33 lines
1.6 KiB
YAML
33 lines
1.6 KiB
YAML
---
|
|
- name: Lockdown | AUDIT | Check current authselect configuration
|
|
ansible.builtin.command: authselect current
|
|
register: baseline_lockdown_authselect_status
|
|
failed_when: false # Exit code is 2 when not configured
|
|
changed_when: false
|
|
|
|
- name: Lockdown | PATCH | Run Ansible Lockdown (RHEL9-CIS)
|
|
ansible.builtin.include_role:
|
|
name: RHEL9-CIS
|
|
vars:
|
|
# Ensure message of the day is configured properly - we have our own MOTD to apply
|
|
rhel9cis_rule_1_7_1: false
|
|
rhel9cis_rule_1_7_4: false
|
|
# Don't restrict user SSH access in sshd_config - this is managed by FreeIPA
|
|
rhel9cis_rule_5_1_7: false
|
|
# Only disable root login once authselect is configured
|
|
rhel9cis_rule_5_1_20: "{{ baseline_lockdown_authselect_status.rc != 2 }}"
|
|
# TODO: figure out boot password
|
|
rhel9cis_set_boot_pass: false
|
|
# TODO: We intend to later deploy a remote rsyslog sink
|
|
rhel9cis_syslog: rsyslog
|
|
rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}"
|
|
rhel9cis_warning_banner: "{{ baseline_warning_banner }}"
|
|
rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it.
|
|
# 2.2 Configure Client Services
|
|
# These services are required by FreeIPA.
|
|
rhel9cis_openldap_clients_required: true
|
|
# 5.3.2 Configure authselect
|
|
# ipaservers are part of Linux Identity Management. Joining your host to an IdM
|
|
# domain automatically configures SSSD authentication on your host.
|
|
rhel9cis_allow_authselect_updates: false
|
|
when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")
|