mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
40bc7aa082
* change logic thanks to @rjacobs1990 see #175 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * thanks to @ipruteani-sie #134 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Thanks to @stwongst #125 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * thanks to @sgomez86 #146 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * Added updates from #115 Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * removed rp_filter in post added in error Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated yamllint precommit Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated fqcn fo json_query Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * updated Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> * fix typo for virt type query Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com> --------- Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
67 lines
1.8 KiB
YAML
67 lines
1.8 KiB
YAML
---
|
|
# Post tasks
|
|
|
|
- name: POST | Gather the package facts after remediation
|
|
ansible.builtin.package_facts:
|
|
manager: auto
|
|
tags:
|
|
- always
|
|
|
|
- name: POST | Update sysctl
|
|
ansible.builtin.template:
|
|
src: "etc/sysctl.d/{{ item }}.j2"
|
|
dest: "/etc/sysctl.d/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
register: sysctl_updated
|
|
notify: Reload sysctl
|
|
loop:
|
|
- 60-kernel_sysctl.conf
|
|
- 60-disable_ipv6.conf
|
|
- 60-netipv4_sysctl.conf
|
|
- 60-netipv6_sysctl.conf
|
|
when:
|
|
- rhel9cis_sysctl_update
|
|
- not system_is_container
|
|
- "'procps-ng' in ansible_facts.packages"
|
|
|
|
- name: Flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: POST | reboot system if changes require it and not skipped
|
|
block:
|
|
- name: POST | Reboot system if changes require it and not skipped
|
|
ansible.builtin.reboot:
|
|
when:
|
|
- change_requires_reboot
|
|
- not skip_reboot
|
|
|
|
- name: POST | Warning a reboot required but skip option set
|
|
ansible.builtin.debug:
|
|
msg: "Warning!! changes have been made that require a reboot to be implemented but skip reboot was set - Can affect compliance check results"
|
|
changed_when: true
|
|
when:
|
|
- change_requires_reboot
|
|
- skip_reboot
|
|
|
|
- name: "POST | Warning a reboot required but skip option set | warning count"
|
|
ansible.builtin.import_tasks:
|
|
file: warning_facts.yml
|
|
when:
|
|
- change_requires_reboot
|
|
- skip_reboot
|
|
vars:
|
|
warn_control_id: Reboot_required
|
|
tags:
|
|
- grub
|
|
- level1-server
|
|
- level1-workstation
|
|
- level2-server
|
|
- level2-workstation
|
|
- rhel9cis_section1
|
|
- rhel9cis_section2
|
|
- rhel9cis_section3
|
|
- rhel9cis_section4
|
|
- rhel9cis_section5
|
|
- rhel9cis_section6
|