boolean variable true/false

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/parse_etc_password.yml

@@ -4,8 +4,8 @@
   block:
       - name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Parse /etc/passwd"
         shell: cat /etc/passwd
-        changed_when: no
-        check_mode: no
+        changed_when: false
+        check_mode: false
         register: rhel9cis_passwd_file_audit
 
       - name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Split passwd entries"

tasks/post.yml

@@ -4,7 +4,7 @@
 - name: Perform DNF package cleanup
   dnf:
       autoremove: true
-  changed_when: no
+  changed_when: false
 
 - name: trigger update sysctl
   shell: /bin/true

tasks/prelim.yml

@@ -4,33 +4,33 @@
 - name: "PRELIM | List users accounts"
   shell: "awk -F: '{print $1}' /etc/passwd"
   args:
-      warn: no
-  changed_when: no
-  check_mode: no
+      warn: false
+  changed_when: false
+  check_mode: false
   register: users
 
 - name: "PRELIM | Gather accounts with empty password fields"
   shell: "cat /etc/shadow | awk -F: '($2 == \"\" ) {j++;print $1; } END {exit j}'"
   args:
-      warn: no
-  changed_when: no
-  check_mode: no
+      warn: false
+  changed_when: false
+  check_mode: false
   register: empty_password_accounts
 
 - name: "PRELIM | Gather UID 0 accounts other than root"
   shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
   args:
-      warn: no
-  changed_when: no
-  check_mode: no
+      warn: false
+  changed_when: false
+  check_mode: false
   register: uid_zero_accounts_except_root
 
 - name: "PRELIM | Gather system-wide crypto-policy"
   shell: update-crypto-policies --show
   args:
-      warn: no
-  changed_when: no
-  check_mode: no
+      warn: false
+  changed_when: false
+  check_mode: false
   register: system_wide_crypto_policy
 
 - name: "PRELIM | if systemd coredump"
@@ -50,15 +50,16 @@
       state: present
   become: true
   when: 
+      - '"auditd" not in ansible_facts.packages'
       - rhel9cis_level_2 or
         rhel9cis_rule_4_1_1_1
-      - '"auditd" not in ansible_facts.packages'
+
 
 - name: "PRELIM | 4.1.12 | Ensure successful file system mounts are collected"
   shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
   changed_when: false
   failed_when: false
-  check_mode: no
+  check_mode: false
   register: priv_procs
   tags:
   - always

tasks/section_1/cis_1.1.1.x.yml

@@ -7,7 +7,7 @@
             dest: /etc/modprobe.d/CIS.conf
             regexp: "^(#)?install cramfs(\\s|$)"
             line: "install cramfs /bin/true"
-            create: yes
+            create: true
             mode: 0600
 
       - name: "1.1.1.1 | L1 | PATCH | Ensure mounting of cramfs filesystems is disabled | Disable cramfs"
@@ -32,7 +32,7 @@
             dest: /etc/modprobe.d/CIS.conf
             regexp: "^(#)?install vfat(\\s|$)"
             line: "install vfat /bin/true"
-            create: yes
+            create: true
             mode: 0600
 
       - name: "1.1.1.2 | L2 | PATCH | Ensure mounting of vFAT filesystems is limited | Disable vFAT"
@@ -58,7 +58,7 @@
             dest: /etc/modprobe.d/CIS.conf
             regexp: "^(#)?install squashfs(\\s|$)"
             line: "install squashfs /bin/true"
-            create: yes
+            create: true
             mode: 0600
 
       - name: "1.1.1.3 | L1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
@@ -83,7 +83,7 @@
             dest: /etc/modprobe.d/CIS.conf
             regexp: "^(#)?install udf(\\s|$)"
             line: "install udf /bin/true"
-            create: yes
+            create: true
             mode: 0600
 
       - name: "1.1.1.4 | L1 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"

tasks/section_1/cis_1.1.x.yml

@@ -256,7 +256,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_1_1_15_dev_shm_status
 
       - name: |
@@ -325,7 +325,7 @@
 - name: "1.1.22 | L1 | PATCH | Disable Automounting"
   service:
       name: autofs
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_allow_autofs
       - "'autofs' in ansible_facts.packages"
@@ -345,7 +345,7 @@
             dest: /etc/modprobe.d/CIS.conf
             regexp: "^(#)?install usb-storage(\\s|$)"
             line: "install usb-storage /bin/true"
-            create: yes
+            create: true
             owner: root
             group: root
             mode: 0600

tasks/section_1/cis_1.2.x.yml

@@ -23,7 +23,7 @@
   service:
       name: rhnsd
       state: stopped
-      enabled: no
+      enabled: false
       masked: true
   when:
       - ansible_distribution == "RedHat"
@@ -84,7 +84,7 @@
         changed_when: false
         failed_when: false
         register: dnf_configured
-        check_mode: no
+        check_mode: false
 
       - name: "1.2.5 | L1 | AUDIT | Ensure package manager repositories are configured | Display repo list"
         debug:

tasks/section_1/cis_1.7.1.x.yml

@@ -19,7 +19,7 @@
       regexp: '(selinux|enforcing)\s*=\s*0\s*'
       replace: ''
   register: selinux_grub_patch
-  ignore_errors: yes
+  ignore_errors: true
   notify: grub2cfg
   when:
       - rhel9cis_rule_1_7_1_2

tasks/section_1/cis_1.8.2.yml

@@ -6,7 +6,7 @@
       regexp: "{{ item.regexp }}"
       line: "{{ item.line }}"
       state: present
-      create: yes
+      create: true
       owner: root
       group: root
       mode: 0644

tasks/section_2/cis_2.2.1.x.yml

@@ -29,7 +29,7 @@
             regexp: "^(#)?OPTIONS"
             line: "OPTIONS=\"-u chrony\""
             state: present
-            create: yes
+            create: true
             mode: 0644
   when:
       - rhel9cis_time_synchronization == "chrony"

tasks/section_2/cis_2.2.x.yml

@@ -7,7 +7,7 @@
         args:
             warn: false
         failed_when: xorg_x11_installed.rc >=2
-        check_mode: no
+        check_mode: false
         changed_when: false
         register: xorg_x11_installed
 
@@ -32,7 +32,7 @@
   service:
       name: rsyncd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_rsyncd_server
       - "'rsyncd' in ansible_facts.packages"
@@ -47,7 +47,7 @@
   service:
       name: avahi-daemon
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_avahi_server
       - "'avahi' in ansible_facts.packages"
@@ -65,7 +65,7 @@
   service:
       name: snmpd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_snmp_server
       - "'net-snmp' in ansible_facts.packages"
@@ -80,7 +80,7 @@
   service:
       name: squid
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_squid_server
       - "'squid' in ansible_facts.packages"
@@ -95,7 +95,7 @@
   service:
       name: smb
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_smb_server
       - "'samba' in ansible_facts.packages"
@@ -110,7 +110,7 @@
   service:
       name: dovecot
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_dovecot_server
       - "'dovecot' in ansible_facts.packages"
@@ -125,7 +125,7 @@
   service:
       name: httpd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_httpd_server
       - "'httpd' in ansible_facts.packages"
@@ -140,7 +140,7 @@
   service:
       name: vsftpd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_vsftpd_server
       - "'vsftpd' in ansible_facts.packages"
@@ -155,7 +155,7 @@
   service:
       name: named
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_named_server
       - "'bind' in ansible_facts.packages"
@@ -170,7 +170,7 @@
   service:
       name: nfs-server
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_nfs_rpc_server
       - "'nfs-utils' in ansible_facts.packages"
@@ -188,7 +188,7 @@
   service:
       name: rpcbind
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_nfs_rpc_server
       - "'rpcbind' in ansible_facts.packages"
@@ -206,7 +206,7 @@
   service:
       name: slapd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_ldap_server
       - "'openldap-servers' in ansible_facts.packages"
@@ -224,7 +224,7 @@
   service:
       name: dhcpd
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_dhcp_server
       - "'dhcp' in ansible_facts.packages"
@@ -242,7 +242,7 @@
   service:
       name: cups
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_cups_server
       - "'cups' in ansible_facts.packages"
@@ -260,7 +260,7 @@
   service:
       name: ypserv
       state: stopped
-      enabled: no
+      enabled: false
   when:
       - not rhel9cis_nis_server
       - "'ypserv' in ansible_facts.packages"

tasks/section_3/cis_3.3.x.yml

@@ -5,7 +5,7 @@
       dest: /etc/modprobe.d/CIS.conf
       regexp: "^(#)?install dccp(\\s|$)"
       line: "install dccp /bin/true"
-      create: yes
+      create: true
       mode: 0600
   when:
       - rhel9cis_rule_3_3_1
@@ -20,7 +20,7 @@
       dest: /etc/modprobe.d/CIS.conf
       regexp: "^(#)?install sctp(\\s|$)"
       line: "install sctp /bin/true"
-      create: yes
+      create: true
       mode: 0600
   when:
       - rhel9cis_rule_3_3_2
@@ -35,7 +35,7 @@
       dest: /etc/modprobe.d/CIS.conf
       regexp: "^(#)?install rds(\\s|$)"
       line: "install rds /bin/true"
-      create: yes
+      create: true
       mode: 0600
   when:
       - rhel9cis_rule_3_3_3
@@ -50,7 +50,7 @@
       dest: /etc/modprobe.d/CIS.conf
       regexp: "^(#)?install tipc(\\s|$)"
       line: "install tipc /bin/true"
-      create: yes
+      create: true
       mode: 0600
   when:
       - rhel9cis_rule_3_3_4

tasks/section_3/cis_3.4.2.x.yml

@@ -4,7 +4,7 @@
   service:
       name: firewalld
       state: started
-      enabled: yes
+      enabled: true
   when:
       - rhel9cis_firewall == "firewalld"
       - rhel9cis_rule_3_4_2_1
@@ -19,9 +19,9 @@
       name: iptables
       enabled: false
       masked: true
-  ignore_errors: true
   when:
       - rhel9cis_firewall == "firewalld"
+      - "'iptables' in ansible_facts.packages"
       - rhel9cis_rule_3_4_2_2
   tags:
       - skip_ansible_lint
@@ -37,6 +37,7 @@
       masked: true
   when:
       - rhel9cis_firewall == "firewalld"
+      - "'nftables' in ansible_facts.packages"
       - rhel9cis_rule_3_4_2_3
   tags:
       - level1-server
@@ -65,7 +66,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_3_4_2_5_interfacepolicy
 
       - name: "3.4.2.5 | L1 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies | Show the interface to policy"
@@ -90,7 +91,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_3_4_2_6_servicesport
 
       - name: "3.4.2.6 | L1 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports"

tasks/section_3/cis_3.4.3.x.yml

@@ -44,7 +44,7 @@
         shell: nft create table inet "{{ rhel9cis_nft_tables_tablename }}"
         args:
             warn: false
-        failed_when: no
+        failed_when: false
         when: rhel9cis_nft_tables_autonewtable
   when:
       - rhel9cis_firewall == "nftables"
@@ -96,7 +96,7 @@
         shell: "{{ item }}"
         args:
             warn: false
-        failed_when: no
+        failed_when: false
         with_items:
             - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
             - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { type filter hook forward priority 0 \; }
@@ -294,7 +294,7 @@
 - name: "3.4.3.7 | L1 | PATCH | Ensure nftables service is enabled | Check if nftables is enabled"
   service:
       name: nftables
-      enabled: yes
+      enabled: true
   when:
       - rhel9cis_firewall == "nftables"
       - rhel9cis_rule_3_4_3_7

tasks/section_3/cis_3.4.4.1.x.yml

@@ -136,7 +136,7 @@
 - name: "3.4.4.1.5 | L1 | PATCH | Ensure iptables service is enabled and active | Check if iptables is enabled"
   service:
       name: iptables
-      enabled: yes
+      enabled: true
       state: started
   when:
       - rhel9cis_firewall == "iptables"

tasks/section_3/cis_3.4.4.2.x.yml

@@ -124,7 +124,7 @@
 - name: "3.4.4.2.5 | L1 | PATCH | Ensure ip6tables service is enabled and active | Check if ip6tables is enabled"
   service:
       name: ip6tables
-      enabled: yes
+      enabled: true
       state: started
   when:
       - rhel9cis_firewall == "iptables"

tasks/section_3/cis_3.6.yml

@@ -5,7 +5,7 @@
       dest: /etc/default/grub
       regexp: '(^GRUB_CMDLINE_LINUX\s*\=\s*)(?:")(.+)(?<!ipv6.disable=1)(?:")'
       replace: '\1"\2 ipv6.disable=1"'
-      follow: yes
+      follow: true
   notify: grub2cfg
   when:
       - not rhel9cis_ipv6_required

tasks/section_4/cis_4.1.1.x.yml

@@ -25,7 +25,7 @@
   service:
       name: auditd
       state: started
-      enabled: yes
+      enabled: true
   when:
       - not rhel9cis_skip_for_travis
       - rhel9cis_rule_4_1_1_2
@@ -45,7 +45,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_4_1_1_3_grub_cmdline_linux
 
       - name: "4.1.1.3 | L2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Replace existing setting"
@@ -80,7 +80,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_4_1_1_4_grub_cmdline_linux
 
       - name: "4.1.1.4 | L2 | PATCH | Ensure audit_backlog_limit is sufficient | Replace existing setting"

tasks/section_4/cis_4.1.x.yml

@@ -125,7 +125,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: priv_procs
 
       - name: "4.1.12 | L2 | PATCH | Ensure successful file system mounts are collected"

tasks/section_4/cis_4.2.1.x.yml

@@ -157,7 +157,7 @@
         with_items:
             - '^(\$ModLoad imtcp)'
             - '^(\$InputTCPServerRun)'
-        when: falset rhel9cis_system_is_log_server
+        when: not rhel9cis_system_is_log_server
 
       - name: "4.2.1.6 | L1 | PATCH | Ensure remote rsyslog messages are only accepted on designated log hosts. | When log host"
         replace:

tasks/section_5/cis_5.1.x.yml

@@ -3,7 +3,7 @@
 - name: "5.1.1 | L1 | PATCH | Ensure cron daemon is enabled"
   service:
       name: crond
-      enabled: yes
+      enabled: true
   when:
       - rhel9cis_rule_5_1_1
   tags:

tasks/section_5/cis_5.3.x.yml

@@ -8,7 +8,7 @@
             warn: false
         failed_when: false
         changed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_3_1_profiles
 
       - name: "5.3.1 | L1 | AUDIT | Create custom authselect profile | Show profiles"
@@ -39,7 +39,7 @@
             warn: false
         failed_when: false
         changed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_3_2_profiles
 
       - name: "5.3.2 | L1 | AUDIT | Select authselect profile | Show profiles"
@@ -70,7 +70,7 @@
             warn: false
         failed_when: false
         changed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_3_3_profiles_faillock
 
       - name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock| Show profiles"

tasks/section_5/cis_5.4.x.yml

@@ -95,7 +95,7 @@
         copy:
             src: /etc/pam.d/{{ item }}
             dest: /etc/pam.d/{{ item }}-local
-            remote_src: yes
+            remote_src: true
             owner: root
             group: root
             mode: '0644'
@@ -112,7 +112,7 @@
             src: /etc/pam.d/{{ item }}-local
             dest: /etc/pam.d/{{ item }}
             state: link
-            force: yes
+            force: true
         with_items:
             - "system-auth"
             - "password-auth"

tasks/section_5/cis_5.5.1.x.yml

@@ -50,7 +50,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_5_1_4_inactive_settings
 
       - name: "5.5.1.4 | L1 | PATCH | Ensure inactive password lock is 30 days or less | Set default inactive setting"
@@ -63,7 +63,7 @@
         shell: 'egrep ^[^:]+:[^\!*] /etc/shadow | cut -d: -f1'
         args:
             warn: false
-        check_mode: no
+        check_mode: false
         register: rhel_09_5_5_1_4_audit
         changed_when: false
 
@@ -89,7 +89,7 @@
             warn: false
         failed_when: false
         changed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_5_1_5_currentut
 
       - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Get list of users with last changed pw date in the future"
@@ -98,7 +98,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_5_5_1_5_user_list
 
       - name: "5.5.1.5 | L1 | AUDIT | Ensure all users last password change date is in the past | Alert no pw change in the future exist"

tasks/section_5/cis_5.5.x.yml

@@ -41,7 +41,7 @@
 
 - name: "5.5.3 | L1 | PATCH | Ensure default user shell timeout is 900 seconds or less"
   blockinfile:
-      create: yes
+      create: true
       mode: 0644
       dest: "{{ item.dest }}"
       state: "{{ item.state }}"

tasks/section_6/cis_6.2.x.yml

@@ -37,7 +37,7 @@
         shell: 'echo $PATH | grep ::'
         args:
             warn: false
-        check_mode: no
+        check_mode: false
         register: path_colon
         changed_when: False
         failed_when: path_colon.rc == 0
@@ -46,7 +46,7 @@
         shell: 'echo $PATH | grep :$'
         args:
             warn: false
-        check_mode: no
+        check_mode: false
         register: path_colon_end
         changed_when: False
         failed_when: path_colon_end.rc == 0
@@ -55,7 +55,7 @@
         shell: "/bin/bash --login -c 'env | grep ^PATH=' | sed -e 's/PATH=//' -e 's/::/:/' -e 's/:$//' -e 's/:/\\n/g'"
         args:
             warn: false
-        check_mode: no
+        check_mode: false
         register: dot_in_path
         changed_when: False
         failed_when: '"." in dot_in_path.stdout_lines'
@@ -156,7 +156,7 @@
       - name: "6.2.7 | L1 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
         file:
             path: "{{ item.0 }}"
-            recurse: yes
+            recurse: true
             mode: a-st,g-w,o-rwx
         register: rhel_09_6_2_7_patch
         when:
@@ -172,9 +172,9 @@
       - name: "6.2.7 | L1 | PATCH | Ensure users' home directories permissions are 750 or more restrictive"
         acl:
             path: "{{ item.0 }}"
-            default: yes
+            default: true
             state: present
-            recursive: yes
+            recursive: true
             etype: "{{ item.1.etype }}"
             permissions: "{{ item.1.mode }}"
         when: not rhel9cis_system_is_container
@@ -414,7 +414,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: group_group_check
 
       - name: "6.2.18 | L1 | AUDIT | Ensure no duplicate group names exist | Print message that no duplicate groups exist"
@@ -442,7 +442,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_shadow_gid
 
       - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Check /etc/group for empty shadow group"
@@ -451,7 +451,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_empty_shadow
 
       - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Check for users assigned to shadow"
@@ -460,7 +460,7 @@
             warn: false
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_shadow_passwd
 
       - name: "6.2.19 | L1 | AUDIT | Ensure shadow group is empty | Alert shadow group is empty and no users assigned"
@@ -520,7 +520,7 @@
       - name: "6.2.20 | L1 | PATCH | Ensure all users' home directories exist"
         file:
             path: "{{ item.0 }}"
-            recurse: yes
+            recurse: true
             mode: a-st,g-w,o-rwx
         register: rhel_09_6_2_20_patch
         when:
@@ -536,9 +536,9 @@
       - name: "6.2.20 | L1 | PATCH | Ensure all users' home directories exist"
         acl:
             path: "{{ item.0 }}"
-            default: yes
+            default: true
             state: present
-            recursive: yes
+            recursive: true
             etype: "{{ item.1.etype }}"
             permissions: "{{ item.1.mode }}"
         when: not rhel9cis_system_is_container