2

I am hardening a centos6.7 VM to CIS benchmark standards. I am automating as much as I can using Ansible.

The hardening document I am using is (page 12-13): https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_6_Benchmark_v1.1.0.pdf

I am trying to implement control 1.1.6 which has the following 2 checks and expects:

# grep -e "^/tmp" /etc/fstab | grep /var/tmp
/tmp /var/tmp none none 0 0
# mount | grep -e "^/tmp" | grep /var/tmp
/tmp on /var/tmp type none (rw,bind) 

In order to try to accomplish this, I wrote 2 tasks:

mount:
  name: /var/tmp
  src: /tmp
  fstype: none
  opts: rw,bind
  state:mounted

and

lineinfile:
  dest: /etc/fstab
  state: present
  regexp: '^\/tmp'
  line: '/tmp /var/tmp none bind 0 0'

Questions:

  1. is "/tmp /var/tmp none none 0 0" really the correct expected output? I have a nessus audit file that is expecting "/tmp /var/tmp none bind 0 0" Which one is correct?
  2. As things stand, these 2 tasks are not idempotent. The mount module runs and modifes the fstab file and then the lineinfile module rewrites what was changed in the fstab file. Every time the play runs, both tasks run and make changes. Is there a way to remedy that?
  3. Is this the correct way to approach correcting this control? I'm not sure if there is a cleaner way to approach this.

Thanks.

  • Binding /var/tmp to /tmp establishes an unbreakable link to /tmp that cannot be removed (even by the root user). Can someone explain what they mean ? – pawel7318 Jan 7 '16 at 22:36
2

This is a typo in the "Audit" section of the PDF, as a "none none" entry results in an error, while "none bind" (from the "Remediation" section) works:

% grep /var/tmp /etc/fstab 
/tmp /var/tmp none none 0 0
% sudo mount -a           
mount: unknown filesystem type 'none'
% sudo ed /etc/fstab 
832
/\/var\/tmp
/tmp /var/tmp none none 0 0
s/none 0/bind 0
/tmp /var/tmp none bind 0 0
w
832
q
% sudo mount -a     
% 
  • Additionally, the idempotence issue might be due to passing rw,bind for options, but then expecting bind in the options field. – sourcejedi Nov 8 '17 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.