mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
128 lines
3 KiB
YAML
128 lines
3 KiB
YAML
---
|
|
# tasks file for RHEL9-CIS
|
|
- name: Check OS version and family
|
|
fail:
|
|
msg: "This role can only be run against RHEL 8 or 9. {{ ansible_distribution }} {{ ansible_distribution_major_version }} is not supported."
|
|
when:
|
|
- ansible_os_family == 'RedHat'
|
|
- ansible_distribution_major_version == 8 or
|
|
ansible_distribution_major_version == 9
|
|
tags:
|
|
- always
|
|
|
|
- name: Check ansible version
|
|
fail:
|
|
msg: You must use ansible 2.9 or greater
|
|
when: not ansible_version.full is version_compare('2.9', '>=')
|
|
tags:
|
|
- always
|
|
|
|
- name: Check crypto-policy input
|
|
assert:
|
|
that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
|
|
|
|
- name: Check rhel9cis_bootloader_password_hash variable has been changed
|
|
assert:
|
|
that: rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword'
|
|
msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password_hash variable has not been set"
|
|
when:
|
|
- rhel9cis_set_boot_pass
|
|
- rhel9cis_rule_1_5_2
|
|
|
|
- name: "check sugroup exists if used"
|
|
block:
|
|
- name: "Check su group exists if defined"
|
|
shell: grep -w "{{ rhel9cis_sugroup }}" /etc/group
|
|
register: sugroup_exists
|
|
changed_when: false
|
|
failed_when: sugroup_exists.rc >= 2
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: Check sugroup if defined exists before continuing
|
|
assert:
|
|
that: sugroup_exists.rc == 0
|
|
msg: "The variable rhel9cis_sugroup is defined but does not exist please rectify"
|
|
when:
|
|
- rhel9cis_sugroup is defined
|
|
- rhel9cis_rule_5_7
|
|
tags:
|
|
- rule_5.7
|
|
|
|
- name: Gather the package facts
|
|
package_facts:
|
|
manager: auto
|
|
tags:
|
|
- always
|
|
|
|
- name: Include preliminary steps
|
|
import_tasks: prelim.yml
|
|
become:
|
|
tags:
|
|
- prelim_tasks
|
|
- always
|
|
|
|
- name: run pre_remediation audit
|
|
import_tasks: pre_remediation_audit.yml
|
|
when:
|
|
- run_audit
|
|
|
|
- name: Gather the package facts after prelim
|
|
package_facts:
|
|
manager: auto
|
|
tags:
|
|
- always
|
|
|
|
- name: capture /etc/password variables
|
|
include_tasks: parse_etc_password.yml
|
|
when: rhel9cis_section6
|
|
|
|
- name: run Section 1 tasks
|
|
import_tasks: section_1/main.yml
|
|
become: true
|
|
when: rhel9cis_section1
|
|
tags:
|
|
- rhel9cis_section1
|
|
|
|
- name: run Section 2 tasks
|
|
import_tasks: section_2/main.yml
|
|
become: true
|
|
when: rhel9cis_section2
|
|
|
|
- name: run Section 3 tasks
|
|
import_tasks: section_3/main.yml
|
|
become: true
|
|
when: rhel9cis_section3
|
|
|
|
- name: run Section 4 tasks
|
|
import_tasks: section_4/main.yml
|
|
become: true
|
|
when: rhel9cis_section4
|
|
|
|
- name: run Section 5 tasks
|
|
import_tasks: section_5/main.yml
|
|
become: true
|
|
when: rhel9cis_section5
|
|
|
|
- name: run Section 6 tasks
|
|
import_tasks: section_6/main.yml
|
|
become: true
|
|
when: rhel9cis_section6
|
|
|
|
- name: run post remediation tasks
|
|
import_tasks: post.yml
|
|
become: true
|
|
tags:
|
|
- post_tasks
|
|
- always
|
|
|
|
- name: run post_remediation audit
|
|
import_tasks: post_remediation_audit.yml
|
|
when:
|
|
- run_audit
|
|
|
|
- name: Show Audit Summary
|
|
debug:
|
|
msg: "{{ audit_results.split('\n') }}"
|
|
when:
|
|
- run_audit
|