aide

This task initializes aide and copies the aide database

aideinit

ora_secured

pg_secured

sce_linux

Finds groups that exist in /etc/passwd but do not exist in /etc/group

audit_etcpasswd_groups

Verify if /etc/shadow have empty password fields

audit_etc_shadow

Returns the results of firewall-cmd --list-all

audit_firewalld_config

Report only approved services are listening on a network interface

audit_approved_services_listening

Audit authselect profile for RHEL family systems version 8+.

audit_authselect

Audit if the system is configured to boot to the command line or to the graphical user interface.

audit_boot

audit_check_ipv6

Audit DNS servers configured in /etc/resolv.conf

audit_client_dns

audit_dconf_policy_keyfiles

Finds and returns duplicate GIDs in /etc/group

audit_duplicate_gid

Finds and returns duplicate group names in /etc/group.

audit_duplicate_group_names

Finds duplicate UIDs in /etc/passwd and returns the UID and all users that use it

audit_duplicate_uid

Finds and returns duplicate user names in /etc/passwd.

audit_duplicate_user_names

Audit all accounts expiration dates for removal.

audit_for_emergency_accounts

Report journald log rotation is configured per site policy

audit_journald_log_rotation

Report journald is not configured to send logs to rsyslog

audit_journald_logs_to_rsyslog

List all the keytab files on the system at /etc

audit_kerberos_keytab_files

Audit library directories permission, ownership, and group ownership

audit_library_directories

Audit library files permission, ownership, and group ownership

audit_library_files

Audit McAfee Endpoint Security for RHEL-family systems.

audit_mcafee_endpoint_security

Audit for the no-execution bit flag on the system

audit_no_execution_bit_flag

audit_partition_crypto

This task will report on whether the screen is locked or not when using smart card.

audit_pkcs11_eventmgr

Returns the last password change date for all users

audit_pw_change_date

Returns the output of 'semanage user -l' on the target system

audit_selinux_user_roles

audit_sgid_executables

Finds and returns any users in the shadow group

audit_shadow_group

This task checks that the given SSH provate keys are passphrase protected.

audit_ssh_key_authorized_access

audit_sshd_installation

audit_sshd_status

Audit the existance of sssd certmap configuration

audit_sssd_certmap

Return the sudo authentication timeout in minutes

audit_sudo_authentication_timeout

Return instances of NOPASSWD:  in sudo configuration files.

audit_sudo_nopasswd

Returns a list of any ungrouped sudo configuration entries that contain !authenticate.

audit_sudo_re_authentication

audit_suid_executables

Audit system commands permission, ownership and group ownership

audit_system_command_permission

Audit system device files are correctly labeled 

audit_system_device_files

This task audits system file permissions against their defaults

audit_system_file_permissions

Audits system files and commands to ensure the cryptographic hashes match the vendor's published values.

audit_system_files_and_commands

Returns a list of all unconfined services

audit_unconfined_services

Returns a list of any unowned files and directories

audit_ungrouped_files_and_directories

audit_unowned_files_and_directories

Audits user homedirs on the host. Does not make any changes to the system with default parameter values.

audit_user_homedir

Returns a list of any world-writable directories not owned by a service account

audit_world_writable_directories

Audit world writable directories based on GID

audit_world_writable_directories_gid

Returns a list of any world-writable files

audit_world_writable_files

Report all the locations of grub.cfg files on the system

bootloader_on_removable_media

A convenience task to delete files on nodes.

delete_files

Finds and deletes .shosts and shosts.equiv files on the target system. Satisfies RHEL 7 DISA STIG V-204606 and V-204607.

delete_shosts

Checks for users with blank passwords in /etc/shadow and sets the passwords to the default

enforce_user_passwords

Returns all the tunnels configured in '/etc/ipsec.conf' and '/etc/ipsec.d'.

ipsec_configured_tunnels

Report the current installed version of the Red Hat Operating System

operating_system_version_check

Report all installed packages on the RHEL family system to check whether the security patches or update are installed.

package_security_updates_check

query_apt_gpg_keys

Queries for services with established TCP / UDP connections

query_listening_services

query_rpm_gpg_keys

query_yum_repos

Register a system with RedHat subscription manager

redhat_subscription_manager

root_password

Audits root path integrity. Must be run as root

root_path_integrity

Ensures no other accounts besides root have a UID of 0

root_uid

This task return the ports that do not have UFW rules

sce_ufw_port_rules

system_account

Updates and reinstall bootloader configuration

update_bootloader

db2_secured

sce_windows

Deletes c:\windows	emp\SecurityPolicy.inf If this file becomes corrupted and/or is in a security state that prevents the Puppet agent from writing to it this can cause various DSC_* errors and can pervent the Puppet making changes to the effected system.

Refine results

Compatibility

Quality Score

Endorsements

Features

Latest Release

Oops, something's broken…