{"id":14984454,"url":"https://github.com/florianutz/ubuntu1604-cis","last_synced_at":"2025-09-19T05:32:56.464Z","repository":{"id":28082901,"uuid":"115824369","full_name":"florianutz/Ubuntu1604-CIS","owner":"florianutz","description":"Ubuntu CIS Hardening Ansible Role","archived":false,"fork":false,"pushed_at":"2024-07-09T17:28:14.000Z","size":119,"stargazers_count":89,"open_issues_count":13,"forks_count":50,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-01-12T01:07:34.787Z","etag":null,"topics":["ansible","ansible-role","cis","hardening","ubuntu"],"latest_commit_sha":null,"homepage":"","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/florianutz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-12-30T21:11:45.000Z","updated_at":"2023-05-12T16:49:44.000Z","dependencies_parsed_at":"2024-09-25T00:30:21.756Z","dependency_job_id":null,"html_url":"https://github.com/florianutz/Ubuntu1604-CIS","commit_stats":{"total_commits":95,"total_committers":9,"mean_commits":"10.555555555555555","dds":0.4631578947368421,"last_synced_commit":"ef5f06f60696beb6cc795378fdcd0fa9eaa521c9"},"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/florianutz%2FUbuntu1604-CIS","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/florianutz%2FUbuntu1604-CIS/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/florianutz%2FUbuntu1604-CIS/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/florianutz%2FUbuntu1604-CIS/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/florianutz","download_url":"https://codeload.github.com/florianutz/Ubuntu1604-CIS/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":233553762,"owners_count":18693317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","cis","hardening","ubuntu"],"created_at":"2024-09-24T14:09:05.394Z","updated_at":"2025-09-19T05:32:56.120Z","avatar_url":"https://github.com/florianutz.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"Ubuntu 16.04 CIS STIG\n================\n\n[![Build Status](https://travis-ci.com/florianutz/Ubuntu1604-CIS.svg?branch=master)](https://travis-ci.com/florianutz/Ubuntu1604-CIS)\n[![Ansible Role](https://img.shields.io/badge/role-florianutz.Ubuntu1604--CIS-blue.svg)](https://galaxy.ansible.com/florianutz/Ubuntu1604-CIS/)\n\nConfigure Ubuntu 16.04 machine to be CIS compliant. Level 1 and 2 findings will be corrected by default.\n\nThis role **will make changes to the system** that could break things. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.\n\n## IMPORTANT INSTALL STEP\n\nIf you want to install this via the `ansible-galaxy` command you'll need to run it like this:\n\n`ansible-galaxy install -p roles -r requirements.yml`\n\nWith this in the file requirements.yml:\n\n```\n- src: https://github.com/florianutz/Ubuntu1604-CIS.git\n```\n\nBased on [CIS Ubuntu Benchmark v1.1.0 - 12-28-2017 ](https://community.cisecurity.org/collab/public/index.php).\n\nThis repo originated from work done by [MindPointGroup](https://github.com/MindPointGroup/RHEL7-CIS)\n\nRequirements\n------------\n\nYou should carefully read through the tasks to make sure these changes will not break your systems before running this playbook.\n\nRole Variables\n--------------\nThere are many role variables defined in defaults/main.yml. This list shows the most important.\n\n**ubuntu1604cis_notauto**: Run CIS checks that we typically do NOT want to automate due to the high probability of breaking the system (Default: false)\n\n**ubuntu1604cis_section1**: CIS - General Settings (Section 1) (Default: true)\n\n**ubuntu1604cis_section2**: CIS - Services settings (Section 2) (Default: true)\n\n**ubuntu1604cis_section3**: CIS - Network settings (Section 3) (Default: true)\n\n**ubuntu1604cis_section4**: CIS - Logging and Auditing settings (Section 4) (Default: true)\n\n**ubuntu1604cis_section5**: CIS - Access, Authentication and Authorization settings (Section 5) (Default: true)\n\n**ubuntu1604cis_section6**: CIS - System Maintenance settings (Section 6) (Default: true)  \n\n##### Disable all selinux functions\n`ubuntu1604cis_selinux_disable: false`\n\n##### Service variables:\n###### These control whether a server should or should not be allowed to continue to run these services\n\n```\nubuntu1604cis_avahi_server: false  \nubuntu1604cis_cups_server: false  \nubuntu1604cis_dhcp_server: false  \nubuntu1604cis_ldap_server: false  \nubuntu1604cis_telnet_server: false  \nubuntu1604cis_nfs_server: false  \nubuntu1604cis_rpc_server: false  \nubuntu1604cis_ntalk_server: false  \nubuntu1604cis_rsyncd_server: false  \nubuntu1604cis_tftp_server: false  \nubuntu1604cis_rsh_server: false  \nubuntu1604cis_nis_server: false  \nubuntu1604cis_snmp_server: false  \nubuntu1604cis_squid_server: false  \nubuntu1604cis_smb_server: false  \nubuntu1604cis_dovecot_server: false  \nubuntu1604cis_httpd_server: false  \nubuntu1604cis_vsftpd_server: false  \nubuntu1604cis_named_server: false  \nubuntu1604cis_bind: false  \nubuntu1604cis_vsftpd: false  \nubuntu1604cis_httpd: false  \nubuntu1604cis_dovecot: false  \nubuntu1604cis_samba: false  \nubuntu1604cis_squid: false  \nubuntu1604cis_net_snmp: false  \n```  \n\n##### Designate server as a Mail server\n`ubuntu1604cis_is_mail_server: false`\n\n\n##### System network parameters (host only OR host and router)\n`ubuntu1604cis_is_router: false`  \n\n\n##### IPv6 required\n`ubuntu1604cis_ipv6_required: true`  \n\n\n##### AIDE\n`ubuntu1604cis_config_aide: true`\n\n###### AIDE cron settings\n```\nubuntu1604cis_aide_cron:\n  cron_user: root\n  cron_file: /etc/crontab\n  aide_job: '/usr/sbin/aide --check'\n  aide_minute: 0\n  aide_hour: 5\n  aide_day: '*'\n  aide_month: '*'\n  aide_weekday: '*'  \n```\n\n##### SELinux policy\n`ubuntu1604cis_selinux_pol: targeted`\n\n\n##### Set to 'true' if X Windows is needed in your environment\n`ubuntu1604cis_xwindows_required: no`\n\n\n##### Client application requirements\n```\nubuntu1604cis_openldap_clients_required: false\nubuntu1604cis_telnet_required: false\nubuntu1604cis_talk_required: false  \nubuntu1604cis_rsh_required: false\nubuntu1604cis_ypbind_required: false\n```\n\n##### Time Synchronization\n```\nubuntu1604cis_time_synchronization: chrony\nubuntu1604cis_time_Synchronization: ntp\n\nubuntu1604cis_time_synchronization_servers:\n    - 0.pool.ntp.org\n    - 1.pool.ntp.org\n    - 2.pool.ntp.org\n    - 3.pool.ntp.org  \n```  \n\n##### 3.4.2 | PATCH | Ensure /etc/hosts.allow is configured\n```\nubuntu1604cis_host_allow:\n  - \"10.0.0.0/255.0.0.0\"  \n  - \"172.16.0.0/255.240.0.0\"  \n  - \"192.168.0.0/255.255.0.0\"    \n```  \n\n```\nubuntu1604cis_firewall: firewalld\nubuntu1604cis_firewall: iptables\n```\n\n\nDependencies\n------------\n\nAnsible \u003e 2.2\n\nExample Playbook\n-------------------------\n\n```\n- name: Harden Server\n  hosts: servers\n  become: yes\n\n  roles:\n    - Ubuntu1604-CIS\n```\n\nTags\n----\nMany tags are available for precise control of what is and is not changed.\n\nSome examples of using tags:\n\n```\n    # Audit and patch the site\n    ansible-playbook site.yml --tags=\"patch\"\n```\n\nLicense\n-------\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflorianutz%2Fubuntu1604-cis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflorianutz%2Fubuntu1604-cis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflorianutz%2Fubuntu1604-cis/lists"}