mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 14:23:05 +00:00
119 lines
3.2 KiB
YAML
119 lines
3.2 KiB
YAML
---
|
|
# Preliminary tasks that should always be run
|
|
# List users in order to look files inside each home directory
|
|
- name: "PRELIM | List users accounts"
|
|
command: "awk -F: '{print $1}' /etc/passwd"
|
|
args:
|
|
warn: no
|
|
changed_when: no
|
|
check_mode: no
|
|
register: users
|
|
|
|
- name: "PRELIM | Gather accounts with empty password fields"
|
|
shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
|
|
args:
|
|
warn: no
|
|
changed_when: no
|
|
check_mode: no
|
|
register: empty_password_accounts
|
|
|
|
- name: "PRELIM | Gather UID 0 accounts other than root"
|
|
shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
|
|
args:
|
|
warn: no
|
|
changed_when: no
|
|
check_mode: no
|
|
register: uid_zero_accounts_except_root
|
|
|
|
- name: "PRELIM | Gather system-wide crypto-policy"
|
|
shell: update-crypto-policies --show
|
|
args:
|
|
warn: no
|
|
changed_when: no
|
|
check_mode: no
|
|
register: system_wide_crypto_policy
|
|
|
|
- name: "PRELIM | if systemd coredump"
|
|
stat:
|
|
path: /etc/systemd/coredump.conf
|
|
register: systemd_coredump
|
|
when:
|
|
- rhel9cis_rule_1_6_1
|
|
|
|
- name: "PRELIM | Section 1.1 | Create list of mount points"
|
|
set_fact:
|
|
mount_names: "{{ ansible_mounts | map(attribute='mount') | list }}"
|
|
|
|
- name: "PRELIM | Section 4.1 | Configure System Accounting (auditd)"
|
|
package:
|
|
name: audit
|
|
state: present
|
|
when: rhel9cis_level_2
|
|
|
|
- name: "PRELIM | 4.1.12 | Ensure successful file system mounts are collected"
|
|
shell: for i in $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: no
|
|
register: priv_procs
|
|
tags:
|
|
- always
|
|
|
|
- name: "PRELIM | Section 5.1 | Configure cron"
|
|
package:
|
|
name: cronie
|
|
state: present
|
|
|
|
- name: "PRELIM | Install authconfig"
|
|
package:
|
|
name: authconfig
|
|
state: present
|
|
when:
|
|
- rhel9cis_use_authconfig
|
|
- rhel9cis_rule_5_3_1 or
|
|
rhel9cis_rule_5_3_2 or
|
|
rhel9cis_rule_5_3_3
|
|
|
|
- name: "PRELIM | Set facts based on boot type"
|
|
block:
|
|
- name: "PRELIM | Check whether machine is UEFI-based"
|
|
stat:
|
|
path: /sys/firmware/efi
|
|
register: rhel_09_efi_boot
|
|
|
|
- name: "PRELIM | AUDIT | set legacy boot and grub path | Bios"
|
|
set_fact:
|
|
rhel9cis_legacy_boot: true
|
|
grub2_path: /etc/grub2.cfg
|
|
when: not rhel_09_efi_boot.stat.exists
|
|
|
|
- name: "PRELIM | set grub fact | UEFI"
|
|
set_fact:
|
|
grub2_path: /etc/grub2-efi.cfg
|
|
when: rhel_09_efi_boot.stat.exists
|
|
|
|
# - name: debug legacy boot var
|
|
# debug:
|
|
# msg: |
|
|
# legacy_boot={{ rhel9cis_legacy_boot }}
|
|
# grub2_path={{ grub2_path }}
|
|
|
|
- name: "PRELIM | AUDIT | Ensure permissions on bootloader config are configured | Get grub config file stats"
|
|
stat:
|
|
path: "{{ grub2_path }}"
|
|
changed_when: false
|
|
register: grub_cfg
|
|
|
|
# - name: debug grub stat
|
|
# debug:
|
|
# var: grub_cfg.stat
|
|
|
|
- name: "PRELIM | Check for rhnsd service"
|
|
shell: "systemctl show rhnsd | grep LoadState | cut -d = -f 2"
|
|
changed_when: false
|
|
check_mode: false
|
|
register: rhnsd_service_status
|
|
when:
|
|
- rhel9cis_rule_1_2_2
|
|
tags:
|
|
- skip_ansible_lint
|