Update RHEL10 CIS configuration#2452
Conversation
When connecting via SSH to a CIS-hardened host, the following message is
displayed:
Authorized users only. All activity may be monitored and reported.
Authorized users only. All activity may be monitored and reported.
SSH is configured by ansible-lockdown with `Banner /etc/issue.net`,
which will print the content of /etc/issue.net which contains this line.
The authentication flow then goes through the default /etc/pam.d/sshd,
which includes pam_motd.so, printing the content of /etc/motd.
Remove Banner from sshd configuration to avoid duplicating the warning.
A side-effect is that no message is displayed when using non-interactive
sessions, e.g. when running `ssh <host> <command>`.
This is to avoid catastrophic outages if several audit log partitions were to become full at the same time.
The check was using the rhel9cis_crypto_policy variable even for Rocky Linux 10 hosts.
This restores compatibility with ed25519 SSH keys.
📝 WalkthroughUpdates RHEL10 CIS hardening for compatibility and correctness: upgrades the CIS role, fixes FIPS Ed25519 key checks, sets the crypto policy to WalkthroughUpdates RHEL CIS hardening roles and variables, adds RHEL 10 auditd and banner settings, expands FIPS SSH-key validation to RHEL 10, and documents the changes in release notes. ChangesRHEL CIS hardening
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ec5cd53a-80cb-4073-a775-eabd4aa13d62
📒 Files selected for processing (4)
etc/kayobe/ansible/maintenance/cis.ymletc/kayobe/ansible/requirements.ymletc/kayobe/inventory/group_vars/cis-hardening/cisreleasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: stackhpc/check
- GitHub Check: Ansible 2.17 lint with Python 3.10
- GitHub Check: Ansible 2.18 lint with Python 3.12
🔇 Additional comments (6)
etc/kayobe/ansible/requirements.yml (1)
24-24: LGTM!etc/kayobe/inventory/group_vars/cis-hardening/cis (3)
72-72: LGTM!
98-100: 🔒 Security & PrivacyConfirm that
DEFAULTis acceptable for every RHEL10 host.Line 100 removes FIPS as the shared RHEL10 default. That restores Ed25519 compatibility, but may violate deployments requiring FIPS; scope this override or document the exception explicitly.
129-130: 🔒 Security & PrivacyVerify that disabling rule 5.1.5 removes existing SSH
Bannerdirectives.This override may only stop the role from managing the rule. Hosts previously hardened with a
Bannerdirective could therefore retain the duplicate banner unless role version 1.1.0 performs cleanup on the false path.etc/kayobe/ansible/maintenance/cis.yml (1)
15-17: 🔒 Security & PrivacyUse the same OS-major fact as role selection.
The assertion uses
os_release, while Lines 55 and 60 select the CIS role withansible_facts.distribution_major_version. If these values differ—oros_releaseis undefined—the FIPS Ed25519 check can fail or be skipped. Prefer the Ansible fact here, or verify that both variables are guaranteed to match.releasenotes/notes/rhel10-cis-updates-f884f27770013f91.yaml (1)
1-22: LGTM!
| # Prevent system from halting if disk is full | ||
| rhel10cis_auditd_disk_full_action: suspend |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial
Monitor the auditability trade-off of suspend.
This prevents a host halt, but audit logging stops while the partition is full. Confirm that monitoring detects this state and that log-space recovery is automatic.
| rhel10cis_auditd_space_left_action: syslog | ||
|
|
||
| # Prevent system from halting if disk is full | ||
| rhel10cis_auditd_disk_full_action: suspend |
There was a problem hiding this comment.
Why not setting it to syslog like we did before?
2 participants
Various fixes to our RHEL10 CIS configuration, see release note for details.