sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

updated logic

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2025-02-26 14:04:13 +00:00
parent 5a612675e2
commit 74f17b7ee8
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
1 changed files with 18 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

42
tasks/section_6/cis_6.2.4.1.yml
View file

@ -8,6 +8,8 @@
- patch - patch
- logfiles - logfiles
- rule_6.2.4.1 - rule_6.2.4.1
- NIST800-53R5_AC-3
- NIST800-53R5_MP-2
block: block:
- name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | find log files" - name: "6.2.4.1 | AUDIT | Ensure access to all logfiles has been configured | find log files"
ansible.builtin.shell: find /var/log/ -type f -exec ls {} \; ansible.builtin.shell: find /var/log/ -type f -exec ls {} \;
@ -15,43 +17,35 @@
failed_when: false failed_when: false
register: discovered_logfiles register: discovered_logfiles
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions" - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions SSSD min 660"
when: when:
- discovered_logfiles.stdout_lines | length > 0 - discovered_logfiles.stdout_lines | length > 0
- ('audit.log' in item or 'journal' in item) or - item is match("/var/log/(gdm|sssd)")
item == '/var/log/secure' or
item == '/var/log/syslog' or
item == '/var/log/messages' or
item == '/var/log/auth.log'
ansible.builtin.file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
mode: 'u-x,g-wx,o-rwx' mode: 'ug-x,o-rwx'
failed_when: discovered_logfile_list.state not in '[ file, absent ]' failed_when: discovered_logfile_list.state not in '[ file, absent ]'
register: discovered_logfile_list register: discovered_logfile_list
loop: "{{ discovered_logfiles.stdout_lines }}" loop: "{{ discovered_logfiles.stdout_lines }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions" - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions tmp min 664"
when: when:
- discovered_logfiles.stdout_lines | length > 0 - discovered_logfiles.stdout_lines | length > 0
- ('anaconda' in item or 'dnf' in item or 'secure' in item or 'messages' in item or 'hawkey' in item) - item is match("/var/log/((u|b|w)tmp*|lastlog)")
ansible.builtin.file:
path: "{{ item }}"
mode: 'u-x,g-x,o-rwx'
failed_when: discovered_logfile_list.state not in '[ file, absent ]'
register: discovered_logfile_list
loop: "{{ discovered_logfiles.stdout_lines }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
when:
- discovered_logfiles.stdout_lines | length > 0
- ('sssd' in item or 'lastlog' in item) or
item == "/var/log/btmp" or
item == "/var/log/utmp" or
item == "/var/log/wtmp" or
item == "/var/log/lastlog"
ansible.builtin.file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
mode: 'ug-x,o-wx' mode: 'ug-x,o-wx'
failed_when: discovered_logfile_list.state not in '[ file, absent ]' failed_when: discovered_logfile_list.state not in '[ file, absent ]'
register: discovered_logfile_list register: discovered_logfile_list
loop: "{{ discovered_logfiles.stdout_lines }}" loop: "{{ discovered_logfiles.stdout_lines }}"
- name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions else all 640"
when:
- discovered_logfiles.stdout_lines | length > 0
- item is not match("/var/log/((u|b|w)tmp*|lastlog|sssd)")
ansible.builtin.file:
path: "{{ item }}"
mode: 'u-x,g-wx,o-rwx'
failed_when: discovered_logfile_list.state not in '[ file, absent ]'
register: discovered_logfile_list
loop: "{{ discovered_logfiles.stdout_lines }}"