exorCISm

CIS Benchmark hardening, packaged as one Ansible role per operating system target.

The collection is uoa_eresearch.exorcism, and the role for Ubuntu 24.04 LTS is ubuntu2404. Running the role with its shipped defaults gives a sensibly hardened host. It does not implement every CIS control, because some of them break working systems. Controls that carry that risk are opt-in, and everything the role cannot guess is a variable you supply.

• ansible-core 2.16 or later, which is the version Ubuntu 24.04 packages

Every change is tested against ansible-core 2.16, 2.19 and 2.21. Older versions may work and are not checked, so ansible-galaxy warns and continues on those.

ansible-galaxy collection install git+https://github.com/UoA-eResearch/exorCISm.git

That tracks the default branch. Pin to a release instead, so an upstream change cannot alter what a host gets on the next run.

ansible-galaxy collection install git+https://github.com/UoA-eResearch/exorCISm.git,v0.1.0

To pin it in a project, put the same reference in requirements.yml and install with ansible-galaxy collection install -r requirements.yml.

collections:
  - name: https://github.com/UoA-eResearch/exorCISm.git
    type: git
    version: v0.1.0

Always dry run first. This changes nothing and prints a diff of every file the role would write.

ansible-playbook uoa_eresearch.exorcism.ubuntu2404 -i inventory.yml --check --diff

Read the diff for /etc/ssh/sshd_config.d/90-ssh.conf before anything else. If you have set exorcism_ssh_allow_users, confirm your own account appears in it. Getting that wrong locks everyone out of the host.

When the diff looks right, apply it, and keep a second session open until you have confirmed you can still log in.

ansible-playbook uoa_eresearch.exorcism.ubuntu2404 -i inventory.yml

Add --limit web01 to target one host or group.

Every variable is optional. Running the role with none set still hardens the host. These are the ones most hosts need.

For a worked example covering these in context, see playbooks/ubuntu2404_example.yml. For the complete reference of all 61 variables with types, defaults and permitted values, run ansible-doc -t role uoa_eresearch.exorcism.ubuntu2404.

Variables fall into three kinds. Some are values the role cannot guess. Some are controls applied by default that you turn off when one breaks something. The rest are extra hardening left off by default because it can break a working system.

Three sections are off by default and are enabled per host. Set exorcism_section_1_3_apparmor_enabled to apply AppArmor, which confines applications by profile and blocks one whose profile does not match how you run it. Set exorcism_section_1_4_bootloader_enabled, with a hash from grub-mkpasswd-pbkdf2 in exorcism_grub_password_hash, to password-protect editing GRUB boot entries; the host still boots unattended. Set exorcism_section_6_3_integrity_enabled to install AIDE, whose first run builds a database of every file it watches and takes minutes to hours.

GDM configuration is on by default but applies only where GDM is installed, so a headless host is unaffected.

Most teams want their own playbook, so the variables live in their repository and get reviewed like any other change.

- name: Harden research compute nodes
  hosts: compute
  become: true
  roles:
    - role: uoa_eresearch.exorcism.ubuntu2404
      vars:
        exorcism_ssh_allow_users: [alice, bob]
        exorcism_ipv4_ip_forward: 1

For a mixed estate, put the variables in inventory group vars instead, so each group gets what it needs and the playbook stays empty.

The role changes SSH configuration, so be deliberate about how you connect.

Every CIS section carries a tag, so sections can be applied or skipped individually. List them with --list-tags, then use --tags 5.1_ssh to run one or --skip-tags 4.4_firewall to exclude one.