RHEL 7 DISA STIG

This role is still under active development.

Configure a RHEL 7 system to be DISA STIG compliant. CAT I findings will be corrected and audited by default. CAT II and III findings can be enabled by setting the appropriate variables to yes.

This role is based on RHEL 7 DISA STIG: Version 1, Rel 2 released on July 28, 2017.

Requirements

RHEL 7. Other versions are not supported. passlib >= 1.7 on the control node

Role Variables

Name	Default Value	Description
`rhel7stig_cat1_audit`	`yes`	Audit for CAT I findings
`rhel7stig_cat2_audit`	`no`	Audit for CAT II findings
`rhel7stig_cat3_audit`	`no`	Audit for CAT III findings
`rhel7stig_cat1_patch`	`yes`	Correct CAT I findings
`rhel7stig_cat2_patch`	`no`	Correct CAT II findings
`rhel7stig_cat3_patch`	`no`	Correct CAT III findings
`rhel7stig_gui`	`no`	Whether or not to run tasks related to auditing/patching the desktop environment
`rhel7stig_av_package`	`no`	Anti-virus package(s) to install and service to start and enable.
`rhel7stig_antivirus_required`	`no`	Weather or not an antivirus must be installed
`rhel7stig_time_service`	`chronyd`	Set to `ntpd` or `chronyd`.
`rhel7stig_firewall_service`	`firewalld`	Set to `firewalld` or `iptables`.
`rhel7stig_lftpd_required`	`no`	If set to `no`, remove `lftpd`.
`rhel7stig_tftp_required`	`no`	If set to `no`, remove `tftp` client and server packages.
`rhel7stig_snmp_community`	`Endgam3Ladyb0g`	SNMP community string that will replace `public` and `private` in `snmpd.conf`.
`rhel7stig_bootloader_password`	`Boot1tUp!`	GRUB2 bootloader password. This should be stored in an Ansible Vault.
`rhel7stig_logon_banner`	`[see defaults/main.yml]`	Logon banner displayed when logging in to the system. Defaults to nicely formatted standard logon banner.

Dependencies

None

Example Playbook

- hosts: servers
  roles:
    - role: rhel7-stig
      when:
        - ansible_os_family == 'RedHat'
        - ansible_distribution_major_version | version_compare('7', '=')

License