RHEL9-CIS/tasks/main.yml

---
# tasks file for RHEL9-CIS
- name: Check OS version and family
  assert:
      that:
          - ansible_os_family == 'RedHat'
          - ansible_distribution_major_version |int >= 8
      fail_msg: "This role can only be run against RHEL 8 or 9. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported."
      success_msg: "Supported OS release and version"
  tags:
  - always

- name: Check ansible version
  assert:
      that:
          - "ansible_version.full is version_compare ('2.9', '>=')"
      fail_msg: "You must use ansible 2.9 or greater"
      success_msg: "Supported ansible_version"
  tags:
  - always

- name: Check crypto-policy input
  assert:
      that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
      fail_msg: "Crypto policy is not a permitted version"
      success_msg: "Crypto policy is a permitted version"

- name: Check rhel9cis_bootloader_password_hash variable has been changed
  assert:
      that: rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword'
      msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password_hash variable has not been set"
  when:
  - rhel9cis_set_boot_pass
  - rhel9cis_rule_1_5_2

- name: "check sugroup exists if used"
  block:
  - name: "Check su group exists if defined"
    shell: grep -w "{{ rhel9cis_sugroup }}" /etc/group
    args:
      warn: false
    register: sugroup_exists
    changed_when: false
    failed_when: sugroup_exists.rc >= 2
    tags:
    - skip_ansible_lint

  - name: Check sugroup if defined exists before continuing
    assert:
        that: sugroup_exists.rc == 0
        msg: "The variable rhel9cis_sugroup is defined but does not exist please rectify"
  when:
  - rhel9cis_sugroup is defined
  - rhel9cis_rule_5_7
  tags:
  - rule_5.7

- name: Gather the package facts
  package_facts:
      manager: auto
  tags:
  - always

- name: Include preliminary steps
  import_tasks: prelim.yml
  become: 
  tags:
  - prelim_tasks
  - always

- name: run pre_remediation audit
  import_tasks: pre_remediation_audit.yml
  when:
  - run_audit

- name: Gather the package facts after prelim
  package_facts:
      manager: auto
  tags:
  - always

- name: capture /etc/password variables
  include_tasks: parse_etc_password.yml
  when: rhel9cis_section6

- name: run Section 1 tasks
  import_tasks: section_1/main.yml
  become: true
  when: rhel9cis_section1
  tags:
  - rhel9cis_section1

- name: run Section 2 tasks
  import_tasks: section_2/main.yml
  become: true
  when: rhel9cis_section2

- name: run Section 3 tasks
  import_tasks: section_3/main.yml
  become: true
  when: rhel9cis_section3

- name: run Section 4 tasks
  import_tasks: section_4/main.yml
  become: true
  when: rhel9cis_section4

- name: run Section 5 tasks
  import_tasks: section_5/main.yml
  become: true
  when: rhel9cis_section5

- name: run Section 6 tasks
  import_tasks: section_6/main.yml
  become: true
  when: rhel9cis_section6

- name: run post remediation tasks
  import_tasks: post.yml
  become: true
  tags:
  - post_tasks
  - always

- name: run post_remediation audit
  import_tasks: post_remediation_audit.yml
  when:
  - run_audit

- name: Show Audit Summary
  debug:
      msg: "{{ audit_results.split('\n') }}"
  when:
  - run_audit