How to harden Red Hat Enterprise Linux (RHEL) to the CIS benchmark using Ansible

[syedkhaledbhai]

Hi Ben,
Very Helpful Video, Need to Clarify Couple of things.
==> you installed ansible and performed hardening task on same machine. If I want to use Ansible as a separate machine and do hardening on multiple vm's . where do I need to perform below things
1. subscription manager enable (Ansible (or) host where I need to perform hardening)
2. install ansible scap-security guide (Ansible (or) host where I need to perform hardening)
3. Ansible playbook I know it will be executed from Ansible vm.

Appreciate your's response,
.Khaled Syed.

[marsamuk]

Hi Ben.I'm currently working on hardening RHEL 9 using the CIS Benchmarks playbook. However, I've noticed that some tasks are being skipped, even though the settings are relevant. I see the message skipping local host in the output. How can i troubleshoot why these tasks are being skipped? Any help would be greatly appreciated. Thanks!

[abdulsamad]

i want to scan multiple servers of rhel and centOS so far every research i did came to this conclusion that i have to use openscap for scanning and then ansible for hardening my concerns are that if swift wants an organization A do be complaint with cis benchmarks and if i use ansible for the hardening wouldnt it be considered as a third party source. and second how can would we be able to customize the benchmark if it is already present in the ansible package like if the organization suppose doesnt want particular areas to be hardened how will we do that.

[DJNuckChorris]

How can I approach this on an airgapped machine with no access to the red hat repo's?

[davidaustin]

Nice video, but in any production environment you wouldn't want to do this given you have no idea if the changes made will. have an impact. This is fine if you just want a vanilla CIS build.

[swetasingh]

what is you have make a live node compliant?

[mehmeteminkozankurt]

Hi Ben, when i perform this process for RHEL9 i get such an ERROR:

ERROR! couldn't resolve module/action 'ini_file'. This often indicates a misspelling, missing collection, or incorrect module path.

The error appears to be in line 525, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


- name: Disable the GNOME3 Login User List
^ here

what do you recommend for this situation?

[SatyamSingh-qoou]

Please create more videos on redhat satelite

[HubertKurowski-yibx]

Hi Ben,
I tried to harden but a lot of tasks were skipped. What can cause such action?

[JunaidAhmed-oxxd]

is there any other method available instead of using playbooks ?

[dewaynebranch]

nice, how do i practice this, that before and after... I see hipaa up there too

[rosli]

Hi. Performed this on RHEL 8.2 but after rebooting, unable to login. After keyin password, goes back to the login screen. Any advice?

[gagandeep]

Please confirm if this works for RHEL9 with ansible-core