---
# defaults file for cis-security see variable descriptions in security-rollup/README.md

### Mandatory Access controls
## Red Hat and Red Hat clones using selinux
selinux: "enforcing"            # Options are enforcing, permissive, and disabled. Control is 'enforcing'
selinux_policy: "targeted"      # Options are targeted, minimum, or mls. Control has no default
crypto_policy: "DEFAULT"        # Options are DEFAULT, FIPS, or LEGACY

## Ubuntu, ubuntu clones, and SLES using apparmor
apparmor_level: "enforce"     # Set all profiles in /etc/apparmor.d/* to this level. Options are enforce or complain

# Network Time Services
time_service: "chrony"          # Linux: Option for RHEL7/Ubuntu only; options are 'chrony' or 'timesyncd'.
                                #  RHEL8/9 only ships with chrony and this variable is not used
                                #  Linux: Choices are 'ntp' or chrony'. For Ubuntu, this can also accept 'none' as an option to use only systemd timedatectl
time_server: "2.rhel.pool.ntp.org" # Linux: Time server for ntp, chrony, or timedatectl
time_operators:                 # Windows: Users that can set the system time
  - "Administrators"
  - "LOCAL SERVICE"
time_user: "_chrony"            # Linux: Ubuntu 22 only, user to run time daemon as

# Sudo Configuration
sudo_log: "/var/log/sudoers"    # Linux: log file for sudo

# GDM Timeout Configuration
idle_delay: 900                 # Seconds of inactivity before locking screen
lock_delay: 5                   # Seconds of blank screen before locking

# AIDE configuration settings
aide_db_name: "/var/lib/aide/aide.db.gz"        # Linux: Database name that AIDE will look for for comparison
aide_new_db_name: "/var/lib/aide/aide.db.new.gz" # Linux: Database name created during an --init run
aide_gzip: "yes"                                 # Linux: 'yes' or 'no' to enable gzip compression on database

# Yum repos and system updates
update_system: false            # Linux: Update the system to the latest during the role run
gpgcheck: true                  # Linux: Enable GPG checks on ALL repos
enable_audit: true              # Linux: Enable auditing of processes and filesystem changes
audit_backlog_limit: 8192       # Linux: RHEL default is 8MB backlog limit

# Server roles, setting any of the variables to false will remove the default RHEL packages for that service.
#  Setting them to true will not remove them, but will not set them up.
dhcp_server: false              # Linux: DHCP Server
dns_server: false               # Linux: DNS Server
email_server: false             # Linux: Mail Server, If set to true, and the packages exist, it will set mail relay to local only
ftp_server: false               # Linux: FTP SErver
http_server: false              # Linux: HTTP Server (will remove dependent packages as well)
nfs_server: false               # Linux: NFS Server
proxy_server: false             # Linux: Squid proxy server
smb_server: false               # Linux: Samba Server
tftp_server: false              # Linux: TFTPd Server. Option for RHEL7 only

# Desktop roles, see 'Server roles' above.
ypbind: false
graphical_interface: false      # Whether to disable the GDM greeter service. The service will disabled on 'false'

# Services
service_bluetooth:              # Linux: Ubuntu 22 only. Set to 'false' to disable bluetooth service

# Logging services variables
log_service: "journald"         # journald or rsyslog for logging. Choose one. Currently only implemented in RHEL 8/9!
remote_log_service: false       # Whether to configure journald to start systemd-journal-remote.service
log_host: false                 # Linux: Whether this machine will host rsyslog messages for other machines
log_port: 514                   # Linux: Port to listen to RSYSLOG messages on (if log_host is true)
log_file: /var/log/audit/auditd.log # Linux: path and location of audit log
log_file_size: 8                # Linux: log file size. RHEL default is 8MB, control has no default
log_group: root                 # Group that owns the auditd log files (root or adm) RHEL 8/9
rsyslog_file:                   # Linux: Copy file listed for configuring rsyslog
logrotate_file:                 # Linux: RHEL 8/9, Copy file listed for logrotate

# network security settings
tcpwrappers: false              # Linux: Configure tcpwrappers controls. RHEL 7 control only
tcpwrappers_pkg: "tcp_wrappers" # Linux: Name of tcp wrappers package in repository
enable_firewall: firewalld      # Linux: supported values are firewalld (RHEL), nftables (RHEL, Ubuntu) or iptables (Ubuntu)
firewalld_default_zone: public  # Linux: default firwall zone
motd_use: true                  # Linux: RHEL 9: set to 'true' to use motd file, 'false' to not use
motd_file: "banner"             # Linux: File location by default in 'files' directory
issue_use: true                 # Linux: RHEL 9: set to 'true' to use issue file, 'false' to not use
issue_file: "issue"             # Linux: File location by default in 'files' directory
issue_net_use: true             # Linux: RHEL 9: set to 'true' to use issue.net file, 'false' to not use
issue_net_file: "issue"         # Linux: File location by default in 'files' diretory
ipv6_disable: true              # Common: Set to true to disable ipv6 support on host

# Cron/at variables
cron_allow: []                  # Linux: RHEL9, list of users to add to cron.allow
at_allow: []                  # Linux: RHEL9, list of users to add to at_allow.allow

# SSH Server settings
ssh_log_level: INFO             # Linux: Control is INFO or VERBOSE. Stricter is not approved and more verbose exposes user info
ssh_max_auth_tries: 4           # Linux: Control is 4 retries
ssh_mac_list: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com"
                                # Linux: RHEL7 only control
ssh_ciphers_list: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
                                # Linux: Ubuntu control only
ssh_kex_list:
  - 'curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1'
                                # Linux: Ubuntu control only
ssh_alive_interval: 300         # Linux: Control is 5 minutes
ssh_alive_count_max: 0          # Linux: Control is 0 count
ssh_grace_time: 60              # Linux: Control is for 60 seconds or less
ssh_max_sessions: 4             # Linux: Control is 4 sessions from a single host
ssh_login_banner: issue.net     # Linux: a file with no path will exist in the role's files directory, an absolute path will exist on the control host
ssh_allowed_users: ""           # Linux: RHEL9, space separated list of users to add to AllowUsers list
ssh_allowed_groups: ""          # Linux: RHEL9, space separated list of users to add to DenyUsers list
ssh_denied_users: "root"            # Linux: RHEL9, space separated list of users to add to AllowGroups list
ssh_denied_groups: ""           # Linux: RHEL9, space separated list of users to add to DneyGroups list

# Password and account settings, all settings below match controls
password_min_length: 14           # Common
password_req_digit: true          # Linux
password_req_upper: true          # Linux
password_req_lower: true          # Linux
password_req_special: true        # Linux
password_hash_alg: "yescrypt"      # Linux (RHEL 8/9), set password hashing algorithm, set to 'sha512' or 'yescrypt'
password_min_days: 7              # Common: Windows has this control listed as 1 day
password_expire_days: 365         # Common: Windows has this control listed as 24 days
password_warning_days: 7          # Common: Windows has this control listed as 'between 5 and 14 days'
password_inactive_lock_days: 30   # Linux
password_failed_attempts: 5       # RHEL 9: Number of attempts before locking account
password_failed_time: 900         # RHEL 9: amount of time to lock an account that has exceeded failed attemps
password_history: 24              # Windows: number of passwords to remember.
password_max_repeat: 3            # Linux: Ubuntu 22 only, number of same characters in a passwd
account_lockout_duration: 15      # Windows:
account_lockout_threshold: 10     # Windows:
account_reset_duration: 15        # Windows:
cached_logins: 4                  # Windows: Number of login credentials to cache
enable_guest: false               # Windows: enable guest account
rename_guest: "Guest"             # Windows: name of guest account. Will have no effect if enable_gues variable is set to false
enable_administrator: true        # Windows: enable Administrator account
rename_administrator: "Administrator" # Windows: name of Administrator account. Will have no effect if enable_Administrator variable is set to false
dc_network_logon_right:           # Windows: Users that have access to log on from the network (domain controllers)
  - "Administrators"
  - "Authenticated Users"
  - "ENTERPRISE DOMAIN CONTROLLERS"
ms_network_logon_right:           # Windows: Users that have access to log on from the network (member servers and standalone servers)
  - "Administrators"
  - "Authenticated Users"
local_logon_right:                # Windows: Users that have access to log onto the console
  - "Administrators"
dc_rds_logon_right:               # Windows: Users that have access to log onto the system through Remote Desktop Services (domain controller)
  - "Administrators"
  - "Remote Desktop Users"
ms_rds_logon_right:               # Windows: Users that have access to log onto the system through Remote Desktop Services (member or standalone server)
  - "Administrators"
adjust_memory_quotas:             # Windows: Users that can adjust the memory quotas for a process
  - "Administrators"
  - "LOCAL SERVICE"
  - "NETWORK SERVICE"
backup_operators:                 # Windows: Users that can backup files and diretories via a backup application
  - "Administrators"
dc_symbolic_link_right:           # Windows: Users that can create symbolic links.
  - "Administrators"
ms_symbolic_link_right:           # Windows: Users that can create symbolic links. If Hyper-V is installed, this should include "Virtual Machines"
  - "Administrators"
  - 'NT VIRTUAL MACHINE\Virtual Machines'
max_machine_account_days: 30      # Windows: Maximum number of days a machine can keep its password before changing. A zero here will
                                  #  automatically be changed to 30 by the task to force some password rotation

# Environment settings, all settings below match controls
shell_timeout: 900                # Linux:
default_umask: "027"              # Linux: Control is 027 or more strict
inactivity_timeout: 900           # Windows: Number of seconds before screen saver. A zero here will default to 900 for some security

smart_card_removal: 1             # Windows. what do do when a smart card used for authentication is removed.
                                  # Options that can be set in or take effect:
                                  #  1 - Lock Workstation
                                  #  2 - Force Logoff
                                  #  3 - Disconnect if a Remote Desktop Services session
smb_inactivity_minutes: 15        # Windows. Minutes until server suspends SMB connection due to inactivity
spn_level: 1                      # Windows. level of validation with shared folders the server performs on the service principal name
                                  # Options that can be set in or take effect:
                                  #  1 - Accept if provided by client
                                  #  2 - Required from client
ldap_client_signing: 1            # Windows. Sign ldap client communications
                                  # Options that can be set to take effect:
                                  #  1 - Negotiate signing
                                  #  2 - Require signing
uac_prompt_for_consent_admin: 2   # Windows. When to prompt admins for elevated Admin Approval Mode
                                  #  0 - Elevate without prompting
                                  #  1 - Prompt for credentials on the secure desktop
                                  #  2 - Prompt for consent on the secure desktop (default)
                                  #  3 - Prompt for credentials
                                  #  4 - Prompt for consent
                                  #  5 - Prompt for consent for non-Windows binaries
uac_prompt_for_consent_user: 3    # Windows. When to prompt users for elevated Admin Approval Mode
                                  #  0 - Automatically deny elevation requests
                                  #  1 - Prompt for credentials on the secure desktop
                                  #  3 - Prompt for credentials
screensaver_grace_time: 0         # Windows. Seconds from screen saver start until computer locks
win_application_log_size: "32768" # Windows. Max application event log file size
win_security_log_size: "196608"   # Windows. Max security event log file size
win_setup_log_size: "32768"      # Windows. Max setup event log file size
win_system_log_size: "32768"      # Windows. Max setup event log file size
disable_automatic_updates: "0"     # Windows. Disable automatic updates. Set to '1' to disable automatic updates. (Choose if using 3rd party update systems)
au_update_options: "4"            # Windows. Configure automatic updates. Possible values
                                  #  2 - Notify for download and auto install (Notify before downloading any updates)
                                  #  3 - Auto download and notify for install (Download the updates automatically and notify. ) (Default)
                                  #  4 - Auto download and schedule the install (Automatically download updates and install them on the schedule specified.)
                                  #  5 - Allow local admin to choose setting (Leave decision on above choices up to the local Administrators (Not Recommended)
au_update_day: "0"                # Windows. Configure which day automatic updates will be installed.
                                  #  Only takes effect if "automatic_updates" == "4". Possible values
                                  #  0 - Every delay
                                  #  1 - Every Sunday
                                  #  2 - Every Monday
                                  #  3 - Every Tuesday
                                  #  4 - Every Wednesday
                                  #  5 - Every Thursday
                                  #  6 - Every Friday
                                  #  7 - Every Saturday
au_update_time: "3"               # Windows. Configure what time automatic updates will be installed.
                                  #  Only takes effect if "automatic_updates" == "4". This is the hour portion of the
                                  #   time only. "3" means 03:00am. Set this value to '24' for windows to automatically pick a time
