sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

warn control count updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-01-13 11:05:25 +00:00
parent 440f1dfcd4
commit 3ead0d63ac
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
20 changed files with 137 additions and 220 deletions
Download patch file Download diff file Expand all files Collapse all files

72
tasks/section_6/cis_6.1.x.yml
View file

@ -128,12 +128,6 @@
changed_when: false
register: rhel_08_6_1_9_perms_results
- name: "6.1.9 | AUDIT | Ensure no world writable files exist | Alert no world-writable files exist"
ansible.builtin.debug:
msg: "Good news! We have not found any world-writable files on your system"
when:
- rhel_08_6_1_9_perms_results.stdout is not defined
- name: "6.1.9 | PATCH | Ensure no world writable files exist | Adjust world-writable files if they exist (Configurable)"
ansible.builtin.file:
path: '{{ item }}'
@ -169,11 +163,20 @@
- name: "6.1.10 | AUDIT | Ensure no unowned files or directories exist | Displaying any unowned files or directories"
ansible.builtin.debug:
msg: "Manual intervention is required -- missing owner on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
msg: "Warning !! Manual intervention is required -- missing owner on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_10_audit.results }}"
when:
- item.stdout_lines is defined
- item.stdout_lines | length > 0
- name: "6.1.10 | AUDIT | Ensure no unowned files or directories exist | warning"
ansible.builtin.import_tasks: warning_facts.yml
vars:
warn_control_id: '6.1.10'
when:
- item.stdout_lines is defined
- item.stdout_lines | length > 0
when:
- rhel9cis_rule_6_1_10
tags:
@ -199,11 +202,19 @@
- name: "6.1.11 | AUDIT | Ensure no ungrouped files or directories exist | Displaying all ungrouped files or directories"
ansible.builtin.debug:
msg: "Manual intervention is required -- missing group on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
msg: "Warning !! Manual intervention is required -- missing group on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_11_audit.results }}"
when:
- item.stdout_lines is defined
- item.stdout_lines | length > 0
- name: "6.1.11 | AUDIT | Ensure no ungrouped files or directories exist | warning"
ansible.builtin.import_tasks: warning_facts.yml
vars:
warn_control_id: '6.1.11'
when:
- item.stdout_lines is defined
- item.stdout_lines | length > 0
when:
- rhel9cis_rule_6_1_11
tags:
@ -239,20 +250,19 @@
loop_control:
label: "{{ item.mount }}"
- name: "6.1.13 | AUDIT | Audit SUID executables | Alert no SUID executables exist"
ansible.builtin.debug:
msg: "Good news! We have not found any SUID executable files on your system"
failed_when: false
changed_when: false
when:
- rhel_08_6_1_13_perms_results.stdout is not defined
- name: "6.1.13 | AUDIT | Audit SUID executables | Alert SUID executables exist"
ansible.builtin.debug:
msg: "Manual intervention is required -- SUID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
msg: "Warning!! Manual intervention is required -- SUID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_13_perms_results.stdout_lines }}"
when:
- rhel_08_6_1_13_perms_results.stdout is defined
- name: "6.1.13 | AUDIT | Audit SUID executables | Alert SUID executables exist | warning"
ansible.builtin.import_tasks: warning_facts.yml
vars:
warn_control_id: '6.1.13'
when:
- rhel_08_6_1_13_perms_results.stdout is defined
when:
- rhel9cis_rule_6_1_13
tags:
@ -274,20 +284,19 @@
loop_control:
label: "{{ item.mount }}"
- name: "6.1.14 | AUDIT | Audit SGID executables | Alert no SGID executables exist"
ansible.builtin.debug:
msg: "Good news! We have not found any SGID executable files on your system"
failed_when: false
changed_when: false
when:
- rhel_08_6_1_14_perms_results.stdout is not defined
- name: "6.1.14 | AUDIT | Audit SGID executables | Alert SGID executables exist"
ansible.builtin.debug:
msg: "Manual intervention is required -- SGID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}"
with_items: "{{ rhel_08_6_1_14_perms_results.stdout_lines }}"
when:
- rhel_08_6_1_14_perms_results.stdout is defined
- name: "6.1.14 | AUDIT | Audit SGID executables| warning"
ansible.builtin.import_tasks: warning_facts.yml
vars:
warn_control_id: '6.1.14'
when:
- rhel_08_6_1_14_perms_results.stdout is defined
when:
- rhel9cis_rule_6_1_14
tags:
@ -323,15 +332,12 @@
The file list can be found in {{ rhel9cis_rpm_audit_file }}"
- name: "6.1.15 | AUDIT | Audit system file permissions | warning count"
ansible.builtin.set_fact:
control_number: "{{ control_number }} + [ 'rule_6.1.1' ]"
warn_count: "{{ warn_count | int + 1 }}"
when: rhel9cis_6_1_15_packages_rpm.stdout|length > 0
ansible.builtin.import_tasks: warning_facts.yml
vars:
warn_control_id: '6.1.15'
when: rhel9cis_6_1_15_packages_rpm.stdout|length > 0
- name: "6.1.15 | AUDIT | Audit system file permissions | Message out no package descrepancies"
ansible.builtin.debug:
msg: "Good News! There are no package descrepancies"
when: rhel9cis_6_1_15_packages_rpm.stdout|length == 0
when:
- rhel9cis_rule_6_1_15
tags: