vars.yml

---
allowed_group: users
log_retention_time_in_months: 6
slackware_services:
  - inetd
  - yp
  - cups
  - cups-browsed
  - atd
debian_services:
  - avahi-daemon
  - bluetooth
  - hciuart
  - cups
  - cups-browsed
  - atd
  - ModemManager
  - triggerhappy
  - xinetd
  - inetd
  - rsync
  # for servers
  #- triggerhappy
  #- wpa_supplicant
  #- alsa-restore
  #- alsa-state
  #- hciuart
  # NFS stuff from nfs-common & nfs-kernel-server packages
  - nfs-blkmap
  - nfs-idmapd
  - nfs-mountd
  - nfs-server
  # CIS Debian Linux 12 Benchmark v1.1.0 - 09-26-2024      2.1.12 Ensure rpcbind services are not in use
  # CIS Distribution Independent Linux v2.0.0 - 07-16-2019 2.2.7 Ensure NFS and RPC are not enabled
  - rpcbind
allowed_services:
  - sshd
allowed_tcp_ports:
  - 22
sshd_config:
  Ciphers: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
  MACs: hmac-sha2-512-etm@openssh.com
  KexAlgorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
  HostKeyAlgorithms: ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512
  MaxAuthTries: 3
# Value from system-hardening-10.2.txt
fail_delay: 20
session_timeout: 15
nproc_limit: 8192
crypt_rounds: 500000
run_lynis_after_hardening: false
sudo_ids: false
sudo_iolog: false
aide_conf: '{% if ansible_distribution == "Slackware" %}/etc/aide.conf{% else %}/etc/aide/aide.conf{% endif %}'
pass_max_days: 365
pass_min_days: 7
pass_warn_age: 30
inactive_password_lock: 30
lynis_location: '{% if ansible_os_family == "RedHat" or ansible_distribution == "Slackware" %}/usr/bin/lynis{% else %}/usr/sbin/lynis{% endif %}'
chkrootkit_conf_dir: '/etc/chkrootkit'
cisofy_keyring: /etc/apt/keyrings/cisofy.asc
hsts_max_age: 600
clamav_location: '{% if (ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Ubuntu") and ansible_architecture == "x86_64" %}/usr/local/bin{% else %}/usr/bin{% endif %}'
clamav: {
  'socket': "/run/clamav/clamd.sock",
  'database': "/var/lib/clamav",
  'pid': "/run/clamav/clamd.pid"
}