mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-26 23:13:06 +00:00
updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
398bc5bd0c
commit
c6caa90059
36 changed files with 2584 additions and 2078 deletions
|
|
@ -1,131 +1,61 @@
|
|||
---
|
||||
|
||||
- name: |
|
||||
"5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
|
||||
5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
|
||||
5.4.3 | L1 | PATCH | Ensure password reuse is limited
|
||||
5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
|
||||
- name: "5.4.1 | PATCH | Ensure custom authselect profile is used"
|
||||
block:
|
||||
- name: "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set pwquality config settings"
|
||||
lineinfile:
|
||||
state: present
|
||||
dest: /etc/security/pwquality.conf
|
||||
regexp: ^{{ item.name }}
|
||||
line: "{{ item.name }} = {{ item.value }}"
|
||||
with_items:
|
||||
- { name: minlen, value: "{{ rhel9cis_pam_password.minlen }}" }
|
||||
- { name: minclass, value: "{{ rhel9cis_pam_password.minclass }}" }
|
||||
when: rhel9cis_rule_5_4_1
|
||||
- name: "5.4.1 | AUDIT | Ensure custom authselect profile is used | Gather profiles"
|
||||
shell: 'authselect current | grep "Profile ID: custom/"'
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
register: rhel9cis_5_4_1_profiles
|
||||
|
||||
- name: |
|
||||
"5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings
|
||||
5.4.3| L1 | PATCH | Ensure password reuse is limited | Set system-auth remember settings"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/system-auth
|
||||
state: present
|
||||
regexp: '^password requisite pam_pwquality.so'
|
||||
line: "password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
|
||||
insertbefore: '^#?password ?'
|
||||
when:
|
||||
- rhel9cis_rule_5_4_1 or
|
||||
rhel9cis_rule_5_4_3
|
||||
- name: "5.4.1 | AUDIT | Ensure custom authselect profile is used | Show profiles"
|
||||
debug:
|
||||
msg:
|
||||
- "Below are the current custom profiles"
|
||||
- "{{ rhel9cis_5_4_1_profiles.stdout_lines }}"
|
||||
|
||||
- name: "5.4.1 | L1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/password-auth
|
||||
state: present
|
||||
regexp: '^password requisite pam_pwquality.so'
|
||||
line: "password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3"
|
||||
insertbefore: '^#?password ?'
|
||||
when: rhel9cis_rule_5_4_1
|
||||
|
||||
- name: "5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured | Add deny count and unlock time for preauth"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/{{ item }}
|
||||
state: present
|
||||
regexp: '^auth required pam_faillock.so preauth'
|
||||
line: "auth required pam_faillock.so preauth silent deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
|
||||
insertafter: '^#?auth ?'
|
||||
with_items:
|
||||
- "system-auth"
|
||||
- "password-auth"
|
||||
when: rhel9cis_rule_5_4_2
|
||||
|
||||
- name: "5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured | Add deny count and unlock times for authfail"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/{{ item }}
|
||||
state: present
|
||||
regexp: '^auth required pam_faillock.so authfail'
|
||||
line: "auth required pam_faillock.so authfail deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
|
||||
insertafter: '^#?auth ?'
|
||||
with_items:
|
||||
- "system-auth"
|
||||
- "password-auth"
|
||||
when: rhel9cis_rule_5_4_2
|
||||
|
||||
- name: |
|
||||
"5.4.3 | L1 | PATCH | Ensure password reuse is limited | Set system-auth remember remember settings
|
||||
5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512 | Set system-auth pwhash settings"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/system-auth
|
||||
state: present
|
||||
regexp: '^password sufficient pam_unix.so'
|
||||
line: "password sufficient pam_unix.so {{ rhel9cis_pam_faillock.pwhash }} shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}"
|
||||
insertafter: '^#?password ?'
|
||||
when:
|
||||
- rhel9cis_rule_5_4_3 or
|
||||
rhel9cis_rule_5_4_4
|
||||
|
||||
- name: "5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512 | Set system-auth pwhash settings"
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/password-auth
|
||||
state: present
|
||||
regexp: '^password sufficient pam_unix.so'
|
||||
line: "password sufficient pam_unix.so {{ rhel9cis_pam_faillock.pwhash }} shadow try_first_pass use_authtok"
|
||||
insertafter: '^#?password ?'
|
||||
when: rhel9cis_rule_5_4_4
|
||||
|
||||
# The two steps below were added to keep authconfig from overwritting the above configs. This follows steps from here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-hardening_your_system_with_tools_and_services
|
||||
# With the steps below you will score five (5) points lower due to false positive results
|
||||
- name: |
|
||||
"5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
|
||||
5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
|
||||
5.4.3 | L1 | PATCH | Ensure password reuse is limited
|
||||
5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
|
||||
copy:
|
||||
src: /etc/pam.d/{{ item }}
|
||||
dest: /etc/pam.d/{{ item }}-local
|
||||
remote_src: true
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
with_items:
|
||||
- "system-auth"
|
||||
- "password-auth"
|
||||
|
||||
- name: |
|
||||
"5.4.1 | L1 | PATCH | Ensure password creation requirements are configured
|
||||
5.4.2 | L1 | PATCH | Ensure lockout for failed password attempts is configured
|
||||
5.4.3 | L1 | PATCH | Ensure password reuse is limited
|
||||
5.4.4 | L1 | PATCH | Ensure password hashing algorithm is SHA-512"
|
||||
file:
|
||||
src: /etc/pam.d/{{ item }}-local
|
||||
dest: /etc/pam.d/{{ item }}
|
||||
state: link
|
||||
force: true
|
||||
with_items:
|
||||
- "system-auth"
|
||||
- "password-auth"
|
||||
- name: "5.4.1 | PATCH | Ensure custom authselect profile is used | Create custom profiles"
|
||||
shell: authselect create-profile {{ rhel9cis_authselect['custom_profile_name'] }} -b {{ rhel9cis_authselect['default_file_to_copy'] }}
|
||||
args:
|
||||
warn: no
|
||||
when: rhel9cis_authselect_custom_profile_create
|
||||
when:
|
||||
- rhel9cis_rule_5_4_1 or
|
||||
rhel9cis_rule_5_4_2 or
|
||||
rhel9cis_rule_5_4_3 or
|
||||
rhel9cis_rule_5_4_4
|
||||
- rhel9cis_rule_5_4_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- manual
|
||||
- patch
|
||||
- authselect
|
||||
- rule_5.4.1
|
||||
|
||||
- name: "5.4.2 | PATCH | Ensure authselect includes with-faillock"
|
||||
block:
|
||||
- name: "5.4.2 | AUDIT | Ensure authselect includes with-faillock | Gather profiles and enabled features"
|
||||
shell: "authselect current | grep with-faillock"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
check_mode: no
|
||||
register: rhel9cis_5_4_2_profiles_faillock
|
||||
|
||||
- name: "5.4.2 | AUDIT | Ensure authselect includes with-faillock| Show profiles"
|
||||
debug:
|
||||
msg:
|
||||
- "Below are the current custom profiles"
|
||||
- "{{ rhel9cis_5_4_2_profiles_faillock.stdout_lines }}"
|
||||
|
||||
- name: "5.4.2 | PATCH | Ensure authselect includes with-faillock | Create custom profiles"
|
||||
shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} with-faillock"
|
||||
args:
|
||||
warn: no
|
||||
when: rhel9cis_authselect_custom_profile_select
|
||||
when:
|
||||
- rhel9cis_rule_5_4_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- authselect
|
||||
- rule_5.4.2
|
||||
- rule_5.4.3
|
||||
- rule_5.4.4
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue