mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-27 07:23:07 +00:00
section 5 v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
f1c4d96412
commit
9755b0fb62
9 changed files with 1404 additions and 537 deletions
204
tasks/section_5/cis_5.3.3.2.x.yml
Normal file
204
tasks/section_5/cis_5.3.3.2.x.yml
Normal file
|
|
@ -0,0 +1,204 @@
|
|||
---
|
||||
|
||||
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.1
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Remove difok from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_difok_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: 'difok\s*=\s*\d+\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- /etc/pam.d/*-auth
|
||||
|
||||
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Ensure difok file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_difok_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_difok_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.2 | PATCH | Ensure password length is configured"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.2
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Remove minlen from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_minlen_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: 'minlen\s*=\s*\d+\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- '/etc/pam.d/*-auth'
|
||||
|
||||
- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Ensure minlen file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_minlen_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_minlen_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.3
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Remove pwd complex settings from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_complex_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: '(minclass|[dulo]credit)\s*=\s*(-\d|\d+)\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- '/etc/pam.d/*-auth'
|
||||
|
||||
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Ensure complexity file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_complex_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_complex_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.4
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Remove maxrepeat settings from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_maxrepeat_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: 'maxrepeat\s*=\s*\d+\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- '/etc/pam.d/*-auth'
|
||||
|
||||
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Ensure maxrepeat file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_maxrepeat_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_maxrepeat_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is is configured"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.5
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Remove maxsequence settings from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_maxsequence_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: 'maxsequence\s*=\s*\d+\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- '/etc/pam.d/*-auth'
|
||||
|
||||
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Ensure maxsequence file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_maxsequence_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_maxsequence_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_6
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.6
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
block:
|
||||
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Remove dictcheck settings from conf files except expected file"
|
||||
when:
|
||||
- item != rhel9cis_passwd_dictcheck_file
|
||||
ansible.builtin.replace:
|
||||
path: "{{ item }}"
|
||||
regexp: 'dictcheck\s*=\s*\d+\b'
|
||||
replace: ''
|
||||
with_fileglob:
|
||||
- '/etc/security/pwquality.conf'
|
||||
- '/etc/security/pwquality.conf.d/*.conf'
|
||||
- '/etc/pam.d/*-auth'
|
||||
|
||||
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Ensure dictcheck file exists"
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_dictcheck_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_dictcheck_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
|
||||
- name: "5.3.3.2.7 | PATCH | Ensure password quality is enforced for the root user"
|
||||
when:
|
||||
- rhel9cis_rule_5_3_3_2_7
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- patch
|
||||
- rule_5.3.3.2.7
|
||||
- NIST800-53R5_IA-5
|
||||
- pam
|
||||
ansible.builtin.template:
|
||||
src: "{{ rhel9cis_passwd_quality_enforce_root_file }}.j2"
|
||||
dest: "/{{ rhel9cis_passwd_quality_enforce_root_file }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
Loading…
Add table
Add a link
Reference in a new issue