From 7c34f61d11e306bd59eaa1225327c06c8440453a Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Jul 2023 08:50:53 +0100 Subject: [PATCH 1/2] #72 improve password check Signed-off-by: Mark Bolwell --- Changelog.md | 6 ++++++ tasks/main.yml | 1 + 2 files changed, 7 insertions(+) diff --git a/Changelog.md b/Changelog.md index adbc58b..1ceb4c6 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,6 +1,12 @@ # Changes to rhel9CIS +## 1.0.10 + +- [#72](https://github.com/ansible-lockdown/RHEL9-CIS/issues/72) + - Only run check when paybook user not a superuser + ## 1.0.9 + fixed assert for user password set thanks to @byjunks diff --git a/tasks/main.yml b/tasks/main.yml index f895847..277e43f 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -38,6 +38,7 @@ sudo_password_rule: rhel9cis_rule_5_3_4 when: - rhel9cis_rule_5_3_4 + - ansible_env.SUDO_USER is defined - not system_is_ec2 tags: - user_passwd From a791c81cf2a629ff17e002852614d8df767cb978 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 26 Jul 2023 11:42:21 +0100 Subject: [PATCH 2/2] 5.5.3 fix and update Signed-off-by: Mark Bolwell --- Changelog.md | 1 + tasks/section_5/cis_5.5.x.yml | 18 +++++------------- 2 files changed, 6 insertions(+), 13 deletions(-) diff --git a/Changelog.md b/Changelog.md index 1ceb4c6..0a98224 100644 --- a/Changelog.md +++ b/Changelog.md @@ -4,6 +4,7 @@ - [#72](https://github.com/ansible-lockdown/RHEL9-CIS/issues/72) - Only run check when paybook user not a superuser +- fix for 5.5.3 thanks to @nrg-fv ## 1.0.9 diff --git a/tasks/section_5/cis_5.5.x.yml b/tasks/section_5/cis_5.5.x.yml index 566823a..bb3cf34 100644 --- a/tasks/section_5/cis_5.5.x.yml +++ b/tasks/section_5/cis_5.5.x.yml @@ -77,19 +77,11 @@ - patch - rule_5.5.2 -- name: "5.5.3 | PATCH | Ensure password reuse is limited" - block: - - name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality" - ansible.builtin.lineinfile: - path: /etc/pam.d/system-auth - line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}" - insertafter: '^password\s*requisite\s*pam_pwquality.so' - - - name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix" - ansible.builtin.replace: - path: /etc/pam.d/system-auth - regexp: '^password\s*sufficient\s*pam_unix.so.*$' - replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}' +- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality" + ansible.builtin.lineinfile: + path: /etc/pam.d/system-auth + line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}" + insertafter: '^password\s*requisite\s*pam_pwquality.so' when: - rhel9cis_rule_5_5_3 tags: