Ability to audit a system using a lightweight binary to check the current state.
This is:
- very small < 14MB
- lightweight
- self contained
It works using a set of configuration files and directories to audit STIG of Amazon Linux 2023 servers. These files/directories correlate to the STIG Level and STIG_ID.
Feedback on any differences between OSs please raise an issue.
You must have goss available to your host you would like to test.
You must have sudo/root access to the system as some commands require privilege information.
Assuming you have already cloned this repository you can run goss from where you wish.
Please refer to the audit documentation for usage.
This also works alongside the Ansible Lockdown AMZN2023-STIG role
Which will:
- install
- audit
- remediate
- audit
file: vars/STIG.yml
Please refer to the file for all options and their meanings.
The listed variable for every control/benchmark can be turned on/off or section.
-
Other controls
- run_heavy_tasks
-
Bespoke options
If a site has specific options e.g. password complexity these can also be set.
If running as part of the ansible playbook, this will pull in the relevant branch for the version of benchmark you are remediating.
- e.g. v1.3.0 will pull in branch benchmark-v1.3.0
Devel is normally the latest benchmark version, so maybe different from the version of benchmark you wish to test. Details will show in the README as part of the remediation as to the benchmark for the version it is written for.
On our Discord Server to ask questions, discuss features, or just chat with other Ansible-Lockdown users
Ability to add your own requirements is available in several sections.