forked from ansible-lockdown/RHEL9-CIS
91 lines
3.1 KiB
YAML
91 lines
3.1 KiB
YAML
|
---
|
||
|
|
|
||
|
|
- name: "5.3.1 | L1 | PATCH | Create custom authselect profile"
|
||
|
|
block:
|
||
|
|
- name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Gather profiles"
|
||
|
|
shell: 'authselect current | grep "Profile ID: custom/"'
|
||
|
|
failed_when: false
|
||
|
|
changed_when: false
|
||
|
|
check_mode: no
|
||
|
|
register: rhel9cis_5_3_1_profiles
|
||
|
|
|
||
|
|
- name: "5.3.1 | L1 | AUDIT | Create custom authselect profile | Show profiles"
|
||
|
|
debug:
|
||
|
|
msg:
|
||
|
|
- "Below are the current custom profiles"
|
||
|
|
- "{{ rhel9cis_5_3_1_profiles.stdout_lines }}"
|
||
|
|
|
||
|
|
- name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Create custom profiles"
|
||
|
|
shell: authselect create-profile {{ rhel9cis_authselect['custom_profile_name'] }} -b {{ rhel9cis_authselect['default_file_to_copy'] }}
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
when: rhel9cis_authselect_custom_profile_create
|
||
|
|
when:
|
||
|
|
- rhel9cis_rule_5_3_1
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- authselect
|
||
|
|
- rule_5.3.1
|
||
|
|
|
||
|
|
- name: "5.3.2 | L1 | PATCH | Select authselect profile"
|
||
|
|
block:
|
||
|
|
- name: "5.3.2 | L1 | AUDIT | Select authselect profile | Gather profiles and enabled features"
|
||
|
|
shell: "authselect current"
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
failed_when: false
|
||
|
|
changed_when: false
|
||
|
|
check_mode: no
|
||
|
|
register: rhel9cis_5_3_2_profiles
|
||
|
|
|
||
|
|
- name: "5.3.2 | L1 | AUDIT | Select authselect profile | Show profiles"
|
||
|
|
debug:
|
||
|
|
msg:
|
||
|
|
- "Below are the current custom profiles"
|
||
|
|
- "{{ rhel9cis_5_3_2_profiles.stdout_lines }}"
|
||
|
|
|
||
|
|
- name: "5.3.2 | L1 | PATCH | Select authselect profile | Create custom profiles"
|
||
|
|
shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} {{ rhel9cis_authselect['options'] }}"
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
when: rhel9cis_authselect_custom_profile_select
|
||
|
|
when:
|
||
|
|
- rhel9cis_rule_5_3_2
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- authselect
|
||
|
|
- rule_5.3.2
|
||
|
|
|
||
|
|
- name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock"
|
||
|
|
block:
|
||
|
|
- name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock | Gather profiles and enabled features"
|
||
|
|
shell: "authselect current | grep with-faillock"
|
||
|
|
failed_when: false
|
||
|
|
changed_when: false
|
||
|
|
check_mode: no
|
||
|
|
register: rhel9cis_5_3_3_profiles_faillock
|
||
|
|
|
||
|
|
- name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock| Show profiles"
|
||
|
|
debug:
|
||
|
|
msg:
|
||
|
|
- "Below are the current custom profiles"
|
||
|
|
- "{{ rhel9cis_5_3_3_profiles_faillock.stdout_lines }}"
|
||
|
|
|
||
|
|
- name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock | Create custom profiles"
|
||
|
|
shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} with-faillock"
|
||
|
|
args:
|
||
|
|
warn: no
|
||
|
|
when: rhel9cis_authselect_custom_profile_select
|
||
|
|
when:
|
||
|
|
- rhel9cis_rule_5_3_3
|
||
|
|
tags:
|
||
|
|
- level1-server
|
||
|
|
- level1-workstation
|
||
|
|
- patch
|
||
|
|
- authselect
|
||
|
|
- rule_5.3.3
|