2025-10-31 22:36:32 +00:00
|
|
|
---
|
|
|
|
|
- name: Lockdown | AUDIT | Check current authselect configuration
|
2025-11-01 15:07:36 +00:00
|
|
|
ansible.builtin.command: authselect current
|
2025-10-31 22:36:32 +00:00
|
|
|
register: baseline_lockdown_authselect_status
|
|
|
|
|
failed_when: false # Exit code is 2 when not configured
|
|
|
|
|
changed_when: false
|
|
|
|
|
|
|
|
|
|
- name: Lockdown | PATCH | Run Ansible Lockdown (RHEL9-CIS)
|
|
|
|
|
ansible.builtin.include_role:
|
|
|
|
|
name: RHEL9-CIS
|
|
|
|
|
vars:
|
|
|
|
|
# Ensure message of the day is configured properly - we have our own MOTD to apply
|
|
|
|
|
rhel9cis_rule_1_7_1: false
|
|
|
|
|
rhel9cis_rule_1_7_4: false
|
|
|
|
|
# Don't restrict user SSH access in sshd_config - this is managed by FreeIPA
|
|
|
|
|
rhel9cis_rule_5_1_7: false
|
2025-11-01 15:07:36 +00:00
|
|
|
# Only disable root login once authselect is configured
|
|
|
|
|
rhel9cis_rule_5_1_20: "{{ baseline_lockdown_authselect_status.rc != 2 }}"
|
2025-10-31 22:36:32 +00:00
|
|
|
# TODO: figure out boot password
|
|
|
|
|
rhel9cis_set_boot_pass: false
|
|
|
|
|
# TODO: We intend to later deploy a remote rsyslog sink
|
|
|
|
|
rhel9cis_syslog: rsyslog
|
|
|
|
|
rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}"
|
|
|
|
|
rhel9cis_warning_banner: "{{ baseline_warning_banner }}"
|
|
|
|
|
when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")
|
