From cf507307deaab71cc5fb2055567ede807505b338 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Mon, 5 Oct 2026 13:49:07 +0200 Subject: [PATCH] Add defaults for ubuntu24-cis OSISM 11 integrates ansible-lockdown/UBUNTU24-CIS as "osism apply ubuntu24-cis" and, with enable_cis_hardening: true, in bootstrap and maintenance. The role's own defaults (1.7.0) apply Level 1 and Level 2 with disruption_high and a ufw firewall, which would break an OSISM node. all/099-ubuntu24-cis.yml carries the values OSISM ships instead: the Level 1 server profile without the controls that conflict with how OSISM runs a node. Operators tighten it in configuration.yml. Not changed, and documented in the OSISM 11 release notes instead: 1.5.5 and 2.2.4/2.2.6 uninstall apport and the telnet and ftp clients, which removes the ubuntu-server and ubuntu-standard metapackages; the next maintenance run's autoremove then takes the packages they pulled in (open-vm-tools, fwupd, udisks2, tcpdump, nano, ...). Whether OSISM keeps any of them is left open. - Firewall: section 4 is off. firewall_package: none alone would still run the 4.1.1 audit. - disruption_high is off, which also skips locking system accounts (5.4.2.7, 5.4.2.8). - Routing sysctls: is_router skips the forwarding and redirect rules (3.3.1, 3.3.2, 3.3.8). 3.3.7 (rp_filter=1) and 3.3.11 (accept_ra=0) are not guarded by is_router and are turned off explicitly. 3.3.7 writes /etc/sysctl.conf, which systemd loads after sysctl.d, so it would override osism.services.frr's rp_filter=2 after a reboot. - tcp_syncookies: osism.commons.sysctl sets it to 0 on the rabbitmq group, which 3.3.10 would reset to 1 on every run, so 3.3.10 is off. - Logging: the role's journald default sets ForwardToSyslog=no and enables systemd-journal-upload to a placeholder host. OSISM ships host logs journald -> rsyslog -> fluentd, so syslog_service is rsyslog and 6.1.3.6 (forwarding to the same placeholder) is off. - Time sync: 2.3.3.1 adds the NIST servers and 2.3.3.2 a user line to chrony.conf, which osism.services.chrony owns and rewrites; both are off. Ubuntu's chronyd runs as _chrony already. - rsync: 2.1.13 removes the rsync package by default, which breaks every rsync to the hosts (tbng's checks, the testbed's manager setup). rsync_mask keeps the client and masks the daemon, which is what the rule is about. - Files OSISM roles own are left to them, so that repeated maintenance runs do not rewrite them back and forth: login banners (1.6.1-1.6.3, osism.commons.motd), journald.conf (6.1.1.3 would also override OSISM's journald sizing with a drop-in; 6.1.3.3) and the rsyslog logrotate file (6.1.3.8). - AIDE is off; its scans would walk /var/lib/docker and Ceph hosts. - File sweeps report instead of fixing. Docker volume and Ceph data is owned by container users without a host account. With ownership_adjust, 7.1.12 chowns all of it to root, which on a test cluster broke MariaDB, the Ceph OSDs, Prometheus and the manager's Redis. no_world_write_adjust would make 7.1.11 strip world-write from the same data. suid_sgid_adjust is already off upstream and is pinned so that 7.1.13 never strips SUID bits inside container layers. The unowned-file search also excludes /var/lib/docker, /var/lib/ceph and /var/log/ceph, on top of the role's own exclusions. Container image layers alone are some 380k files per node; looping over them made 7.1.12 take most of a two-hour maintenance run and buried the few dozen host files the report is meant to show. - Level 2: the role defines ubtu24cis_level_2 but no task reads it, levels are selected by tags only. The 61 rules tagged level2-server and not level1-server in 1.7.0 are set to false one by one, between "# BEGIN level2" and "# END level2". Among them are 1.1.1.6 (blacklists overlayfs, breaks Docker), 5.2.4 (sudo with password, breaks the operator user and cephadm) and all of 6.2 (auditd). osism/release's ubuntu24_cis_level2 drift check compares the block with the pinned role version, so a role bump that adds Level 2 rules is flagged. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-ubuntu24-cis.yml | 133 +++++++++++++++++++++++++++++++++++++++ all/README.md | 4 ++ 2 files changed, 137 insertions(+) create mode 100644 all/099-ubuntu24-cis.yml diff --git a/all/099-ubuntu24-cis.yml b/all/099-ubuntu24-cis.yml new file mode 100644 index 0000000..48a43ea --- /dev/null +++ b/all/099-ubuntu24-cis.yml @@ -0,0 +1,133 @@ +--- +########################## +# ubuntu24_cis +# +# Defaults for ansible-lockdown/UBUNTU24-CIS, run by `osism apply ubuntu24-cis` +# and, with enable_cis_hardening: true, by bootstrap and maintenance. Level 1 +# server profile without the controls that break an OSISM node. Tighten in +# environments/configuration.yml. + +# Firewalling is not managed on OSISM nodes. firewall_package: none alone +# still runs 4.1.1. +ubtu24cis_section4: false + +ubtu24cis_disruption_high: false + +# Time sync is osism.services.chrony's. 2.3.3.1 would add the NIST servers +# and 2.3.3.2 a user line to chrony.conf, which that role rewrites again. +ubtu24cis_rule_2_3_3_1: false +ubtu24cis_rule_2_3_3_2: false + +# Login banners are osism.commons.motd's (motd, issue, issue.net). +ubtu24cis_rule_1_6_1: false +ubtu24cis_rule_1_6_2: false +ubtu24cis_rule_1_6_3: false + +# 2.1.13 is about the rsync daemon. Mask it instead of removing the package, +# which OSISM and its tooling use as a client. +ubtu24cis_rsync_mask: true + +# Nodes forward for OVS/OVN and kolla: skips 3.3.1, 3.3.2 and 3.3.8. +ubtu24cis_is_router: true +# rp_filter is OSISM's (osism.services.frr sets 2). 3.3.7 would set 1 in +# /etc/sysctl.conf, which loads after sysctl.d. +ubtu24cis_rule_3_3_7: false +# Router advertisements +ubtu24cis_rule_3_3_11: false +# osism.commons.sysctl sets tcp_syncookies=0 on the rabbitmq group. +ubtu24cis_rule_3_3_10: false + +# Host logs go journald -> rsyslog -> fluentd (osism.services.rsyslog). The +# journald default sets ForwardToSyslog=no and uploads to a placeholder host. +ubtu24cis_syslog_service: rsyslog +# Remote forwarding to ubtu24cis_remote_log_server +ubtu24cis_rule_6_1_3_6: false +# osism.services.journald and osism.services.rsyslog own journald.conf and +# the rsyslog logrotate file. 6.1.1.3 would comment out OSISM's journald sizing +# and override it with a drop-in; 6.1.3.3 and 6.1.3.8 edit what those roles +# rewrite on every run. +ubtu24cis_rule_6_1_1_3: false +ubtu24cis_rule_6_1_3_3: false +ubtu24cis_rule_6_1_3_8: false + +# AIDE would scan /var/lib/docker and Ceph hosts. +ubtu24cis_config_aide: false + +# Docker volume and Ceph data is owned by container users without a host +# account. Report instead of fixing: 7.1.12 would chown it to root, 7.1.11 +# would strip world-write from it, 7.1.13 SUID/SGID bits (sudo, ping) in +# container layers. +ubtu24cis_ownership_adjust: false +ubtu24cis_no_world_write_adjust: false +ubtu24cis_suid_sgid_adjust: false +# The role's exclusions plus Docker and Ceph data, so the 7.1.12 report lists +# host files rather than every container layer (some 380k files per node). +# Re-check the role's own list on a version bump. +ubtu24cis_exclude_unowned_search_path: '\( ! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*" -a ! -path "/snap/*" -a ! -path "/var/lib/docker/*" -a ! -path "/var/lib/ceph/*" -a ! -path "/var/log/ceph/*" \)' + +# Level 2 only. The role ignores ubtu24cis_level_2, so each rule is disabled +# here. osism/release's ubuntu24_cis_level2 drift check compares this block +# with the pinned role version. +# BEGIN level2 +ubtu24cis_rule_1_1_1_6: false +ubtu24cis_rule_1_1_1_7: false +ubtu24cis_rule_1_1_1_8: false +ubtu24cis_rule_1_1_2_3_1: false +ubtu24cis_rule_1_1_2_4_1: false +ubtu24cis_rule_1_1_2_5_1: false +ubtu24cis_rule_1_1_2_6_1: false +ubtu24cis_rule_1_1_2_7_1: false +ubtu24cis_rule_1_3_1_4: false +ubtu24cis_rule_1_7_1: false +ubtu24cis_rule_2_1_20: false +ubtu24cis_rule_3_2_1: false +ubtu24cis_rule_3_2_2: false +ubtu24cis_rule_3_2_3: false +ubtu24cis_rule_3_2_4: false +ubtu24cis_rule_5_1_8: false +ubtu24cis_rule_5_1_9: false +ubtu24cis_rule_5_2_4: false +ubtu24cis_rule_5_3_3_1_3: false +ubtu24cis_rule_5_4_1_2: false +ubtu24cis_rule_5_4_3_1: false +ubtu24cis_rule_6_2_1_1: false +ubtu24cis_rule_6_2_1_2: false +ubtu24cis_rule_6_2_1_3: false +ubtu24cis_rule_6_2_1_4: false +ubtu24cis_rule_6_2_2_1: false +ubtu24cis_rule_6_2_2_2: false +ubtu24cis_rule_6_2_2_3: false +ubtu24cis_rule_6_2_2_4: false +ubtu24cis_rule_6_2_3_1: false +ubtu24cis_rule_6_2_3_2: false +ubtu24cis_rule_6_2_3_3: false +ubtu24cis_rule_6_2_3_4: false +ubtu24cis_rule_6_2_3_5: false +ubtu24cis_rule_6_2_3_6: false +ubtu24cis_rule_6_2_3_7: false +ubtu24cis_rule_6_2_3_8: false +ubtu24cis_rule_6_2_3_9: false +ubtu24cis_rule_6_2_3_10: false +ubtu24cis_rule_6_2_3_11: false +ubtu24cis_rule_6_2_3_12: false +ubtu24cis_rule_6_2_3_13: false +ubtu24cis_rule_6_2_3_14: false +ubtu24cis_rule_6_2_3_15: false +ubtu24cis_rule_6_2_3_16: false +ubtu24cis_rule_6_2_3_17: false +ubtu24cis_rule_6_2_3_18: false +ubtu24cis_rule_6_2_3_19: false +ubtu24cis_rule_6_2_3_20: false +ubtu24cis_rule_6_2_3_21: false +ubtu24cis_rule_6_2_4_1: false +ubtu24cis_rule_6_2_4_2: false +ubtu24cis_rule_6_2_4_3: false +ubtu24cis_rule_6_2_4_4: false +ubtu24cis_rule_6_2_4_5: false +ubtu24cis_rule_6_2_4_6: false +ubtu24cis_rule_6_2_4_7: false +ubtu24cis_rule_6_2_4_8: false +ubtu24cis_rule_6_2_4_9: false +ubtu24cis_rule_6_2_4_10: false +ubtu24cis_rule_6_3_3: false +# END level2 diff --git a/all/README.md b/all/README.md index 79d65dc..e1faa77 100644 --- a/all/README.md +++ b/all/README.md @@ -308,6 +308,10 @@ Three things to keep in mind about the result: ceph-ansible, k3s, playbooks). - **`099-generic.yml`** — host/OS-level config (docker, chrony, hardening, operator user); not kolla. +- **`099-ubuntu24-cis.yml`** — OSISM-safe defaults for the UBUNTU24-CIS role + (`osism apply ubuntu24-cis`, `enable_cis_hardening`). The block between + `# BEGIN level2` and `# END level2` must match the pinned role; osism/release's + `ubuntu24_cis_level2` drift check reports the toggles to add or remove. - **`099-hosts.yml`** — OSISM playbook control vars. - **`099-infrastructure.yml`** — OSISM "infrastructure" services (cephclient, openstackclient, traefik, squid, …). An explicit exception — a version value