38270e7870
This patch changes any reference of openstack-ansible-security to ansible-hardening. Change-Id: Ib264e31a926c05380b0d1dcd630ad8f3fd1e58f3
47 lines
1.9 KiB
ReStructuredText
47 lines
1.9 KiB
ReStructuredText
Security hardening controls in detail (RHEL 6 STIG)
|
|
===================================================
|
|
|
|
The Security Technical Implementation Guide (STIG) for Red Hat Enterprise Linux
|
|
6 contains over 200 security controls. The links below will allow you to review
|
|
each control based on a certain set of criteria.
|
|
|
|
Controls are divided into groups based on certain properties:
|
|
|
|
* **Severity:** Normally high, medium and low. High severity items are the ones
|
|
which should be completed first, since they pose the greatest threat to the
|
|
security of a system.
|
|
*(These severity levels are set within the STIG.)*
|
|
|
|
* **Implementation status:** Each control is assessed thoroughly before Ansible
|
|
tasks are written. Some controls may be listed as *exceptions* since they
|
|
can't be implemented with automation, or they could cause damage to an
|
|
existing system. Other controls are listed as *opt-in* when they are
|
|
implemented, but they require a deployer to enable them.
|
|
*(This categorization comes from ansible-hardening, not the STIG.)*
|
|
|
|
* **Tag:** The controls are also separated based on which parts of the system
|
|
they act upon. Something that secures ``grub`` would be tagged with *boot*
|
|
while controls for ``sshd`` would be tagged with *auth*.
|
|
*(This categorization comes from ansible-hardening, not the STIG.)*
|
|
|
|
You can also review the STIG controls in one very large page. This can be
|
|
helpful when you need to search using your web browser.
|
|
|
|
.. note::
|
|
|
|
The RHEL 6 STIG content is deprecated in the Ocata release and will be
|
|
removed in a future release. Deployers can choose to deploy the RHEL 6
|
|
STIG content by setting the ``stig_version`` Ansible variable:
|
|
|
|
.. code-block:: console
|
|
|
|
ansible-playbook -i hosts playbook.yml -e stig_version=rhel7
|
|
|
|
.. toctree::
|
|
:maxdepth: 2
|
|
|
|
auto_controls-by-severity.rst
|
|
auto_controls-by-status.rst
|
|
auto_controls-by-tag.rst
|
|
auto_controls-all.rst
|