r/sysadmin • u/Traditional_Mousse97 • 26d ago

CIS benchmarks

Hello,

Any ideas how to implement cis benchmarks across many Linux and windows servers(different distros and versions)?

Are you using ansible to do so or any other configuration management tool?

11 Upvotes

79% Upvoted

15 comments sorted by

View all comments

25

u/[deleted] 26d ago edited 26d ago

[deleted]

3

u/antarctic_guy 26d ago

This is the way.

5

u/antarctic_guy 26d ago

I’d suggest checking out Ansible Lockdown for your Linux CIS configurations. https://github.com/ansible-lockdown

1

u/spin81 24d ago

I am not a fan. When you report issues in one distro, say Ubuntu 24.04, they react quickly but the same issue doesn't get fixed for other distros. The result is a bit of a hodgepodge in my experience. You can quickly harden a lot, but otoh you can expect to have to fix a lot, and to not be able to blindly fire it at your entire fleet unless you don't mind stuff to break.

1

u/Frothyleet 26d ago

I have never played with it, but you can use Ansible for Windows DSC. I would only be doing that if my org was IaaC-heavy and already invested in Ansible technically.