Merge branch 'devel' of https://github.com/brisky/RHEL9-CIS into devel

defaults/main.yml

@@ -567,7 +567,7 @@ rhel9cis_logrotate: "daily"
 rhel9_cis_sshd_config_file: /etc/ssh/sshd_config
 
 rhel9cis_sshd:
-    clientalivecountmax: 0
+    clientalivecountmax: 3
     clientaliveinterval: 900
     logingracetime: 60
     # WARNING: make sure you understand the precedence when working with these values!!

tasks/post.yml

@@ -27,18 +27,13 @@
       - "'procps-ng' in ansible_facts.packages"
 
 - name: POST | Update usr sysctl
-  block:
+  ansible.builtin.lineinfile:
-     - name: POST | Set default.rp_filter
+      dest: /usr/lib/sysctl.d/50-default.conf
-       ansible.builtin.lineinfile:
+      regexp: "{{ item.regexp }}"
-        path: /usr/lib/sysctl.d/50-default.conf
+      line: "{{ item.line }}"
-        regexp: '^net.ipv4.conf.default.rp_filter'
+  loop:
-        line: net.ipv4.conf.default.rp_filter = 1
+      - { regexp: '^net.ipv4.conf.default.rp_filter', line: 'net.ipv4.conf.default.rp_filter = 1' }
-
+      - { regexp: '^net.ipv4.conf.*.rp_filter', line: 'net.ipv4.conf.*.rp_filter = 1' }
-     - name: POST | Set ALL rp_filter
-       ansible.builtin.lineinfile:
-        path: /usr/lib/sysctl.d/50-default.conf
-        regexp: '^net.ipv4.conf.*.rp_filter'
-        line: net.ipv4.conf.*.rp_filter = 1
   when:
       - rhel9cis_sysctl_update
       - not system_is_container

tasks/section_5/cis_5.6.x.yml

@@ -98,6 +98,11 @@
             regexp: '^USERGROUPS_ENAB'
             line: USERGROUPS_ENAB no
 
+      - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask on sessions /etc/pam.d/system-auth"
+        ansible.builtin.lineinfile:
+            path: /etc/pam.d/system-auth
+            line: 'session     required            pam_umask.so'
+            insertafter: EOF
   when:
       - rhel9cis_rule_5_6_5
   tags: