sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

feat: become true for all tasks

Browse source
This commit is contained in:
Iain Learmonth 2025-12-20 12:49:57 +00:00
parent 9bab97dccc
commit a8190b8fcb
1 changed files with 233 additions and 230 deletions
Download patch file Download diff file Expand all files Collapse all files

55
tasks/main.yml
View file

@ -1,7 +1,10 @@
---
# tasks file for RHEL9-CIS
- name: "Check OS version and family"
- name: "RHEL9-CIS"
become: true
block:
- name: "Check OS version and family"
when: os_check
tags: always
ansible.builtin.assert:
@ -9,14 +12,14 @@
fail_msg: "This role can only be run against Supported OSs. {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }} is not supported."
success_msg: "This role is running against a supported OS {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }}"
- name: "Check ansible version"
- name: "Check ansible version"
tags: always
ansible.builtin.assert:
that: ansible_version.full is version_compare(min_ansible_version, '>=')
fail_msg: "You must use Ansible {{ min_ansible_version }} or greater"
success_msg: "This role is running a supported version of ansible {{ ansible_version.full }} >= {{ min_ansible_version }}"
- name: "Setup rules if container"
- name: "Setup rules if container"
when:
- ansible_connection == 'docker' or
ansible_facts.virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
@ -37,13 +40,13 @@
ansible.builtin.debug:
msg: system has been discovered as a container
- name: "Check crypto-policy input"
- name: "Check crypto-policy input"
ansible.builtin.assert:
that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
fail_msg: "Crypto policy is not a permitted version"
success_msg: "Crypto policy is a permitted version"
- name: "Check rhel9cis_bootloader_password_hash variable has been changed"
- name: "Check rhel9cis_bootloader_password_hash variable has been changed"
when:
- rhel9cis_set_boot_pass
- rhel9cis_rule_1_4_1
@ -52,7 +55,7 @@
that: rhel9cis_bootloader_password_hash.find('grub.pbkdf2.sha512') != -1 and rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword' # pragma: allowlist secret
msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password_hash variable has not been set correctly"
- name: "Check crypto-policy module input"
- name: "Check crypto-policy module input"
when:
- rhel9cis_rule_1_6_1
- rhel9cis_crypto_policy_module | length > 0
@ -65,7 +68,7 @@
fail_msg: "Crypto policy module is not a permitted version"
success_msg: "Crypto policy module is a permitted version"
- name: "Check password set for {{ ansible_env.SUDO_USER }}"
- name: "Check password set for {{ ansible_env.SUDO_USER }}"
when:
- rhel9cis_rule_5_2_4
- ansible_env.SUDO_USER is defined
@ -108,7 +111,7 @@
fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_env.SUDO_USER }} is locked - It can break access"
success_msg: "The local account {{ ansible_env.SUDO_USER }} is not locked or included in the exception list for rule 5.2.4"
- name: "Check authselect profile is selected"
- name: "Check authselect profile is selected"
when: rhel9cis_allow_authselect_updates
tags: always
block:
@ -123,7 +126,7 @@
failed_when: prelim_authselect_current_profile.rc not in [ 0, 1 ]
register: prelim_authselect_current_profile
- name: "Ensure root password is set"
- name: "Ensure root password is set"
when: rhel9cis_rule_5_4_2_4
tags:
- level1-server
@ -145,78 +148,78 @@
fail_msg: "You have rule 5.4.2.4 enabled this requires that you have a root password set"
success_msg: "You have a root password set"
- name: "Gather the package facts"
- name: "Gather the package facts"
tags: always
ansible.builtin.package_facts:
manager: auto
- name: "Include OS specific variables"
- name: "Include OS specific variables"
tags: always
ansible.builtin.include_vars:
file: "{{ ansible_facts.distribution }}.yml"
- name: "Include preliminary steps"
- name: "Include preliminary steps"
tags:
- prelim_tasks
- always
ansible.builtin.import_tasks:
file: prelim.yml
- name: "Run Section 1 tasks"
- name: "Run Section 1 tasks"
when: rhel9cis_section1
ansible.builtin.import_tasks:
file: section_1/main.yml
- name: "Run Section 2 tasks"
- name: "Run Section 2 tasks"
when: rhel9cis_section2
ansible.builtin.import_tasks:
file: section_2/main.yml
- name: "Run Section 3 tasks"
- name: "Run Section 3 tasks"
when: rhel9cis_section3
ansible.builtin.import_tasks:
file: section_3/main.yml
- name: "Run Section 4 tasks"
- name: "Run Section 4 tasks"
when: rhel9cis_section4
ansible.builtin.import_tasks:
file: section_4/main.yml
- name: "Run Section 5 tasks"
- name: "Run Section 5 tasks"
when: rhel9cis_section5
ansible.builtin.import_tasks:
file: section_5/main.yml
- name: "Run Section 6 tasks"
- name: "Run Section 6 tasks"
when: rhel9cis_section6
ansible.builtin.import_tasks:
file: section_6/main.yml
- name: "Run Section 7 tasks"
- name: "Run Section 7 tasks"
when: rhel9cis_section7
ansible.builtin.import_tasks:
file: section_7/main.yml
- name: "Run auditd logic"
- name: "Run auditd logic"
when: update_audit_template
tags: always
ansible.builtin.import_tasks:
file: auditd.yml
- name: "Run post remediation tasks"
- name: "Run post remediation tasks"
tags:
- post_tasks
- always
ansible.builtin.import_tasks:
file: post.yml
- name: "Run post_remediation audit"
- name: "Run post_remediation audit"
when: run_audit
tags: always
ansible.builtin.import_tasks:
file: post_remediation_audit.yml
- name: Add ansible file showing Benchmark and levels applied if audit details not present
- name: Add ansible file showing Benchmark and levels applied if audit details not present
when:
- create_benchmark_facts
- (post_audit_summary is defined) or
@ -241,7 +244,7 @@
group: root
mode: 'u-x,go=r'
- name: Fetch audit files
- name: Fetch audit files
when:
- fetch_audit_output
- run_audit
@ -249,13 +252,13 @@
ansible.builtin.import_tasks:
file: fetch_audit_output.yml
- name: "Show Audit Summary"
- name: "Show Audit Summary"
when: run_audit
tags: always
ansible.builtin.debug:
msg: "{{ audit_results.split('\n') }}"
- name: "If Warnings found Output count and control IDs affected"
- name: "If Warnings found Output count and control IDs affected"
when: warn_count != 0
tags: always
ansible.builtin.debug: