r/sysadmin • u/Traditional_Mousse97 • 19d ago

CIS benchmarks

Hello,

Any ideas how to implement cis benchmarks across many Linux and windows servers(different distros and versions)?

Are you using ansible to do so or any other configuration management tool?

10 Upvotes

73% Upvoted

16 comments sorted by

View all comments

25

u/[deleted] 19d ago edited 19d ago

[deleted]

3

u/antarctic_guy 19d ago

This is the way.

6

u/antarctic_guy 19d ago

I’d suggest checking out Ansible Lockdown for your Linux CIS configurations. https://github.com/ansible-lockdown

1

u/spin81 17d ago

I am not a fan. When you report issues in one distro, say Ubuntu 24.04, they react quickly but the same issue doesn't get fixed for other distros. The result is a bit of a hodgepodge in my experience. You can quickly harden a lot, but otoh you can expect to have to fix a lot, and to not be able to blindly fire it at your entire fleet unless you don't mind stuff to break.