ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

added uid discovery and usage

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-01-31 17:03:51 +00:00
parent 375847536b
commit 113d422dd4
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
5 changed files with 49 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

23
tasks/prelim.yml
View file

@ -190,3 +190,26 @@
tags:
- rule_1.2.2
- skip_ansible_lint
- name: "PRELIM | AUDIT | Discover Interactive UID MIN and MIN from logins.def"
block:
- name: "PRELIM | AUDIT | Capture UID_MIN information from logins.def"
shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
register: uid_min_id
- name: "PRELIM | AUDIT | Capture UID_MAX information from logins.def"
shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
register: uid_max_id
- name: "PRELIM | AUDIT | Capture GID_MIN information from logins.def"
shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
register: gid_min_id
- name: "PRELIM | AUDIT | set_facts for interactive uid/gid"
set_fact:
min_int_uid: uid_min_id.stdout
max_int_uid: uid_max_id.stdout
when:
- not discover_int_uid

4
tasks/section_5/cis_5.5.x.yml
View file

@ -13,7 +13,7 @@
- item.id != "sync"
- item.id != "shutdown"
- item.id != "halt"
- item.gid < rhel9cis_int_gid
- item.gid < min_int_uid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
@ -28,7 +28,7 @@
- item.id != "shutdown"
- item.id != "sync"
- item.id != "root"
- item.gid < rhel9cis_int_gid
- item.gid < min_int_uid
- item.shell != " /bin/false"
- item.shell != " /usr/sbin/nologin"
when:

6
tasks/section_6/cis_6.2.x.yml
View file

@ -134,7 +134,7 @@
- name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
stat:
path: "{{ item }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid) | selectattr('uid', '!=', max_int_uid) | map(attribute='dir') | list }}"
register: rhel_09_6_2_7_audit
- name: "6.2.7 | L1 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
@ -204,7 +204,7 @@
loop_control:
label: "{{ rhel9cis_passwd_label }}"
when:
- item.uid >= rhel9cis_int_gid
- item.uid >= min_int_uid
- rhel9cis_rule_6_2_8
tags:
- skip_ansible_lint # settings found on 6_2_7
@ -500,7 +500,7 @@
stat:
path: "{{ item }}"
register: rhel_09_6_2_20_audit
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', rhel9cis_int_gid) | selectattr('uid', '!=', 65534) | map(attribute='dir') | list }}"
with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid) | selectattr('uid', '!=', max_int_uid) | map(attribute='dir') | list }}"
- name: "6.2.20 | L1 | AUDIT | Ensure all users' home directories exist"
shell: find -H {{ item.0 | quote }} -not -type l -perm /027