mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
119 lines
2.1 KiB
YAML
119 lines
2.1 KiB
YAML
---
|
|
# handlers file for RHEL9-CIS
|
|
|
|
- name: reload sysctl
|
|
shell: sysctl --system
|
|
args:
|
|
warn: false
|
|
when:
|
|
- sysctl_updated.changed
|
|
|
|
- name: sysctl flush ipv4 route table
|
|
become: true
|
|
sysctl:
|
|
name: net.ipv4.route.flush
|
|
value: '1'
|
|
sysctl_set: true
|
|
ignore_errors: true
|
|
when:
|
|
- flush_ipv4_route
|
|
- not system_is_container
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: sysctl flush ipv6 route table
|
|
become: true
|
|
sysctl:
|
|
name: net.ipv6.route.flush
|
|
value: '1'
|
|
sysctl_set: true
|
|
when:
|
|
- flush_ipv6_route
|
|
- not system_is_container
|
|
|
|
- name: systemd restart tmp.mount
|
|
become: true
|
|
systemd:
|
|
name: tmp.mount
|
|
daemon_reload: true
|
|
enabled: true
|
|
masked: false
|
|
state: reloaded
|
|
|
|
- name: systemd restart var-tmp.mount
|
|
become: true
|
|
systemd:
|
|
name: var-tmp.mount
|
|
daemon_reload: true
|
|
enabled: true
|
|
masked: false
|
|
state: reloaded
|
|
|
|
- name: remount tmp
|
|
shell: mount -o remount /tmp
|
|
args:
|
|
warn: false
|
|
|
|
- name: restart firewalld
|
|
service:
|
|
name: firewalld
|
|
state: restarted
|
|
|
|
- name: restart sshd
|
|
service:
|
|
name: sshd
|
|
state: restarted
|
|
|
|
- name: restart postfix
|
|
service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: reload dconf
|
|
shell: dconf update
|
|
args:
|
|
warn: false
|
|
|
|
- name: restart auditd
|
|
shell: service auditd restart
|
|
args:
|
|
warn: false
|
|
when:
|
|
- audit_rules_updated.changed or
|
|
rule_4_1_2_1.changed or
|
|
rule_4_1_2_2.changed or
|
|
rule_4_1_2_3.changed
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: grub2cfg
|
|
shell: "grub2-mkconfig -o /boot/grub2/grub.cfg"
|
|
args:
|
|
warn: false
|
|
ignore_errors: True
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
- name: restart rsyslog
|
|
become: true
|
|
service:
|
|
name: rsyslog
|
|
state: restarted
|
|
|
|
- name: restart journald
|
|
service:
|
|
name: systemd-journald
|
|
state: restarted
|
|
|
|
- name: restart systemd_journal_upload
|
|
service:
|
|
name: systemd-journal-upload
|
|
state: restarted
|
|
|
|
- name: systemd_daemon_reload
|
|
systemd:
|
|
daemon-reload: true
|
|
|
|
- name: change_requires_reboot
|
|
set_fact:
|
|
change_requires_reboot: true
|