ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #3 from gbrcir1/patch-1

Browse source 
Update cis_5.3.x.yml
This commit is contained in:
Stefan Popa 2024-03-26 10:31:09 +02:00 • committed by GitHub
commit bab24475fd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 15 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

30
tasks/section_5/cis_5.3.x.yml
View file

@ -42,21 +42,21 @@
- sudo
- rule_5.3.3
- name: "5.3.4 | PATCH | Ensure users must provide password for escalation"
ansible.builtin.replace:
path: "{{ item }}"
regexp: '^([^#|{% if system_is_ec2 %}ec2-user{% endif %}].*)NOPASSWD(.*)'
replace: '\1PASSWD\2'
validate: '/usr/sbin/visudo -cf %s'
loop: "{{ rhel9cis_sudoers_files.stdout_lines }}"
when:
- rhel9cis_rule_5_3_4
tags:
- level2-server
- level2-workstation
- patch
- sudo
- rule_5.3.4
#- name: "5.3.4 | PATCH | Ensure users must provide password for escalation"
# ansible.builtin.replace:
# path: "{{ item }}"
# regexp: '^([^#|{% if system_is_ec2 %}ec2-user{% endif %}].*)NOPASSWD(.*)'
# replace: '\1PASSWD\2'
# validate: '/usr/sbin/visudo -cf %s'
# loop: "{{ rhel9cis_sudoers_files.stdout_lines }}"
# when:
# - rhel9cis_rule_5_3_4
# tags:
# - level2-server
# - level2-workstation
# - patch
# - sudo
# - rule_5.3.4
- name: "5.3.5 | PATCH | Ensure re-authentication for privilege escalation is not disabled globally"
ansible.builtin.replace: