forked from ansible-lockdown/RHEL9-CIS
linting
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
2974fa5385
commit
1e22c13794
8 changed files with 38 additions and 31 deletions
|
|
@ -22,20 +22,20 @@
|
|||
|
||||
- name: "Check password set for {{ ansible_user }}"
|
||||
block:
|
||||
- name: Capture current password state of "{{ ansible_user }}"
|
||||
shell: "grep {{ ansible_user }} /etc/shadow | awk -F: '{print $2}'"
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
register: ansible_user_password_set
|
||||
- name: Capture current password state of "{{ ansible_user }}"
|
||||
shell: "grep {{ ansible_user }} /etc/shadow | awk -F: '{print $2}'"
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
check_mode: false
|
||||
register: ansible_user_password_set
|
||||
|
||||
- name: "Assert that password set for {{ ansible_user }} and account not locked"
|
||||
assert:
|
||||
that: ansible_user_password_set.stdout | length != 0 and ansible_user_password_set.stdout != "!!"
|
||||
fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_user }} has no password set - It can break access"
|
||||
success_msg: "You a password set for the {{ ansible_user }}"
|
||||
vars:
|
||||
sudo_password_rule: rhel9cis_rule_5_3_4
|
||||
- name: "Assert that password set for {{ ansible_user }} and account not locked"
|
||||
assert:
|
||||
that: ansible_user_password_set.stdout | length != 0 and ansible_user_password_set.stdout != "!!"
|
||||
fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_user }} has no password set - It can break access"
|
||||
success_msg: "You a password set for the {{ ansible_user }}"
|
||||
vars:
|
||||
sudo_password_rule: rhel9cis_rule_5_3_4
|
||||
when:
|
||||
- rhel9cis_rule_5_3_4
|
||||
- not system_is_ec2
|
||||
|
|
@ -205,7 +205,7 @@
|
|||
|
||||
- name: If Warnings found Output count and control IDs affected
|
||||
debug:
|
||||
msg: "You have {{ warn_count }} Warning(s) that require investigating that are related to the following benchmark ID(s) {{ control_number }}"
|
||||
msg: "You have {{ warn_count }} Warning(s) that require investigating that are related to the following benchmark ID(s) {{ control_number }}"
|
||||
when: warn_count != 0
|
||||
tags:
|
||||
- always
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue