RHEL6-STIG

An Ansible role that pushes RHEL 6 toward DISA STIG compliance, fixing CAT I findings by default and CAT II and III when you flip the right variables. It is a remediation tool, and it can break things.

The role configures RHEL 6 to meet the DISA STIG. CAT I findings, the most serious category, are corrected by default, while CAT II and CAT III only run when you enable the matching variables. Not everything can be automated though. The README points out that some findings need complex, environment specific automation, with notes left in the cat1, cat2, and cat3 task files.

The warning is blunt. This role changes the system and those changes could break things. It is not an auditing tool but a remediation tool, meant for hardening before or after an audit, and the README expects you to understand what the changes do, pointing to the DISA IASE site for details.

Configuration runs through defaults in the main defaults file, with the README listing the most important variables. The CAT I variable defaults to yes, CAT II and CAT III to no. Further down are things like the SNMP community string, minimum and maximum password age, the SELinux policy, whether to run yum updates, the maximum simultaneous logins, and whether X Windows, IPv6, or TFTP are in use, all of which shape how aggressively the role changes the box.

Every task carries tags: its category, its severity, whether it is a patch or audit task, and the finding ID, like V-38462. Human friendly tags such as ssh or dod logon banner sit alongside. A set of preliminary tasks that enumerate services and check for files runs every time unless you skip them with the prelim tasks tag.

• Source 1 · Project repository
• Source 2 · README