Initial

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/prelim.yml

@@ -0,0 +1,119 @@
+---
+# Preliminary tasks that should always be run
+# List users in order to look files inside each home directory
+- name: "PRELIM | List users accounts"
+  command: "awk -F: '{print $1}' /etc/passwd"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: users
+
+- name: "PRELIM | Gather accounts with empty password fields"
+  shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: empty_password_accounts
+
+- name: "PRELIM | Gather UID 0 accounts other than root"
+  shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: uid_zero_accounts_except_root
+
+- name: "PRELIM | Gather system-wide crypto-policy"
+  shell: update-crypto-policies --show
+  args:
+      warn: no
+  changed_when: no
+  check_mode: no
+  register: system_wide_crypto_policy
+
+- name: "PRELIM | if systemd coredump"
+  stat:
+      path: /etc/systemd/coredump.conf
+  register: systemd_coredump
+  when:
+      - rhel9cis_rule_1_6_1
+
+- name: "PRELIM | Section 1.1 | Create list of mount points"
+  set_fact:
+      mount_names: "{{ ansible_mounts | map(attribute='mount') | list }}"
+
+- name: "PRELIM | Section 4.1 | Configure System Accounting (auditd)"
+  package:
+      name: audit
+      state: present
+  when: rhel9cis_level_2
+
+- name: "PRELIM | 4.1.12 | Ensure successful file system mounts are collected"
+  shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
+  changed_when: false
+  failed_when: false
+  check_mode: no
+  register: priv_procs
+  tags:
+  - always
+
+- name: "PRELIM | Section 5.1 | Configure cron"
+  package:
+      name: cronie
+      state: present
+
+- name: "PRELIM | Install authconfig"
+  package:
+      name: authconfig
+      state: present
+  when:
+      - rhel9cis_use_authconfig
+      - rhel9cis_rule_5_3_1 or
+        rhel9cis_rule_5_3_2 or
+        rhel9cis_rule_5_3_3
+
+- name: "PRELIM | Set facts based on boot type"
+  block:
+      - name: "PRELIM | Check whether machine is UEFI-based"
+        stat:
+            path: /sys/firmware/efi
+        register: rhel_09_efi_boot
+
+      - name: "PRELIM | AUDIT | set legacy boot and grub path | Bios"
+        set_fact:
+            rhel9cis_legacy_boot: true
+            grub2_path: /etc/grub2.cfg
+        when: not rhel_09_efi_boot.stat.exists
+
+      - name: "PRELIM | set grub fact | UEFI"
+        set_fact:
+            grub2_path: /etc/grub2-efi.cfg
+        when: rhel_09_efi_boot.stat.exists
+
+# - name: debug legacy boot var
+#   debug:
+#       msg: |
+#           legacy_boot={{ rhel9cis_legacy_boot }}
+#           grub2_path={{ grub2_path }}
+
+- name: "PRELIM | AUDIT | Ensure permissions on bootloader config are configured | Get grub config file stats"
+  stat:
+      path: "{{ grub2_path }}"
+  changed_when: false
+  register: grub_cfg
+
+# - name: debug grub stat
+#   debug:
+#       var: grub_cfg.stat
+
+- name: "PRELIM | Check for rhnsd service"
+  shell: "systemctl show rhnsd | grep LoadState | cut -d = -f 2"
+  changed_when: false
+  check_mode: false
+  register: rhnsd_service_status
+  when:
+      - rhel9cis_rule_1_2_2
+  tags:
+      - skip_ansible_lint