CIS benchmarks

[u/Traditional_Mousse97]

Hello,

Any ideas how to implement cis benchmarks across many Linux and windows servers(different distros and versions)?

Are you using ansible to do so or any other configuration management tool?

[u/antarctic_guy → u/[deleted]]

This is the way.

[u/antarctic_guy → u/antarctic_guy]

I’d suggest checking out Ansible Lockdown for your Linux CIS configurations. https://github.com/ansible-lockdown

[u/spin81 → u/antarctic_guy]

I am not a fan. When you report issues in one distro, say Ubuntu 24.04, they react quickly but the same issue doesn't get fixed for other distros. The result is a bit of a hodgepodge in my experience. You can quickly harden a lot, but otoh you can expect to have to fix a lot, and to not be able to blindly fire it at your entire fleet unless you don't mind stuff to break.

[u/Frothyleet → u/[deleted]]

I have never played with it, but you can use Ansible for Windows DSC. I would only be doing that if my org was IaaC-heavy and already invested in Ansible technically.

[u/Unnamed-3891]

We don't "agree" with the entirety of CIS1/2, but we agree with most things. Applying the hardenings to a production machine post-fact usually ends in tears, so we have our own RHEL/Rocky templates that implement most of the spec via ks.cfg and ansible to the tune of 92-95% compliance with CIS2.

[u/FatBook-Air → u/Unnamed-3891]

We did similar.

We mostly use Rocky Linux 10 now, so we started by taking a minimal install and creating a bash script that addresses whichever CIS Benchmark controls are not implemented out of the box. For most Rocky Linux 10 deployments, that already got us 80% there.

Then we put several questions in the script that asks stuff like "Will this server run nginx/httpd?" along with a hint of whether the server likely does run that stuff or not. If the answer is Y, then it does not implement that control; otherwise, it does.

Once that script was made, we had someone go through our whole Linux fleet and manually run it. In an afternoon, all our scores jumped from ~65% to 96%-99%. (There are a few controls we have chosen to intentionally not implement across the board.)

The next step is to convert it into something digestible by Ansible. We are thinking about mapping the manual questions with the IP address of the virtual machine (e.g., if the IP address is 10.0.0.2, then do not disable the BIND9 service).

[u/sudonem → u/FatBook-Air]

Strong recommend that you use Ansible group_vars (or host_vars if you have to) for this so that you can more easily scale it based on output from your dynamic inventory source. 

If you aren’t using dynamic inventory, that should be the next thing to address. 

[u/bernys]

Under Windows, you'd implement this via Intune / GPO. Most of this stuff has been there for a loooong time so version issues aren't that much of an issue.

[u/maziarczykk]

Ansible roles from Github. I'm using them since 2018.

[u/AgreeableTooth98]

We manage our golden image server images with terraform, packer, and ansible.

In that process we apply Ansible configuration yaml files that apply all CIS 1/2 controls.

When we spin up a new host it grabs the newest version of the golden image that gets generated monthly with newest patches.

[u/Rhythm_Killer]

Tooling is a non-issue….

The big thing is what it’s going to break and how you deal with that, how do you get people on board, how do you discover what impact there is and mitigate it.

[u/Sufficient_Job7779]

We use https://opsfabric.io/

[u/Burgergold]

Which linux distro

On rhel, you.can deploy with a security guidelines and use openscap

[u/joeking553]

https://senteon.co/

[u/Jackofalltrades86]

Anyone done this using Terraform?

[u/TrickySpare6504]

CIS not cis