RHEL9-CIS/tasks/prelim.yml

---

# Preliminary tasks that should always be run
# List users in order to look files inside each home directory

- name: PRELIM | Include audit specific variables
  when:
      - run_audit or audit_only
      - setup_audit
  tags:
      - setup_audit
      - run_audit
  ansible.builtin.include_vars: audit.yml

- name: PRELIM | Include pre-remediation audit tasks
  when:
      - run_audit or audit_only
      - setup_audit
  tags:
      - run_audit
  ansible.builtin.import_tasks: pre_remediation_audit.yml

- name: "PRELIM | AUDIT | Interactive Users"
  tags:
      - always
  ansible.builtin.shell: >
      grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $1 }'
  changed_when: false
  register: discovered_interactive_usernames

- name: "PRELIM | AUDIT | Interactive User accounts home directories"
  tags:
      - always
  ansible.builtin.shell: >
      grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $6 }'
  changed_when: false
  register: discovered_interactive_users_home

- name: "PRELIM | AUDIT | Interactive UIDs"
  tags:
      - always
  ansible.builtin.shell: >
      grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $3 }'
  changed_when: false
  register: discovered_interactive_uids

- name: "PRELIM | capture /etc/password variables"
  ansible.builtin.include_tasks:
      file: parse_etc_password.yml
  tags:
      - always

- name: "PRELIM | List users accounts"
  ansible.builtin.shell: "awk -F: '{print $1}' /etc/passwd"
  changed_when: false
  check_mode: false
  register: users
  tags:
      - level1-server
      - level1-workstation
      - users

- name: "PRELIM | Gather accounts with empty password fields"
  ansible.builtin.shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
  changed_when: false
  failed_when: false
  check_mode: false
  register: empty_password_accounts
  tags:
      - level1-server
      - level1-workstation
      - passwords

- name: "PRELIM | Gather UID 0 accounts other than root"
  ansible.builtin.shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
  changed_when: false
  check_mode: false
  register: rhel9cis_uid_zero_accounts_except_root
  tags:
      - rule_6.2.9
      - level1-server
      - level1-workstation
      - users

- name: "PRELIM | Setup crypto-policy"
  block:
      - name: "PRELIM | Install crypto-policies | pkgs present"
        ansible.builtin.package:
            name:
                - crypto-policies
                - crypto-policies-scripts
            state: present

      - name: "PRELIM | Gather system-wide crypto-policy"
        ansible.builtin.shell: 'update-crypto-policies --show'
        changed_when: false
        check_mode: false
        register: rhel9cis_system_wide_crypto_policy

      - name: "PRELIM | Gather system-wide crypto-policy | set fact system policy"
        ansible.builtin.set_fact:
            current_crypto_policy: "{{ rhel9cis_system_wide_crypto_policy.stdout.split(':')[0] }}"

      - name: "PRELIM | Gather system-wide crypto-policy module | set fact system policy submodule"
        ansible.builtin.set_fact:
            current_crypto_module: "{{ rhel9cis_system_wide_crypto_policy.stdout.split(':')[1] }}"
        when: "':' in rhel9cis_system_wide_crypto_policy.stdout"
  when:
      - rhel9cis_rule_1_10
  tags:
      - level1-server
      - level1-workstation
      - rule_1.10
      - crypto

- name: "PRELIM | if systemd coredump"
  ansible.builtin.stat:
      path: /etc/systemd/coredump.conf
  register: systemd_coredump
  when:
      - rhel9cis_rule_1_5_1
  tags:
      - level1-server
      - level1-workstation
      - rule_1.5.1
      - systemd

- name: "PRELIM | Section 1.1 | Create list of mount points"
  ansible.builtin.set_fact:
      mount_names: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
  tags:
      - level1-server
      - level1-workstation

- name: "PRELIM | Ensure python3-libselinux is installed"
  ansible.builtin.package:
      name: python3-libselinux
      state: present
  when:
      - '"python3-libselinux" not in ansible_facts.packages'

- name: "PRELIM | Set facts based on boot type"
  block:
      - name: "PRELIM | Check whether machine is UEFI-based"
        ansible.builtin.stat:
            path: /sys/firmware/efi
        register: rhel_09_efi_boot

      - name: "PRELIM | set legacy boot and grub path | Bios"
        ansible.builtin.set_fact:
            rhel9cis_legacy_boot: true
            grub2_path: /etc/grub2.cfg
        when: not rhel_09_efi_boot.stat.exists

      - name: "PRELIM | set grub fact | UEFI"
        ansible.builtin.set_fact:
            grub2_path: /etc/grub2-efi.cfg
        when: rhel_09_efi_boot.stat.exists

- name: "PRELIM | Update to latest gpg keys"
  ansible.builtin.package:
      name: "{{ gpg_key_package }}"
      state: latest
  when:
      - rhel9cis_rule_1_2_4
      - ansible_facts.distribution != 'RedHat'
      - ansible_facts.distribution != 'OracleLinux'

- name: "PRELIM | Check gpg keys are imported will cause 1.2.1 to fail if not | RedHat Only"
  block:
      - name: "PRELIM | Check gpg keys are imported will cause 1.2.1 to fail if not"
        ansible.builtin.shell: rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
        changed_when: false
        failed_when: false
        register: check_gpg_imported

      - name: "PRELIM | Check key package matches RedHat"
        ansible.builtin.shell: rpm -qi redhat-release | grep Signature
        changed_when: false
        failed_when: false
        register: os_gpg_package_valid
        when: "'not installed' in check_gpg_imported.stdout"

      - name: "PRELIM | Force keys to be imported"
        ansible.builtin.shell: rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
        when:
            - "'not installed' in check_gpg_imported.stdout"
            - "'Key ID 199e2f91fd431d51' in os_gpg_package_valid.stdout"
  when:
      - rhel9cis_rule_1_2_1
      - rhel9cis_force_gpg_key_import
      - ansible_facts.distribution == 'RedHat'

- name: "PRELIM | Discover Gnome Desktop Environment"
  ansible.builtin.stat:
      path: /usr/share/gnome/gnome-version.xml
  register: prelim_gnome_present
  tags:
      - always

- name: "PRELIM | Section 4.1 | Configure System Accounting (auditd)"
  ansible.builtin.package:
      name: audit
      state: present
  become: true
  when:
      - '"auditd" not in ansible_facts.packages'
      - rhel9cis_rule_4_1_1_1
  tags:
      - level2-server
      - level2-workstation
      - patch
      - rule_4.1.1.1
      - auditd

- name: "PRELIM | 4.1.4.5 | Audit conf and rules files | list files"
  ansible.builtin.find:
      path: /etc/audit
      file_type: file
      recurse: true
      patterns: '*.conf,*.rules'
  register: auditd_conf_files
  when:
      - rhel9cis_rule_4_1_4_5 or
        rhel9cis_rule_4_1_4_6 or
        rhel9cis_rule_4_1_4_7
  tags:
      - level2-server
      - level2-workstation
      - patch
      - auditd
      - rule_4.1.4.5
      - rule_4.1.4.6
      - rule_4.1.4.7

- name: "PRELIM | Section 5.1 | Configure cron"
  ansible.builtin.package:
      name: cronie
      state: present
  become: true
  when:
      - rhel9cis_rule_5_1_1
      - '"cronie" not in ansible_facts.packages'
  tags:
      - level1-server
      - level1-workstation
      - rule_5.1.1
      - cron

# Added to ensure ssh drop in file exists if not default /etc/ssh/sshd_config
- name: "PRELIM | Section 5.2 | SSH"
  ansible.builtin.file:
      path: "{{ rhel9cis_sshd_config_file }}"
      owner: root
      group: root
      mode: '0600'
      state: touch
  when:
      - rhel9cis_sshd_config_file != '/etc/ssh/sshd_config'
      - "'openssh-server' in ansible_facts.packages"
  tags:
      - always

- name: "PRELIM | 5.3.4 | Find all sudoers files."
  ansible.builtin.shell: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"
  changed_when: false
  failed_when: false
  check_mode: false
  register: rhel9cis_sudoers_files
  when:
      - rhel9cis_rule_5_3_4 or
        rhel9cis_rule_5_3_5
  tags:
      - rule_5.3.4
      - rule_5.3.5

- name: "PRELIM | Discover Interactive UID MIN and MIN from logins.def"
  block:
      - name: "PRELIM | Capture UID_MIN information from logins.def"
        ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
        changed_when: false
        register: uid_min_id

      - name: "PRELIM | Capture UID_MAX information from logins.def"
        ansible.builtin.shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
        changed_when: false
        register: uid_max_id

      - name: "PRELIM | Capture GID_MIN information from logins.def"
        ansible.builtin.shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
        changed_when: false
        register: gid_min_id

      - name: "PRELIM | set_facts for interactive uid/gid"
        ansible.builtin.set_fact:
            min_int_uid: "{{ uid_min_id.stdout }}"
            max_int_uid: "{{ uid_max_id.stdout }}"
            min_int_gid: "{{ gid_min_id.stdout }}"

- name: "PRELIM | Output of uid findings"
  ansible.builtin.debug:
      msg: "{{ min_int_uid }} {{ max_int_uid }}"

  when:
      - not discover_int_uid

- name: "PRELIM | Gather the package facts after prelim"
  ansible.builtin.package_facts:
      manager: auto
  tags:
      - always