rhel10cis_firewall: None
Expand Down Expand Up @@ -122,6 +126,9 @@ rhel10cis_rule_1_2_2_1: false
rhel10cis_rule_2_3_1: false
rhel10cis_rule_2_3_2: false

# Avoid duplicate banner (already enabled by pam_motd)
rhel10cis_rule_5_1_5: false

# Disable requirement for password when using sudo
rhel10cis_rule_5_2_4: false

Expand Down
22 changes: 22 additions & 0 deletions releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
---
upgrade:
- |
Bumps the ``ansible-lockdown.rhel10_cis`` role to the 1.1.0 release.
- |
Switches default RHEL 10 crypto policy from ``FIPS`` to ``DEFAULT``
(``rhel10cis_crypto_policy: DEFAULT``). This only applies to the initial
CIS hardening execution because of `ansible-lockdown/RHEL10-CIS#111
<https://github.com/ansible-lockdown/RHEL10-CIS/issues/111>`__.
fixes:
- |
Fixes compatibility with ed25519 SSH keys by changing the default RHEL 10
crypto policy from ``FIPS`` to ``DEFAULT``.
- |
Fixes assertion check for ed25519 SSH keys in CIS playbook to correctly
check ``rhel10cis_crypto_policy`` on Rocky Linux 10 hosts.
- |
Sets ``rhel10cis_auditd_disk_full_action: suspend`` to prevent hosts from
halting if audit log partitions become full.
- |
Disables CIS rule 5.1.5 (``rhel10cis_rule_5_1_5: false``) in SSH
configuration to avoid duplicate banners on interactive SSH login.
Loading