ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

improved new variable usage

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-04-10 07:56:52 +01:00
parent af2ffa2368
commit 4baa4d735b
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
1 changed files with 10 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
tasks/section_6/cis_6.2.x.yml
View file

@ -278,7 +278,7 @@
owner: "{{ item.id }}" owner: "{{ item.id }}"
group: "{{ item.gid }}" group: "{{ item.gid }}"
register: rhel_09_6_2_10_home_dir register: rhel_09_6_2_10_home_dir
loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | list }}" loop: "{{ discovered_interactive_uids.stdout_lines }}"
loop_control: loop_control:
label: "{{ item.id }}" label: "{{ item.id }}"
@ -290,7 +290,7 @@
etype: group etype: group
permissions: rx permissions: rx
state: present state: present
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: not system_is_container when: not system_is_container
- name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set other ACL" - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set other ACL"
@ -300,7 +300,7 @@
etype: other etype: other
permissions: 0 permissions: 0
state: present state: present
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: not system_is_container when: not system_is_container
when: when:
- rhel9cis_rule_6_2_10 - rhel9cis_rule_6_2_10
@ -320,10 +320,7 @@
loop_control: loop_control:
label: "{{ item.id }}" label: "{{ item.id }}"
when: when:
- item.uid >= min_int_uid | int - item.id in discovered_interactive_usernames.stdout
- item.id != 'nobody'
- (item.id != 'tss' and item.dir != '/dev/null')
- item.shell != '/sbin/nologin'
- rhel9cis_rule_6_2_11 - rhel9cis_rule_6_2_11
tags: tags:
- level1-server - level1-server
@ -338,7 +335,7 @@
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ item }}" path: "{{ item }}"
register: rhel_09_6_2_12_home_dir_perms register: rhel_09_6_2_12_home_dir_perms
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
- name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | amend if needed" - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | amend if needed"
ansible.builtin.file: ansible.builtin.file:
@ -359,7 +356,7 @@
etype: group etype: group
permissions: rx permissions: rx
state: present state: present
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: not system_is_container when: not system_is_container
- name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | Set other ACL" - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | Set other ACL"
@ -369,7 +366,7 @@
etype: other etype: other
permissions: 0 permissions: 0
state: present state: present
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: not system_is_container when: not system_is_container
when: when:
- rhel9cis_rule_6_2_12 - rhel9cis_rule_6_2_12
@ -385,7 +382,7 @@
ansible.builtin.file: ansible.builtin.file:
path: "{{ item }}/.netrc" path: "{{ item }}/.netrc"
state: absent state: absent
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: when:
- rhel9cis_rule_6_2_13 - rhel9cis_rule_6_2_13
tags: tags:
@ -400,7 +397,7 @@
ansible.builtin.file: ansible.builtin.file:
path: "{{ item }}/.forward" path: "{{ item }}/.forward"
state: absent state: absent
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: when:
- rhel9cis_rule_6_2_14 - rhel9cis_rule_6_2_14
tags: tags:
@ -415,7 +412,7 @@
ansible.builtin.file: ansible.builtin.file:
path: "~{{ item }}/.rhosts" path: "~{{ item }}/.rhosts"
state: absent state: absent
loop: "{{ interactive_users_home.stdout_lines }}" loop: "{{ discovered_interactive_users_home.stdout_lines }}"
when: when:
- rhel9cis_rule_6_2_15 - rhel9cis_rule_6_2_15
tags: tags: