RHEL9-CIS/tasks/prelim.yml

---
# Preliminary tasks that should always be run
# List users in order to look files inside each home directory
- name: "PRELIM | List users accounts"
  command: "awk -F: '{print $1}' /etc/passwd"
  args:
      warn: no
  changed_when: no
  check_mode: no
  register: users

- name: "PRELIM | Gather accounts with empty password fields"
  shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
  args:
      warn: no
  changed_when: no
  check_mode: no
  register: empty_password_accounts

- name: "PRELIM | Gather UID 0 accounts other than root"
  shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
  args:
      warn: no
  changed_when: no
  check_mode: no
  register: uid_zero_accounts_except_root

- name: "PRELIM | Gather system-wide crypto-policy"
  shell: update-crypto-policies --show
  args:
      warn: no
  changed_when: no
  check_mode: no
  register: system_wide_crypto_policy

- name: "PRELIM | if systemd coredump"
  stat:
      path: /etc/systemd/coredump.conf
  register: systemd_coredump
  when:
      - rhel9cis_rule_1_6_1

- name: "PRELIM | Section 1.1 | Create list of mount points"
  set_fact:
      mount_names: "{{ ansible_mounts | map(attribute='mount') | list }}"

- name: "PRELIM | Section 4.1 | Configure System Accounting (auditd)"
  package:
      name: audit
      state: present
  when: rhel9cis_level_2

- name: "PRELIM | 4.1.12 | Ensure successful file system mounts are collected"
  shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
  changed_when: false
  failed_when: false
  check_mode: no
  register: priv_procs
  tags:
  - always

- name: "PRELIM | Section 5.1 | Configure cron"
  package:
      name: cronie
      state: present

- name: "PRELIM | Install authconfig"
  package:
      name: authconfig
      state: present
  when:
      - rhel9cis_use_authconfig
      - rhel9cis_rule_5_3_1 or
        rhel9cis_rule_5_3_2 or
        rhel9cis_rule_5_3_3

- name: "PRELIM | Set facts based on boot type"
  block:
      - name: "PRELIM | Check whether machine is UEFI-based"
        stat:
            path: /sys/firmware/efi
        register: rhel_09_efi_boot

      - name: "PRELIM | AUDIT | set legacy boot and grub path | Bios"
        set_fact:
            rhel9cis_legacy_boot: true
            grub2_path: /etc/grub2.cfg
        when: not rhel_09_efi_boot.stat.exists

      - name: "PRELIM | set grub fact | UEFI"
        set_fact:
            grub2_path: /etc/grub2-efi.cfg
        when: rhel_09_efi_boot.stat.exists

# - name: debug legacy boot var
#   debug:
#       msg: |
#           legacy_boot={{ rhel9cis_legacy_boot }}
#           grub2_path={{ grub2_path }}

- name: "PRELIM | AUDIT | Ensure permissions on bootloader config are configured | Get grub config file stats"
  stat:
      path: "{{ grub2_path }}"
  changed_when: false
  register: grub_cfg

# - name: debug grub stat
#   debug:
#       var: grub_cfg.stat

- name: "PRELIM | Check for rhnsd service"
  shell: "systemctl show rhnsd | grep LoadState | cut -d = -f 2"
  changed_when: false
  check_mode: false
  register: rhnsd_service_status
  when:
      - rhel9cis_rule_1_2_2
  tags:
      - skip_ansible_lint