I am hardening a centos6.7 VM to CIS benchmark standards. I am automating as much as I can using Ansible.
The hardening document I am using is (page 12-13): https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_6_Benchmark_v1.1.0.pdf
I am trying to implement control 1.1.6 which has the following 2 checks and expects:
# grep -e "^/tmp" /etc/fstab | grep /var/tmp /tmp /var/tmp none none 0 0 # mount | grep -e "^/tmp" | grep /var/tmp /tmp on /var/tmp type none (rw,bind)
In order to try to accomplish this, I wrote 2 tasks:
mount: name: /var/tmp src: /tmp fstype: none opts: rw,bind state:mounted
lineinfile: dest: /etc/fstab state: present regexp: '^\/tmp' line: '/tmp /var/tmp none bind 0 0'
- is "/tmp /var/tmp none none 0 0" really the correct expected output? I have a nessus audit file that is expecting "/tmp /var/tmp none bind 0 0" Which one is correct?
- As things stand, these 2 tasks are not idempotent. The mount module runs and modifes the fstab file and then the lineinfile module rewrites what was changed in the fstab file. Every time the play runs, both tasks run and make changes. Is there a way to remedy that?
- Is this the correct way to approach correcting this control? I'm not sure if there is a cleaner way to approach this.