diff --git a/tasks/section_1/cis_1.1.2.x.yml b/tasks/section_1/cis_1.1.2.x.yml index d4a7f7d..d55f5ec 100644 --- a/tasks/section_1/cis_1.1.2.x.yml +++ b/tasks/section_1/cis_1.1.2.x.yml @@ -6,7 +6,7 @@ ansible.builtin.debug: msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task" - - name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | warning" + - name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | Present" ansible.builtin.import_tasks: warning_facts.yml vars: warn_control_id: '1.1.2.1' diff --git a/tasks/section_1/cis_1.1.3.x.yml b/tasks/section_1/cis_1.1.3.x.yml index 7ea30d9..649657f 100644 --- a/tasks/section_1/cis_1.1.3.x.yml +++ b/tasks/section_1/cis_1.1.3.x.yml @@ -6,7 +6,7 @@ ansible.builtin.debug: msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task" - - name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | warning" + - name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Present" ansible.builtin.import_tasks: warning_facts.yml vars: warn_control_id: '1.1.3.1' @@ -37,9 +37,7 @@ label: "{{ item.device }}" notify: Change_requires_reboot when: - - var_mount_present is defined - item.mount == "/var" - - rhel9cis_rule_1_1_3_1 # This is required so the check takes place - rhel9cis_rule_1_1_3_2 or rhel9cis_rule_1_1_3_3 tags: diff --git a/tasks/section_1/cis_1.1.4.x.yml b/tasks/section_1/cis_1.1.4.x.yml index b32260b..b8ae48d 100644 --- a/tasks/section_1/cis_1.1.4.x.yml +++ b/tasks/section_1/cis_1.1.4.x.yml @@ -7,7 +7,7 @@ ansible.builtin.debug: msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task" - - name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Absent" + - name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Present" ansible.builtin.import_tasks: warning_facts.yml vars: warn_control_id: '1.1.4.1' @@ -32,16 +32,14 @@ src: "{{ item.device }}" fstype: "{{ item.fstype }}" state: present - opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nodev{% endif %} + opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_4_4 %}nodev{% endif %} with_items: - "{{ ansible_mounts }}" loop_control: label: "{{ item.device }}" notify: Change_requires_reboot when: - - var_tmp_mount_present is defined - item.mount == "/var/tmp" - - rhel9cis_rule_1_1_4_1 # This is required so the check takes place - rhel9cis_rule_1_1_4_2 or rhel9cis_rule_1_1_4_3 or rhel9cis_rule_1_1_4_4 diff --git a/tasks/section_1/cis_1.1.5.x.yml b/tasks/section_1/cis_1.1.5.x.yml index da3c0e8..9f556ba 100644 --- a/tasks/section_1/cis_1.1.5.x.yml +++ b/tasks/section_1/cis_1.1.5.x.yml @@ -39,9 +39,7 @@ label: "{{ item.device }}" notify: Change_requires_reboot when: - - var_log_mount_present is defined - item.mount == "/var/log" - - rhel9cis_rule_1_1_5_1 # This is required so the check takes place - rhel9cis_rule_1_1_5_2 or rhel9cis_rule_1_1_5_3 or rhel9cis_rule_1_1_5_4 diff --git a/tasks/section_1/cis_1.1.6.x.yml b/tasks/section_1/cis_1.1.6.x.yml index b030e8f..fcfa92b 100644 --- a/tasks/section_1/cis_1.1.6.x.yml +++ b/tasks/section_1/cis_1.1.6.x.yml @@ -38,9 +38,7 @@ label: "{{ item.device }}" notify: Change_requires_reboot when: - - var_log_audit_mount_present is defined - item.mount == "/var/log/audit" - - rhel9cis_rule_1_1_6_1 # This is required so the check takes place - rhel9cis_rule_1_1_6_2 or rhel9cis_rule_1_1_6_3 or rhel9cis_rule_1_1_6_4 diff --git a/tasks/section_1/cis_1.1.7.x.yml b/tasks/section_1/cis_1.1.7.x.yml index 946572c..9fadf59 100644 --- a/tasks/section_1/cis_1.1.7.x.yml +++ b/tasks/section_1/cis_1.1.7.x.yml @@ -1,5 +1,8 @@ --- +- ansible.builtin.debug: + msg: "{{ mount_names }}" + - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home" block: - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Absent" @@ -8,9 +11,9 @@ - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Present" ansible.builtin.import_tasks: warning_facts.yml - vars: - warn_control_id: '1.1.7.1' + vars: + warn_control_id: '1.1.7.1' required_mount: '/home' when: - required_mount not in mount_names @@ -38,7 +41,6 @@ label: "{{ item.device }}" notify: Change_requires_reboot when: - - home_mount_present is defined - item.mount == "/home" - rhel9cis_rule_1_1_7_1 - rhel9cis_rule_1_1_7_2 or diff --git a/tasks/section_1/cis_1.1.x.yml b/tasks/section_1/cis_1.1.x.yml index dea0bbc..19c99c0 100644 --- a/tasks/section_1/cis_1.1.x.yml +++ b/tasks/section_1/cis_1.1.x.yml @@ -16,6 +16,14 @@ ansible.builtin.modprobe: name: usb-storage state: absent + + - name: "1.1.9 | PATCH | Disable USB Storage | blacklist" + lineinfile: + path: /etc/modprobe.d/blacklist.conf + regexp: "^(#)?blacklist usb-storage(\\s|$)" + line: "blacklist usb-storage" + create: true + mode: 0600 when: - rhel9cis_rule_1_1_9 tags: