ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Chage tool related settings: max-days, min-days and warn-age, for getting CIS-Passes on rules 5.6.1.{1-3}

Browse source 
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
This commit is contained in:
Pruteanu 2024-03-11 09:38:22 +02:00
parent 40bc7aa082
commit e4d6b7d102
No known key found for this signature in database
GPG key ID: 8665D673971C2D62
1 changed files with 64 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

52
tasks/section_5/cis_5.6.1.x.yml
View file

@ -1,10 +1,28 @@
--- ---
- name: "5.6.1.1 | PATCH | Ensure password expiration is 365 days or less" - name: "5.6.1.1 | PATCH | Ensure password expiration is 365 days or less"
block:
- name: "5.6.1.1 | PATCH | Ensure password expiration is 365 days or less | Setting in login.defs file"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/login.defs path: /etc/login.defs
regexp: '^PASS_MAX_DAYS' regexp: '^PASS_MAX_DAYS'
line: "PASS_MAX_DAYS {{ rhel9cis_pass['max_days'] }}" line: "PASS_MAX_DAYS {{ rhel9cis_pass['max_days'] }}"
- name: "5.6.1.1 | PATCH | Ensure password expiration is 365 days or less | Setting for all users via chage tool"
ansible.builtin.user:
name: "{{ item.id }}"
password_expire_max: "{{ rhel9cis_pass['max_days'] }}"
when:
- item.id != "halt"
- item.id != "shutdown"
- item.id != "sync"
- item.id != "nfsnobody"
- item.shell != "/usr/sbin/nologin"
- item.shell != "/sbin/nologin"
- item.id == "root" or item.uid >= min_int_uid | int
loop: "{{ rhel9cis_passwd }}"
loop_control:
label: "{{ item.id }}"
when: when:
- rhel9cis_rule_5_6_1_1 - rhel9cis_rule_5_6_1_1
tags: tags:
@ -15,10 +33,28 @@
- rule_5.6.1.1 - rule_5.6.1.1
- name: "5.6.1.2 | PATCH | Ensure minimum days between password changes is 7 or more" - name: "5.6.1.2 | PATCH | Ensure minimum days between password changes is 7 or more"
block:
- name: "5.6.1.2 | PATCH | Ensure minimum days between password changes is 7 or more | Setting in login.defs file"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/login.defs path: /etc/login.defs
regexp: '^PASS_MIN_DAYS' regexp: '^PASS_MIN_DAYS'
line: "PASS_MIN_DAYS {{ rhel9cis_pass['min_days'] }}" line: "PASS_MIN_DAYS {{ rhel9cis_pass['min_days'] }}"
- name: "5.6.1.2 | PATCH | Ensure minimum days between password changes is 7 or more | Setting for all users via chage tool"
ansible.builtin.user:
name: "{{ item.id }}"
password_expire_min: "{{ rhel9cis_pass['min_days'] }}"
when:
- item.id != "halt"
- item.id != "shutdown"
- item.id != "sync"
- item.id != "nfsnobody"
- item.shell != "/usr/sbin/nologin"
- item.shell != "/sbin/nologin"
- item.id == "root" or item.uid >= min_int_uid | int
loop: "{{ rhel9cis_passwd }}"
loop_control:
label: "{{ item.id }}"
when: when:
- rhel9cis_rule_5_6_1_2 - rhel9cis_rule_5_6_1_2
tags: tags:
@ -29,10 +65,26 @@
- rule_5.6.1.2 - rule_5.6.1.2
- name: "5.6.1.3 | PATCH | Ensure password expiration warning days is 7 or more" - name: "5.6.1.3 | PATCH | Ensure password expiration warning days is 7 or more"
block:
- name: "5.6.1.3 | PATCH | Ensure password expiration warning days is 7 or more | Setting in login.defs file"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/login.defs path: /etc/login.defs
regexp: '^PASS_WARN_AGE' regexp: '^PASS_WARN_AGE'
line: "PASS_WARN_AGE {{ rhel9cis_pass['warn_age'] }}" line: "PASS_WARN_AGE {{ rhel9cis_pass['warn_age'] }}"
- name: "5.6.1.3 | PATCH | Ensure password expiration warning days is 7 or more | Setting for all users via chage tool"
ansible.builtin.shell: chage --warndays "{{ rhel9cis_pass['warn_age'] }}" "{{ item.id }}"
when:
- item.id != "halt"
- item.id != "shutdown"
- item.id != "sync"
- item.id != "nfsnobody"
- item.shell != "/usr/sbin/nologin"
- item.shell != "/sbin/nologin"
- item.id == "root" or item.uid >= min_int_uid | int
loop: "{{ rhel9cis_passwd }}"
loop_control:
label: "{{ item.id }}"
when: when:
- rhel9cis_rule_5_6_1_3 - rhel9cis_rule_5_6_1_3
tags: tags: