ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Gramma Fix and fix to tss and nobody user

Browse source 
Signed-off-by: Kristian Ebdrup <kris9854@gmail.com>
This commit is contained in:
Kristian Ebdrup 2022-09-17 23:26:10 +02:00
parent d3477e2407
commit 04324e049d
3 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tasks/section_5/cis_5.1.x.yml
View file

@ -148,7 +148,7 @@
dest: /etc/at.deny
state: absent
- name: "5.1.9 | PATCH | Ensure at is restricted to authorized users | Check if at.allow exists"
- name: "5.1.9 | PATCH | Ensure at is restricted to authorized users | Check if at.allow exists"
stat:
path: "/etc/at.allow"
register: rhel9cis_5_1_9_at_allow_state

4
tasks/section_5/cis_5.2.x.yml
View file

@ -285,7 +285,7 @@
- ssh
- rule_5.2.14
- name: "5.2.15 | PATCH | Ensure SSH warning banner is configured"
- name: "5.2.15 | PATCH | Ensure SSH warning banner is configured"
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^Banner'
@ -332,7 +332,7 @@
- ssh
- rule_5.2.17
- name: "5.2.18 | PATCH | Ensure SSH MaxSessions is set to 10 or less"
- name: "5.2.18 | PATCH | Ensure SSH MaxSessions is set to 10 or less"
lineinfile:
path: /etc/ssh/sshd_config
regexp: "^#MaxSessions|^MaxSessions"

10
tasks/section_6/cis_6.1.x.yml
View file

@ -88,7 +88,7 @@
- permissions
- rule_6.1.4
- name: "6.1.5 | PATCH | Ensure permissions on /etc/group are configured"
- name: "6.1.5 | PATCH | Ensure permissions on /etc/group are configured"
file:
dest: /etc/group-
owner: root
@ -291,7 +291,7 @@
loop_control:
label: "{{ item.mount }}"
- name: "6.1.14 | AUDIT | Audit SUID executables | Alert no SUID executables exist"
- name: "6.1.14 | AUDIT | Audit SUID executables | Alert no SUID executables exist"
debug:
msg: "Good news! We have not found any SUID executable files on your system"
failed_when: false
@ -299,7 +299,7 @@
when:
- rhel_08_6_1_14_perms_results.stdout is not defined
- name: "6.1.14 | AUDIT | Audit SUID executables | Alert SUID executables exist"
- name: "6.1.14 | AUDIT | Audit SUID executables | Alert SUID executables exist"
debug:
msg: "Manual intervention is required -- SUID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_14_perms_results.stdout_lines }}"
@ -326,7 +326,7 @@
loop_control:
label: "{{ item.mount }}"
- name: "6.1.15 | AUDIT | Audit SGID executables | Alert no SGID executables exist"
- name: "6.1.15 | AUDIT | Audit SGID executables | Alert no SGID executables exist"
debug:
msg: "Good news! We have not found any SGID executable files on your system"
failed_when: false
@ -334,7 +334,7 @@
when:
- rhel_08_6_1_15_perms_results.stdout is not defined
- name: "6.1.15 | AUDIT | Audit SGID executables | Alert SGID executables exist"
- name: "6.1.15 | AUDIT | Audit SGID executables | Alert SGID executables exist"
debug:
msg: "Manual intervention is required -- SGID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_15_perms_results.stdout_lines }}"