sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

improved tests and updated

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-08-09 13:13:17 +01:00
parent 485a85db76
commit 265423eb0a
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
11 changed files with 171 additions and 152 deletions
Download patch file Download diff file Expand all files Collapse all files

48
tasks/section_6/cis_6.2.4.1.yml
View file

@ -16,47 +16,37 @@
failed_when: false
register: discovered_logfiles
- name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | set_fact"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
when:
- discovered_logfiles.stdout_lines | length > 0
- discovered_logfiles is defined
ansible.builtin.set_fact:
discovered_logfiles_flattened: "{{ discovered_logfiles.stdout_lines | flatten }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
when:
- discovered_logfiles_flattened is defined
- item == "/var/log/secure"
- item == "/var/log/auth.log"
- item == "/var/log/syslog"
- "'journal' in item"
- ('audit.log' in item or 'journal' in item) or
item == '/var/log/secure' or
item == '/var/log/syslog' or
item == '/var/log/messages' or
item == '/var/log/auth.log'
ansible.builtin.file:
path: "{{ item }}"
mode: 'u-x,g-wx,o-rwx'
loop: "{{ discovered_logfiles_flattened }}"
loop: "{{ discovered_logfiles.stdout_lines }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
when:
- discovered_logfiles_flattened is defined
- item == "/var/log/btmp"
- item == "/var/log/utmp"
- item == "/var/log/wtmp"
- item == "/var/log/lastlog"
- discovered_logfiles.stdout_lines | length > 0
- ('anaconda' in item or 'dnf' in item or 'secure' in item or 'messages' in item or 'hawkey' in item)
ansible.builtin.file:
path: "{{ item }}"
mode: 'u-x,g-wx,o-rwx'
owner: root
group: root
loop: "{{ discovered_logfiles_flattened }}"
mode: 'u-x,g-x,o-rwx'
loop: "{{ discovered_logfiles.stdout_lines }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
when:
- discovered_logfiles_flattened is defined
- "'sssd' in item"
- item == "/var/log/utmp"
- item == "/var/log/wtmp"
- item == "/var/log/lastlog"
- discovered_logfiles.stdout_lines | length > 0
- ('sssd' in item or 'lastlog' in item) or
item == "/var/log/btmp" or
item == "/var/log/utmp" or
item == "/var/log/wtmp" or
item == "/var/log/lastlog"
ansible.builtin.file:
path: "{{ item }}"
mode: 'u-x,g-wx,o-rwx'
loop: "{{ discovered_logfiles_flattened }}"
mode: 'ug-x,o-wx'
loop: "{{ discovered_logfiles.stdout_lines }}"