sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Lint updates & control alignment

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-01-13 09:09:21 +00:00
parent bcc5922832
commit 7c6555d92e
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
7 changed files with 26 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tasks/section_5/cis_5.1.x.yml
View file

@ -9,7 +9,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.1
@ -25,7 +24,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.2
@ -42,7 +40,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.3
@ -59,7 +56,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.4
@ -91,7 +87,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- rule_5.1.6
@ -107,7 +102,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.7
@ -136,7 +130,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.8
@ -165,7 +158,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- cron
- rule_5.1.9

20
tasks/section_5/cis_5.2.x.yml
View file

@ -12,7 +12,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- permissions
@ -43,7 +42,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- permissions
@ -74,7 +72,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.3
@ -121,7 +118,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.4
@ -137,7 +133,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sshs
- rule_5.2.5
@ -153,7 +148,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.6
@ -169,7 +163,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.7
@ -185,7 +178,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.8
@ -201,7 +193,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.9
@ -217,7 +208,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.10
@ -233,7 +223,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.11
@ -249,7 +238,6 @@
tags:
- level2-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.12
@ -265,7 +253,6 @@
tags:
- level2-server
- level2-workstation
- automated
- patch
- ssh
- rule_5.2.13
@ -287,7 +274,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.14
@ -302,7 +288,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.15
@ -318,7 +303,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.16
@ -334,7 +318,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.17
@ -350,7 +333,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.18
@ -366,7 +348,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.19
@ -391,7 +372,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- ssh
- rule_5.2.20

7
tasks/section_5/cis_5.3.x.yml
View file

@ -9,7 +9,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.1
@ -24,7 +23,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.2
@ -40,7 +38,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.3
@ -58,7 +55,6 @@
tags:
- level2-server
- level2-workstation
- automated
- patch
- sudo
- rule_5.3.4
@ -76,7 +72,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.5
@ -111,7 +106,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.6
@ -133,7 +127,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- sudo
- rule_5.3.7

1
tasks/section_5/cis_5.4.x.yml
View file

@ -51,7 +51,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- authselect
- rule_5.4.2

12
tasks/section_5/cis_5.5.x.yml
View file

@ -1,6 +1,6 @@
---
- name: "5.5.1 | PATCH | "
- name: "5.5.1 | PATCH | Ensure password creation requirements are configured"
block:
- name: "5.5.1 | PATCH | Ensure password creation requirements are configured | Set pwquality config settings"
ansible.builtin.lineinfile:
@ -32,7 +32,7 @@
- patch
- rule_5.5.1
- name: "5.5.2 | PATCH | Ensure system accounts are secured"
- name: "5.5.2 | PATCH | Ensure lockout for failed password attempts is configured"
ansible.builtin.lineinfile:
path: /etc/security/faillock.conf
regexp: "{{ item.regexp }}"
@ -45,7 +45,7 @@
- name: "5.5.3 | PATCH | Ensure password reuse is limited"
block:
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwhistory"
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality"
ansible.builtin.lineinfile:
path: /etc/pam.d/system-auth
line: "password requisite pam_pwhistory.so try_first_pass local_users_only enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
@ -54,8 +54,8 @@
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix"
ansible.builtin.replace:
path: /etc/pam.d/system-auth
regexp: '^password\s*sufficient\s*pam_unix.so.*$'
replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
regexp: '^password\s*(sufficient|requisite|sufficient)\s*pam_unix.so.*$'
replace: 'password requisite pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
when:
- rhel9cis_rule_5_5_3
tags:
@ -64,7 +64,7 @@
- patch
- rule_5.5.3
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512"
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512 or yescrypt"
block:
- name: "5.5.4 | PATCH | Ensure password hashing algorithm is SHA-512 | libuser.conf"
ansible.builtin.replace:

4
tasks/section_5/cis_5.6.1.x.yml
View file

@ -10,7 +10,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- password
- rule_5.5.1.1
@ -25,7 +24,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- password
- rule_5.6.1.2
@ -40,7 +38,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- password
- rule_5.5.1.3
@ -73,7 +70,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- password
- rule_5.6.1.4

24
tasks/section_5/cis_5.6.x.yml
View file

@ -41,7 +41,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- accounts
- rule_5.6.2
@ -65,7 +64,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- accounts
- rule_5.6.3
@ -79,7 +77,6 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- accounts
- rule_5.6.4
@ -111,7 +108,26 @@
tags:
- level1-server
- level1-workstation
- automated
- patch
- accounts
- rule_5.6.5
- name: "5.6.6 | PATCH | Ensure root password is set"
block:
- name: "5.6.6 | PATCH | Ensure root password is set"
ansible.builtin.shell: passwd -S root | grep "Password set, SHA512 crypt"
register: root_passwd
- name: "5.6.6 | PATCH | Ensure root password is set"
ansible.builtin.fail:
msg: The root password is not set
when: root_passwd.rc != 0
when:
- rhel9cis_rule_5_6_6
tags:
- level1-server
- level1-workstation
- patch
- accounts
- root
- rule_5.6.6