forked from ansible-lockdown/RHEL9-CIS
rewrite
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell
parent
b3a6f89ae0
commit
223254b5c9
1 changed files with 102 additions and 70 deletions
|
|
@ -1,59 +1,91 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: "5.5.2 | PATCH | Ensure system accounts are secured"
|
- name: "5.5.1 | PATCH | "
|
||||||
block:
|
block:
|
||||||
- name: "5.5.2 | Ensure system accounts are secured | Set nologin"
|
- name: "5.5.1 | PATCH | Ensure password creation requirements are configured | Set pwquality config settings"
|
||||||
user:
|
blockinfile:
|
||||||
name: "{{ item.id }}"
|
path: /etc/security/pwquality.conf
|
||||||
shell: /usr/sbin/nologin
|
marker: "<!-- {mark} CIS 5.5.1 ANSIBLE MANAGED BLOCK -->"
|
||||||
with_items:
|
block: "{{ rhel9cis_pam_password }}"
|
||||||
- "{{ rhel9cis_passwd }}"
|
|
||||||
when:
|
|
||||||
- item.id != "root"
|
|
||||||
- item.id != "sync"
|
|
||||||
- item.id != "shutdown"
|
|
||||||
- item.id != "halt"
|
|
||||||
- min_int_uid | int > item.gid
|
|
||||||
- item.shell != " /bin/false"
|
|
||||||
- item.shell != " /usr/sbin/nologin"
|
|
||||||
|
|
||||||
- name: "5.5.2 | PATCH | Ensure system accounts are secured | Lock accounts"
|
- name: "5.5.1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings"
|
||||||
user:
|
lineinfile:
|
||||||
name: "{{ item.id }}"
|
dest: /etc/pam.d/system-auth
|
||||||
password_lock: true
|
state: present
|
||||||
with_items:
|
regexp: '^password\s*requisite\s*pam_pwquality.so'
|
||||||
- "{{ rhel9cis_passwd }}"
|
line: "password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3"
|
||||||
when:
|
insertbefore: '^#?password ?'
|
||||||
- item.id != "halt"
|
|
||||||
- item.id != "shutdown"
|
- name: "5.5.1 | PATCH | Ensure password creation requirements are configured | Set system-auth retry settings"
|
||||||
- item.id != "sync"
|
lineinfile:
|
||||||
- item.id != "root"
|
dest: /etc/pam.d/password-auth
|
||||||
- min_int_uid | int > item.gid
|
state: present
|
||||||
- item.shell != " /bin/false"
|
regexp: '^password\s*requisite\s*pam_pwquality.so'
|
||||||
- item.shell != " /usr/sbin/nologin"
|
line: "password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3"
|
||||||
|
insertbefore: '^#?password ?'
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_5_2
|
- rhel9cis_rule_5_5_1
|
||||||
tags:
|
tags:
|
||||||
- level1-server
|
- level1-server
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
- patch
|
- patch
|
||||||
- rule_5.5.2
|
- rule_5.5.1
|
||||||
|
|
||||||
- name: "5.5.3 | PATCH | Ensure default user shell timeout is 900 seconds or less"
|
- name: "5.5.2 | PATCH | Ensure system accounts are secured | pre RHEL8.2"
|
||||||
blockinfile:
|
block:
|
||||||
create: yes
|
- name: "5.5.2 | PATCH | Ensure lockout for failed password attempts is configured | pre RHEL8.2 | Add deny count and unlock time for preauth"
|
||||||
mode: 0644
|
lineinfile:
|
||||||
dest: "{{ item.dest }}"
|
dest: /etc/pam.d/{{ item }}
|
||||||
state: "{{ item.state }}"
|
state: present
|
||||||
marker: "# {mark} ANSIBLE MANAGED"
|
regexp: '^auth\s*required\s*pam_faillock.so preauth'
|
||||||
block: |
|
line: "auth required pam_faillock.so preauth silent deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
|
||||||
# Set session timeout - CIS ID RHEL-08-5.4.5
|
insertafter: '^#?auth ?'
|
||||||
TMOUT={{ rhel9cis_shell_session_timeout.timeout }}
|
with_items:
|
||||||
export TMOUT
|
- "system-auth"
|
||||||
readonly TMOUT
|
- "password-auth"
|
||||||
|
|
||||||
|
- name: "5.5.2 | PATCH | Ensure lockout for failed password attempts is configured | pre RHEL8.2 | Add deny count and unlock times for authfail"
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/{{ item }}
|
||||||
|
state: present
|
||||||
|
regexp: '^auth\s*required\s*pam_faillock.so authfail'
|
||||||
|
line: "auth required pam_faillock.so authfail deny={{ rhel9cis_pam_faillock.attempts }}{{ (rhel9cis_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}unlock_time={{ rhel9cis_pam_faillock.unlock_time }}"
|
||||||
|
insertafter: '^#?auth ?'
|
||||||
|
with_items:
|
||||||
|
- "system-auth"
|
||||||
|
- "password-auth"
|
||||||
|
when:
|
||||||
|
- ansible_distribution_version <= "8.1"
|
||||||
|
- rhel9cis_rule_5_5_2
|
||||||
|
|
||||||
|
- name: "5.5.2 | PATCH | Ensure system accounts are secured | RHEL8.2+ "
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/security/faillock.conf
|
||||||
|
state: present
|
||||||
|
regexp: "{{ item.regexp }}"
|
||||||
|
line: "{{ item.line }}"
|
||||||
with_items:
|
with_items:
|
||||||
- { dest: "{{ rhel9cis_shell_session_timeout.file }}", state: present }
|
- { regexp: '^\s*deny\s*=\s*[1-5]\b', line: 'deny = 5' }
|
||||||
- { dest: /etc/profile, state: "{{ (rhel9cis_shell_session_timeout.file == '/etc/profile') | ternary('present', 'absent') }}" }
|
- { regexp: '^\s*unlock_time\s*=\s*(0|9[0-9][0-9]|[1-9][0-9][0-9][0-9]+)\b', line: 'unlock_time = 900' }
|
||||||
|
when:
|
||||||
|
- ansible_distribution_version >= "8.2"
|
||||||
|
- rhel9cis_rule_5_5_2
|
||||||
|
|
||||||
|
- name: "5.5.3 | PATCH | Ensure password reuse is limited"
|
||||||
|
block:
|
||||||
|
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwhistory"
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/pam.d/system-auth
|
||||||
|
state: present
|
||||||
|
line: "password requisite pam_pwhistory.so try_first_pass local_users_only enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
|
||||||
|
insertafter: '^password\s*requisite\s*pam_pwquality.so'
|
||||||
|
|
||||||
|
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix"
|
||||||
|
replace:
|
||||||
|
path: /etc/pam.d/system-auth
|
||||||
|
regexp: '^password\s*sufficient\s*pam_unix.so.*$'
|
||||||
|
#after: '^password\s*requisite\s*pam_pwhistory.so'
|
||||||
|
replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_5_3
|
- rhel9cis_rule_5_5_3
|
||||||
tags:
|
tags:
|
||||||
|
|
@ -62,10 +94,31 @@
|
||||||
- patch
|
- patch
|
||||||
- rule_5.5.3
|
- rule_5.5.3
|
||||||
|
|
||||||
- name: "5.5.4 | PATCH | Ensure default group for the root account is GID 0"
|
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512"
|
||||||
command: usermod -g 0 root
|
block:
|
||||||
changed_when: false
|
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512 | libuser.conf"
|
||||||
failed_when: false
|
replace:
|
||||||
|
path: /etc/libuser.conf
|
||||||
|
regexp: '^crypt_style\s*=\s*.*$'
|
||||||
|
replace: 'crypt_style = sha512'
|
||||||
|
|
||||||
|
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512 | login.defs"
|
||||||
|
replace:
|
||||||
|
path: /etc/login.defs
|
||||||
|
regexp: '^ENCRYPT_METHOD.*'
|
||||||
|
replace: 'ENCRYPT_METHOD SHA512'
|
||||||
|
|
||||||
|
- name: "5.5.4 | PATCH | Ensure password reuse is limited | pwhistory"
|
||||||
|
replace:
|
||||||
|
path: /etc/pam.d/password-auth
|
||||||
|
regexp: '^password\s*sufficient\s*pam_unix.so.*$'
|
||||||
|
replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
|
||||||
|
|
||||||
|
- name: "5.5.4 | PATCH | Ensure password reuse is limited | pam_unix"
|
||||||
|
replace:
|
||||||
|
path: /etc/pam.d/system-auth
|
||||||
|
regexp: '^password\s*sufficient\s*pam_unix.so.*'
|
||||||
|
replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
|
||||||
when:
|
when:
|
||||||
- rhel9cis_rule_5_5_4
|
- rhel9cis_rule_5_5_4
|
||||||
tags:
|
tags:
|
||||||
|
|
@ -73,24 +126,3 @@
|
||||||
- level1-workstation
|
- level1-workstation
|
||||||
- patch
|
- patch
|
||||||
- rule_5.5.4
|
- rule_5.5.4
|
||||||
|
|
||||||
- name: "5.5.5 | PATCH | Ensure default user umask is 027 or more restrictive"
|
|
||||||
block:
|
|
||||||
- name: "5.5.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/bashrc"
|
|
||||||
replace:
|
|
||||||
path: /etc/bashrc
|
|
||||||
regexp: '(^\s+umask) 0[012][0-6]'
|
|
||||||
replace: '\1 027'
|
|
||||||
|
|
||||||
- name: "5.5.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/profile"
|
|
||||||
replace:
|
|
||||||
path: /etc/profile
|
|
||||||
regexp: '(^\s+umask) 0[012][0-6]'
|
|
||||||
replace: '\1 027'
|
|
||||||
when:
|
|
||||||
- rhel9cis_rule_5_5_5
|
|
||||||
tags:
|
|
||||||
- level1-server
|
|
||||||
- level1-workstation
|
|
||||||
- patch
|
|
||||||
- rule_5.5.5
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue