openstack/ansible-hardening
Code Issues Proposed changes

Auto-fix usage of modules via FQCN

Browse Source 
Since ansible-core 2.10 it is recommended to use modules via FQCN
In order to align with recommendation, we perform migration
by applying suggestions made by `ansible-lint --fix=fqcn`

Change-Id: I76bf3945bf413a8e9f0661f9aba697fdb8e993f7
This commit is contained in:
Dmitriy Rabotyagov
2025-02-13 07:54:07 +01:00
parent c774a1fb24
commit 4dbd95132c
21 changed files with 196 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
handlers/main.yml
View File

@@ -18,32 +18,32 @@
# NOTE(mhayden): It's not possible to use systemd to restart auditd on CentOS # NOTE(mhayden): It's not possible to use systemd to restart auditd on CentOS
# since it's a special service. Using the old service scripts is required. # since it's a special service. Using the old service scripts is required.
- name: Restart auditd - name: Restart auditd
command: service auditd restart # noqa: command-instead-of-module ansible.builtin.command: service auditd restart
changed_when: false changed_when: false
- name: Restart chrony - name: Restart chrony
service: ansible.builtin.service:
name: "{{ chrony_service }}" name: "{{ chrony_service }}"
state: restarted state: restarted
- name: Restart ssh - name: Restart ssh
service: ansible.builtin.service:
name: "{{ ssh_service }}" name: "{{ ssh_service }}"
state: restarted state: restarted
- name: Restart clamav - name: Restart clamav
service: ansible.builtin.service:
name: "{{ clamav_service }}" name: "{{ clamav_service }}"
state: restarted state: restarted
# Miscellaneous ############################################################## # Miscellaneous ##############################################################
- name: Generate auditd rules - name: Generate auditd rules
command: augenrules --load ansible.builtin.command: augenrules --load
changed_when: false changed_when: false
notify: restart auditd notify: restart auditd
- name: Update grub config - name: Update grub config
command: "{{ grub_update_cmd }}" ansible.builtin.command: "{{ grub_update_cmd }}"
changed_when: false changed_when: false
when: when:
- security_enable_grub_update | bool - security_enable_grub_update | bool
@@ -55,10 +55,10 @@
# NOTE(mhayden): Running `update-grub` causes the bootloader permissions to # NOTE(mhayden): Running `update-grub` causes the bootloader permissions to
# change, which breaks V-38583. # change, which breaks V-38583.
- name: Set bootloader file permissions after updating grub config - name: Set bootloader file permissions after updating grub config
file: ansible.builtin.file:
path: "{{ grub_config_file_boot }}" path: "{{ grub_config_file_boot }}"
mode: "0644" mode: "0644"
- name: Dconf update - name: Dconf update
command: dconf update ansible.builtin.command: dconf update
changed_when: false changed_when: false

2
tasks/contrib/main.yml
View File

@@ -14,5 +14,5 @@
# limitations under the License. # limitations under the License.
- name: Notify the deployer that contrib tasks are enabled - name: Notify the deployer that contrib tasks are enabled
debug: ansible.builtin.debug:
msg: "The contrib tasks are enabled." msg: "The contrib tasks are enabled."

15
tasks/main.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Gather variables for each operating system - name: Gather variables for each operating system
include_vars: "{{ lookup('first_found', params) }}" ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
vars: vars:
params: params:
files: files:
@@ -30,20 +30,20 @@
- always - always
- name: Check for check/audit mode - name: Check for check/audit mode
command: /bin/true ansible.builtin.command: /bin/true
register: noop_result register: noop_result
changed_when: false changed_when: false
tags: tags:
- always - always
- name: Check to see if we are booting with EFI or UEFI - name: Check to see if we are booting with EFI or UEFI
set_fact: ansible.builtin.set_fact:
booted_with_efi: "{{ ansible_facts['mounts'] | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}" booted_with_efi: "{{ ansible_facts['mounts'] | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}"
tags: tags:
- always - always
- name: Set facts - name: Set facts
set_fact: ansible.builtin.set_fact:
check_mode: "{{ noop_result is skipped }}" # noqa: var-naming[no-reserved] check_mode: "{{ noop_result is skipped }}" # noqa: var-naming[no-reserved]
linux_security_module: "{{ (ansible_facts['os_family'] == 'Debian') | ternary('apparmor', 'selinux') }}" linux_security_module: "{{ (ansible_facts['os_family'] == 'Debian') | ternary('apparmor', 'selinux') }}"
grub_config_file_boot: "{{ booted_with_efi | ternary(grub_conf_file_efi, grub_conf_file) }}" grub_config_file_boot: "{{ booted_with_efi | ternary(grub_conf_file_efi, grub_conf_file) }}"
@@ -51,16 +51,15 @@
- always - always
- name: Check if grub is present on the remote node - name: Check if grub is present on the remote node
stat: ansible.builtin.stat:
path: "{{ grub_update_cmd.split(' ')[0] }}" path: "{{ grub_update_cmd.split(' ')[0] }}"
register: grub_update_binary register: grub_update_binary
tags: tags:
- always - always
- name: Importing STIG tasks - name: Importing STIG tasks
import_tasks: "{{ stig_version }}stig/main.yml" ansible.builtin.import_tasks: "{{ stig_version }}stig/main.yml"
- name: Including contrib tasks - name: Including contrib tasks
include_tasks: contrib/main.yml ansible.builtin.include_tasks: contrib/main.yml
when: when:
- security_contrib_enabled | bool - security_contrib_enabled | bool

32
tasks/rhel7stig/accounts.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Check if /etc/security/pwquality.conf exists - name: Check if /etc/security/pwquality.conf exists
stat: ansible.builtin.stat:
path: /etc/security/pwquality.conf path: /etc/security/pwquality.conf
check_mode: false check_mode: false
register: pwquality_config_check register: pwquality_config_check
@@ -22,7 +22,7 @@
- always - always
- name: Set password quality requirements - name: Set password quality requirements
blockinfile: ansible.builtin.blockinfile:
dest: /etc/security/pwquality.conf dest: /etc/security/pwquality.conf
backup: true backup: true
insertbefore: EOF insertbefore: EOF
@@ -45,7 +45,7 @@
- V-71935 - V-71935
- name: Check for SHA512 password storage in PAM - name: Check for SHA512 password storage in PAM
command: "grep pam_unix.so {{ pam_password_file }}" ansible.builtin.command: "grep pam_unix.so {{ pam_password_file }}"
register: password_sha512_check register: password_sha512_check
changed_when: false changed_when: false
check_mode: false check_mode: false
@@ -53,7 +53,7 @@
- always - always
- name: Print warning if PAM is not using SHA512 for password storage - name: Print warning if PAM is not using SHA512 for password storage
debug: ansible.builtin.debug:
msg: > msg: >
PAM is not using SHA512 for password storage. This is a security issue. PAM is not using SHA512 for password storage. This is a security issue.
when: when:
@@ -65,7 +65,7 @@
- V-71919 - V-71919
- name: Ensure libuser is storing passwords using SHA512 - name: Ensure libuser is storing passwords using SHA512
ini_file: community.general.ini_file:
dest: /etc/libuser.conf dest: /etc/libuser.conf
section: defaults section: defaults
option: crypt_style option: crypt_style
@@ -84,7 +84,7 @@
# may be attached to a Kerberos realm and they may not have shadow data on the # may be attached to a Kerberos realm and they may not have shadow data on the
# system. See bug 1659232 for more details. # system. See bug 1659232 for more details.
- name: Set minimum password lifetime limit to 24 hours for interactive accounts - name: Set minimum password lifetime limit to 24 hours for interactive accounts
command: "chage -m 1 {{ item.name }}" ansible.builtin.command: "chage -m 1 {{ item.name }}"
changed_when: false changed_when: false
when: when:
- item.shadow is mapping - item.shadow is mapping
@@ -101,7 +101,7 @@
# may be attached to a Kerberos realm and they may not have shadow data on the # may be attached to a Kerberos realm and they may not have shadow data on the
# system. See bug 1659232 for more details. # system. See bug 1659232 for more details.
- name: Set maximum password lifetime limit to 60 days for interactive accounts - name: Set maximum password lifetime limit to 60 days for interactive accounts
command: "chage -M 60 {{ item.name }}" ansible.builtin.command: "chage -M 60 {{ item.name }}"
changed_when: false changed_when: false
when: when:
- item.shadow is mapping - item.shadow is mapping
@@ -115,7 +115,7 @@
- V-71931 - V-71931
- name: Ensure that users cannot reuse one of their last 5 passwords - name: Ensure that users cannot reuse one of their last 5 passwords
lineinfile: ansible.builtin.lineinfile:
dest: "{{ pam_password_file }}" dest: "{{ pam_password_file }}"
regexp: "^(password\\s+[a-z0-9\\=\\[\\] ]+\\s+pam_unix\\.so.+?)\\s+(?:remember=\\d+)?$" regexp: "^(password\\s+[a-z0-9\\=\\[\\] ]+\\s+pam_unix\\.so.+?)\\s+(?:remember=\\d+)?$"
line: "\\1 remember={{ security_password_remember_password }}" line: "\\1 remember={{ security_password_remember_password }}"
@@ -129,7 +129,7 @@
- V-71933 - V-71933
- name: Ensure accounts are disabled if the password expires - name: Ensure accounts are disabled if the password expires
lineinfile: ansible.builtin.lineinfile:
dest: /etc/default/useradd dest: /etc/default/useradd
regexp: "^[#\\s]*INACTIVE" regexp: "^[#\\s]*INACTIVE"
line: "INACTIVE=0" line: "INACTIVE=0"
@@ -141,7 +141,7 @@
- V-71941 - V-71941
- name: Apply shadow-utils configurations - name: Apply shadow-utils configurations
lineinfile: ansible.builtin.lineinfile:
dest: /etc/login.defs dest: /etc/login.defs
regexp: "^{{ item.parameter }}" regexp: "^{{ item.parameter }}"
line: "{{ item.parameter }} {{ item.value }}" line: "{{ item.parameter }} {{ item.value }}"
@@ -161,7 +161,7 @@
- V-72013 - V-72013
- name: Print warning for groups in /etc/passwd that are not in /etc/group - name: Print warning for groups in /etc/passwd that are not in /etc/group
debug: ansible.builtin.debug:
msg: > msg: >
The following users have GIDs in /etc/passwd that do not exist in /etc/group: The following users have GIDs in /etc/passwd that do not exist in /etc/group:
{{ hardening_user_list.users | selectattr('group', 'equalto', False) | map(attribute='name') | join(', ') }} {{ hardening_user_list.users | selectattr('group', 'equalto', False) | map(attribute='name') | join(', ') }}
@@ -185,7 +185,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Print warnings for non-root users with UID 0 - name: Print warnings for non-root users with UID 0
fail: ansible.builtin.fail:
msg: | msg: |
Only the 'root' user should have UID 0. Other users were found: Only the 'root' user should have UID 0. Other users were found:
{{ root_user_check.stdout_lines | join(', ') }}" {{ root_user_check.stdout_lines | join(', ') }}"
@@ -197,7 +197,7 @@
- V-72005 - V-72005
- name: Print warning for local interactive users without a home directory assigned - name: Print warning for local interactive users without a home directory assigned
debug: ansible.builtin.debug:
msg: | msg: |
The following users do not have a home directory assigned: The following users do not have a home directory assigned:
{{ hardening_user_list.users | selectattr('dir', 'equalto', '') | map(attribute='name') | join(', ') }} {{ hardening_user_list.users | selectattr('dir', 'equalto', '') | map(attribute='name') | join(', ') }}
@@ -210,7 +210,7 @@
- V-72011 - V-72011
- name: Check each user to see if its home directory exists on the filesystem - name: Check each user to see if its home directory exists on the filesystem
stat: ansible.builtin.stat:
path: "{{ item['dir'] }}" path: "{{ item['dir'] }}"
when: when:
- item['dir'] | length > 0 - item['dir'] | length > 0
@@ -222,7 +222,7 @@
- V-72015 - V-72015
- name: Print warning for users with an assigned home directory that does not exist - name: Print warning for users with an assigned home directory that does not exist
debug: ansible.builtin.debug:
msg: | msg: |
These users have a home directory assigned, but the directory does not exist: These users have a home directory assigned, but the directory does not exist:
{% for check in home_directory_checks.results %} {% for check in home_directory_checks.results %}
@@ -238,7 +238,7 @@
- V-72015 - V-72015
- name: Use pwquality when passwords are changed or created - name: Use pwquality when passwords are changed or created
lineinfile: ansible.builtin.lineinfile:
dest: /etc/pam.d/passwd dest: /etc/pam.d/passwd
line: "password required pam_pwquality.so retry=3" line: "password required pam_pwquality.so retry=3"
state: present state: present

16
tasks/rhel7stig/aide.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Verify that AIDE configuration directory exists - name: Verify that AIDE configuration directory exists
stat: ansible.builtin.stat:
path: "{{ item }}" path: "{{ item }}"
register: aide_conf register: aide_conf
check_mode: false check_mode: false
@@ -25,7 +25,7 @@
- always - always
- name: Exclude certain directories from AIDE - name: Exclude certain directories from AIDE
template: ansible.builtin.template:
src: ZZ_aide_exclusions.j2 src: ZZ_aide_exclusions.j2
dest: /etc/aide/aide.conf.d/ZZ_aide_exclusions dest: /etc/aide/aide.conf.d/ZZ_aide_exclusions
mode: "0644" mode: "0644"
@@ -39,7 +39,7 @@
# that meets the requirements of V-72069 and V-72071. That config # that meets the requirements of V-72069 and V-72071. That config
# is borrowed for Ubuntu 16.04 here. # is borrowed for Ubuntu 16.04 here.
- name: Configure AIDE to verify additional properties (Ubuntu) - name: Configure AIDE to verify additional properties (Ubuntu)
blockinfile: ansible.builtin.blockinfile:
dest: "/etc/aide/aide.conf" dest: "/etc/aide/aide.conf"
insertbefore: EOF insertbefore: EOF
marker: "# {mark} MANAGED BY ANSIBLE-HARDENING" marker: "# {mark} MANAGED BY ANSIBLE-HARDENING"
@@ -69,7 +69,7 @@
# NOTE(hwoarang): Add acl and xattrs on SUSE to meet V-72069 and V-72071. # NOTE(hwoarang): Add acl and xattrs on SUSE to meet V-72069 and V-72071.
- name: Configure AIDE to verify additional properties (SUSE) - name: Configure AIDE to verify additional properties (SUSE)
lineinfile: ansible.builtin.lineinfile:
dest: "/etc/aide.conf" dest: "/etc/aide.conf"
regexp: "(^Binlib.*= )" regexp: "(^Binlib.*= )"
line: "\\1p+i+n+u+g+s+b+m+c+sha256+sha512+acl+xattrs" line: "\\1p+i+n+u+g+s+b+m+c+sha256+sha512+acl+xattrs"
@@ -86,7 +86,7 @@
- V-72073 - V-72073
- name: Check to see if AIDE database is already in place - name: Check to see if AIDE database is already in place
stat: ansible.builtin.stat:
path: "{{ aide_database_file }}" path: "{{ aide_database_file }}"
register: aide_database register: aide_database
check_mode: false check_mode: false
@@ -97,7 +97,7 @@
# NOTE(hwoarang): aideinit is an Ubuntu wrapper. An alternative # NOTE(hwoarang): aideinit is an Ubuntu wrapper. An alternative
# would be to use aideinit || aide -i but that will possibly mask # would be to use aideinit || aide -i but that will possibly mask
# genuine aideinit failures. # genuine aideinit failures.
shell: "if test -x /usr/sbin/aideinit; then aideinit; else aide -i; fi" ansible.builtin.shell: "if test -x /usr/sbin/aideinit; then aideinit; else aide -i; fi"
changed_when: false changed_when: false
register: aide_init register: aide_init
when: when:
@@ -113,7 +113,7 @@
# copies the new AIDE database into place automatically with its AIDE wrapper # copies the new AIDE database into place automatically with its AIDE wrapper
# script. # script.
- name: Move AIDE database into place - name: Move AIDE database into place
command: "mv {{ aide_database_out_file }} {{ aide_database_file }}" ansible.builtin.command: "mv {{ aide_database_out_file }} {{ aide_database_file }}"
changed_when: false changed_when: false
when: when:
- aide_init is not skipped - aide_init is not skipped
@@ -127,7 +127,7 @@
# package doesn't come with a cron job file. Ubuntu packages a cron job for # package doesn't come with a cron job file. Ubuntu packages a cron job for
# AIDE checks already. # AIDE checks already.
- name: Create AIDE cron job - name: Create AIDE cron job
cron: ansible.builtin.cron:
name: aide name: aide
cron_file: aide cron_file: aide
user: root user: root

20
tasks/rhel7stig/apt.yml
View File

@@ -14,13 +14,13 @@
# limitations under the License. # limitations under the License.
- name: Ensure debsums is installed - name: Ensure debsums is installed
apt: ansible.builtin.apt:
name: debsums name: debsums
state: present state: present
when: security_check_package_checksums | bool when: security_check_package_checksums | bool
- name: Gather debsums report - name: Gather debsums report
shell: "debsums > {{ temp_dir }}/debsums.txt" ansible.builtin.shell: "debsums > {{ temp_dir }}/debsums.txt"
changed_when: false changed_when: false
failed_when: false failed_when: false
when: when:
@@ -28,7 +28,7 @@
- not check_mode | bool - not check_mode | bool
- name: V-71855 - Get files with invalid checksums (apt) - name: V-71855 - Get files with invalid checksums (apt)
shell: "grep -v OK$ {{ temp_dir }}/debsums.txt | awk '{ print $1 }'" # noqa risky-shell-pipe ansible.builtin.shell: "grep -v OK$ {{ temp_dir }}/debsums.txt | awk '{ print $1 }'"
register: invalid_checksum_files register: invalid_checksum_files
changed_when: false changed_when: false
when: when:
@@ -40,7 +40,7 @@
- V-71855 - V-71855
- name: V-71855 - Create comma-separated list - name: V-71855 - Create comma-separated list
set_fact: ansible.builtin.set_fact:
invalid_checksum_files_violations: "{{ invalid_checksum_files.stdout_lines | default([]) | join(', ') }}" invalid_checksum_files_violations: "{{ invalid_checksum_files.stdout_lines | default([]) | join(', ') }}"
when: when:
- security_check_package_checksums | bool - security_check_package_checksums | bool
@@ -51,7 +51,7 @@
- V-71855 - V-71855
- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (apt) - name: V-71855 - The cryptographic hash of system files and commands must match vendor values (apt)
debug: ansible.builtin.debug:
msg: > msg: >
The following files have checksums that differ from the checksum provided The following files have checksums that differ from the checksum provided
with their package. Each of these should be verified manually to ensure with their package. Each of these should be verified manually to ensure
@@ -68,14 +68,14 @@
# See the documentation for V-71977 for more details on this check. # See the documentation for V-71977 for more details on this check.
- name: Search for AllowUnauthenticated in /etc/apt/apt.conf.d/ - name: Search for AllowUnauthenticated in /etc/apt/apt.conf.d/
command: grep -r '^[^#].*AllowUnauthenticated \"true\"' /etc/apt/apt.conf.d/ ansible.builtin.command: grep -r '^[^#].*AllowUnauthenticated \"true\"' /etc/apt/apt.conf.d/
register: gpgcheck_result register: gpgcheck_result
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: false check_mode: false
- name: V-71977 - Package management tool must verify authenticity of packages - name: V-71977 - Package management tool must verify authenticity of packages
debug: ansible.builtin.debug:
msg: "Remove AllowUnauthenticated from files in /etc/apt/apt.conf.d/ to ensure packages are verified." msg: "Remove AllowUnauthenticated from files in /etc/apt/apt.conf.d/ to ensure packages are verified."
when: when:
- security_enable_gpgcheck_packages | bool - security_enable_gpgcheck_packages | bool
@@ -85,7 +85,7 @@
- V-71977 - V-71977
- name: V-71979 - Package management tool must verify authenticity of locally-installed packages - name: V-71979 - Package management tool must verify authenticity of locally-installed packages
lineinfile: ansible.builtin.lineinfile:
dest: /etc/dpkg/dpkg.cfg dest: /etc/dpkg/dpkg.cfg
regexp: "^(#)?no-debsig" regexp: "^(#)?no-debsig"
line: "#no-debsig" line: "#no-debsig"
@@ -97,7 +97,7 @@
- V-71979 - V-71979
- name: V-71987 - Clean requirements/dependencies when removing packages (dpkg) - name: V-71987 - Clean requirements/dependencies when removing packages (dpkg)
lineinfile: ansible.builtin.lineinfile:
dest: /etc/apt/apt.conf.d/security-autoremove dest: /etc/apt/apt.conf.d/security-autoremove
regexp: "^(#)?APT::Get::AutomaticRemove" regexp: "^(#)?APT::Get::AutomaticRemove"
line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";" line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";"
@@ -113,7 +113,7 @@
- V-71987 - V-71987
- name: Enable automatic package updates (apt) - name: Enable automatic package updates (apt)
copy: ansible.builtin.copy:
src: 20auto-upgrades src: 20auto-upgrades
dest: /etc/apt/apt.conf.d/20auto-upgrades dest: /etc/apt/apt.conf.d/20auto-upgrades
mode: "0644" mode: "0644"

4
tasks/rhel7stig/async_tasks.yml
View File

@@ -32,7 +32,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Locate top level directories to check for .shosts - name: Locate top level directories to check for .shosts
find: ansible.builtin.find:
paths: / paths: /
file_type: directory file_type: directory
register: shosts_dirs register: shosts_dirs
@@ -46,7 +46,7 @@
- V-72279 - V-72279
- name: Check for .shosts or shosts.equiv files - name: Check for .shosts or shosts.equiv files
find: ansible.builtin.find:
paths: "{{ shosts_dirs.files | map(attribute='path') | difference(security_rhel7_remove_shosts_exclude_dirs) }}" paths: "{{ shosts_dirs.files | map(attribute='path') | difference(security_rhel7_remove_shosts_exclude_dirs) }}"
recurse: true recurse: true
hidden: true hidden: true

20
tasks/rhel7stig/auditd.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Verify that auditd.conf exists - name: Verify that auditd.conf exists
stat: ansible.builtin.stat:
path: /etc/audit/auditd.conf path: /etc/audit/auditd.conf
register: auditd_conf register: auditd_conf
check_mode: false check_mode: false
@@ -22,7 +22,7 @@
- always - always
- name: Verify that audisp-remote.conf exists - name: Verify that audisp-remote.conf exists
stat: ansible.builtin.stat:
path: /etc/audisp/audisp-remote.conf path: /etc/audisp/audisp-remote.conf
register: audisp_remote_conf register: audisp_remote_conf
check_mode: false check_mode: false
@@ -30,7 +30,7 @@
- always - always
- name: V-72083 - The operating system must off-load audit records onto a different system or media from the system being audited - name: V-72083 - The operating system must off-load audit records onto a different system or media from the system being audited
lineinfile: ansible.builtin.lineinfile:
dest: /etc/audisp/audisp-remote.conf dest: /etc/audisp/audisp-remote.conf
regexp: "^(#)?remote_server" regexp: "^(#)?remote_server"
line: "remote_server = {{ security_audisp_remote_server }}" line: "remote_server = {{ security_audisp_remote_server }}"
@@ -45,7 +45,7 @@
- V-72083 - V-72083
- name: V-72085 - The operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited - name: V-72085 - The operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited
lineinfile: ansible.builtin.lineinfile:
dest: /etc/audisp/audisp-remote.conf dest: /etc/audisp/audisp-remote.conf
regexp: "^(#)?enable_krb5" regexp: "^(#)?enable_krb5"
line: "enable_krb5 = yes" line: "enable_krb5 = yes"
@@ -60,14 +60,14 @@
- V-72085 - V-72085
- name: Get valid system architectures for audit rules - name: Get valid system architectures for audit rules
set_fact: ansible.builtin.set_fact:
auditd_architectures: "{{ (ansible_facts['architecture'] == 'ppc64le') | ternary(['ppc64'], ['b32', 'b64']) }}" auditd_architectures: "{{ (ansible_facts['architecture'] == 'ppc64le') | ternary(['ppc64'], ['b32', 'b64']) }}"
check_mode: false check_mode: false
tags: tags:
- always - always
- name: Remove system default audit.rules file - name: Remove system default audit.rules file
file: ansible.builtin.file:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
state: absent state: absent
when: when:
@@ -78,7 +78,7 @@
- always - always
- name: Remove old RHEL 6 audit rules file - name: Remove old RHEL 6 audit rules file
file: ansible.builtin.file:
path: /etc/audit/rules.d/osas-auditd.rules path: /etc/audit/rules.d/osas-auditd.rules
state: absent state: absent
when: when:
@@ -89,7 +89,7 @@
- always - always
- name: Deploy rules for auditd based on STIG requirements - name: Deploy rules for auditd based on STIG requirements
template: ansible.builtin.template:
src: osas-auditd-rhel7.j2 src: osas-auditd-rhel7.j2
dest: /etc/audit/rules.d/osas-auditd-rhel7.rules dest: /etc/audit/rules.d/osas-auditd-rhel7.rules
mode: "0644" mode: "0644"
@@ -155,7 +155,7 @@
- V-72081 - V-72081
- name: Adjust auditd/audispd configurations - name: Adjust auditd/audispd configurations
lineinfile: ansible.builtin.lineinfile:
dest: "{{ item.config }}" dest: "{{ item.config }}"
regexp: "^#?{{ item.parameter }}\\s*=" regexp: "^#?{{ item.parameter }}\\s*="
line: "{{ item.parameter }} = {{ item.value }}" line: "{{ item.parameter }} = {{ item.value }}"
@@ -174,7 +174,7 @@
- V-72093 - V-72093
- name: Ensure auditd is running and enabled at boot time - name: Ensure auditd is running and enabled at boot time
service: ansible.builtin.service:
name: auditd name: auditd
state: started state: started
enabled: true enabled: true

32
tasks/rhel7stig/auth.yml
View File

@@ -16,7 +16,7 @@
# NOTE(mhayden): pam_faildelay expects the `delay` parameter to be in # NOTE(mhayden): pam_faildelay expects the `delay` parameter to be in
# microseconds. # microseconds.
- name: Set pam_faildelay configuration on Ubuntu - name: Set pam_faildelay configuration on Ubuntu
lineinfile: ansible.builtin.lineinfile:
dest: /etc/pam.d/login dest: /etc/pam.d/login
regexp: "^(auth[\\s]+optional[\\s]+pam_faildelay.so).*$" regexp: "^(auth[\\s]+optional[\\s]+pam_faildelay.so).*$"
line: "\\1 delay={{ (security_shadow_utils_fail_delay | int) * 10**6 }}" line: "\\1 delay={{ (security_shadow_utils_fail_delay | int) * 10**6 }}"
@@ -31,7 +31,7 @@
- V-71951 - V-71951
- name: Prevent users with blank or null passwords from authenticating (Debian/Ubuntu) - name: Prevent users with blank or null passwords from authenticating (Debian/Ubuntu)
lineinfile: ansible.builtin.lineinfile:
dest: "{{ pam_auth_file }}" dest: "{{ pam_auth_file }}"
state: present state: present
regexp: "^(.*)nullok_secure(.*)$" regexp: "^(.*)nullok_secure(.*)$"
@@ -47,7 +47,7 @@
- V-71937 - V-71937
- name: Prevent users with blank or null passwords from authenticating (Red Hat) - name: Prevent users with blank or null passwords from authenticating (Red Hat)
lineinfile: ansible.builtin.lineinfile:
dest: "{{ item[1] }}" dest: "{{ item[1] }}"
state: present state: present
regexp: "^({{ item[0] }}.*sufficient.*)nullok(.*)$" regexp: "^({{ item[0] }}.*sufficient.*)nullok(.*)$"
@@ -64,7 +64,7 @@
- V-71937 - V-71937
- name: Prevent users with blank or null passwords from authenticating (SUSE) - name: Prevent users with blank or null passwords from authenticating (SUSE)
lineinfile: ansible.builtin.lineinfile:
dest: "{{ item }}" dest: "{{ item }}"
state: present state: present
regexp: "^(.*required.*)nullok(.*)$" regexp: "^(.*required.*)nullok(.*)$"
@@ -83,7 +83,7 @@
- V-71937 - V-71937
- name: Lock accounts after three failed login attempts a 15 minute period - name: Lock accounts after three failed login attempts a 15 minute period
blockinfile: ansible.builtin.blockinfile:
dest: "{{ pam_password_file }}" dest: "{{ pam_password_file }}"
state: present state: present
marker: "# {mark} MANAGED BY ANSIBLE-HARDENING" marker: "# {mark} MANAGED BY ANSIBLE-HARDENING"
@@ -106,7 +106,7 @@
# those lines that have a '#' as the first character or '#' as the first # those lines that have a '#' as the first character or '#' as the first
# character following a space (or series of spaces). # character following a space (or series of spaces).
- name: Check for 'nopasswd' in sudoers files - name: Check for 'nopasswd' in sudoers files
shell: 'grep -ir nopasswd /etc/sudoers /etc/sudoers.d/ | egrep -v "^([[:space:]]*)?(#|$)" || echo "not found"' # noqa risky-shell-pipe ansible.builtin.shell: 'grep -ir nopasswd /etc/sudoers /etc/sudoers.d/ | egrep -v "^([[:space:]]*)?(#|$)" || echo "not found"'
register: sudoers_nopasswd_check register: sudoers_nopasswd_check
changed_when: false changed_when: false
when: when:
@@ -132,7 +132,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Check for '!authenticate' in sudoers files - name: Check for '!authenticate' in sudoers files
shell: grep -ir '\!authenticate' /etc/sudoers /etc/sudoers.d/ || echo 'not found' ansible.builtin.shell: grep -ir '\!authenticate' /etc/sudoers /etc/sudoers.d/ || echo 'not found'
register: sudoers_authenticate_check register: sudoers_authenticate_check
changed_when: false changed_when: false
tags: tags:
@@ -156,7 +156,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Check if sssd.conf exists - name: Check if sssd.conf exists
stat: ansible.builtin.stat:
path: /etc/sssd/sssd.conf path: /etc/sssd/sssd.conf
register: sssd_conf_check register: sssd_conf_check
check_mode: false check_mode: false
@@ -166,7 +166,7 @@
# NOTE(mhayden): Some systems, such as ARM, don't have grub at all. This task # NOTE(mhayden): Some systems, such as ARM, don't have grub at all. This task
# should be skipped on those systems. # should be skipped on those systems.
- name: Check if GRUB2 custom file exists - name: Check if GRUB2 custom file exists
stat: ansible.builtin.stat:
path: "{{ grub_custom_file }}" path: "{{ grub_custom_file }}"
register: grub_custom_file_check register: grub_custom_file_check
check_mode: false check_mode: false
@@ -176,7 +176,7 @@
- name: Set a GRUB 2 password for single-user/maintenance modes - name: Set a GRUB 2 password for single-user/maintenance modes
block: block:
- name: Define password options for grub - name: Define password options for grub
blockinfile: ansible.builtin.blockinfile:
path: "{{ grub_custom_file }}" path: "{{ grub_custom_file }}"
insertbefore: EOF insertbefore: EOF
marker: "# {mark} MANAGED BY ANSIBLE-HARDENING" marker: "# {mark} MANAGED BY ANSIBLE-HARDENING"
@@ -187,7 +187,7 @@
notify: notify:
- Update grub config - Update grub config
- name: Set CLASS for grub file - name: Set CLASS for grub file
lineinfile: ansible.builtin.lineinfile:
path: "{{ grub_linux_file }}" path: "{{ grub_linux_file }}"
regexp: "^CLASS=.*" regexp: "^CLASS=.*"
line: 'CLASS="--class gnu-linux --class gnu --class os --unrestricted"' line: 'CLASS="--class gnu-linux --class gnu --class os --unrestricted"'
@@ -205,7 +205,7 @@
- V-71963 - V-71963
- name: V-72217 - The operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types. - name: V-72217 - The operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.
blockinfile: ansible.builtin.blockinfile:
dest: /etc/security/limits.d/ansible-hardening-maxlogins.conf dest: /etc/security/limits.d/ansible-hardening-maxlogins.conf
create: true create: true
mode: "0644" mode: "0644"
@@ -221,7 +221,7 @@
- V-72217 - V-72217
- name: Check for pam_lastlog in PAM configuration - name: Check for pam_lastlog in PAM configuration
command: "grep pam_lastlog {{ pam_postlogin_file }}" ansible.builtin.command: "grep pam_lastlog {{ pam_postlogin_file }}"
register: pam_lastlog_check register: pam_lastlog_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -230,7 +230,7 @@
- always - always
- name: V-72275 - Display date/time of last logon after logon - name: V-72275 - Display date/time of last logon after logon
debug: ansible.builtin.debug:
msg: > msg: >
The 'pam_lastlog' directive is missing in {{ pam_postlogin_file }}. The 'pam_lastlog' directive is missing in {{ pam_postlogin_file }}.
This is required by V-72275. This is required by V-72275.
@@ -242,7 +242,7 @@
- V-72275 - V-72275
- name: Ensure .shosts find has finished - name: Ensure .shosts find has finished
async_status: ansible.builtin.async_status:
jid: "{{ shosts_find.ansible_job_id }}" jid: "{{ shosts_find.ansible_job_id }}"
failed_when: false failed_when: false
changed_when: false changed_when: false
@@ -258,7 +258,7 @@
- V-72279 - V-72279
- name: Remove .shosts or shosts.equiv files - name: Remove .shosts or shosts.equiv files
file: ansible.builtin.file:
path: "{{ item.path }}" path: "{{ item.path }}"
state: absent state: absent
with_items: "{{ job_result.files }}" with_items: "{{ job_result.files }}"

8
tasks/rhel7stig/dnf.yml
View File

@@ -14,10 +14,10 @@
# limitations under the License. # limitations under the License.
- name: Including rpm tasks - name: Including rpm tasks
include_tasks: rpm.yml ansible.builtin.include_tasks: rpm.yml
- name: Check if /etc/dnf/automatic.conf exists - name: Check if /etc/dnf/automatic.conf exists
stat: ansible.builtin.stat:
path: /etc/dnf/automatic.conf path: /etc/dnf/automatic.conf
check_mode: false check_mode: false
register: dnf_automatic_config_check register: dnf_automatic_config_check
@@ -28,7 +28,7 @@
- always - always
- name: Enable automatic package updates (dnf) - name: Enable automatic package updates (dnf)
lineinfile: ansible.builtin.lineinfile:
dest: /etc/dnf/automatic.conf dest: /etc/dnf/automatic.conf
regexp: "^apply_updates" regexp: "^apply_updates"
line: "apply_updates = yes" line: "apply_updates = yes"
@@ -77,7 +77,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Enable dnf automatic timer for automatic package updates - name: Enable dnf automatic timer for automatic package updates
systemd: ansible.builtin.systemd:
name: "{{ dnf_automatic_timer }}" name: "{{ dnf_automatic_timer }}"
enabled: true enabled: true
state: started state: started

20
tasks/rhel7stig/file_perms.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: V-71849 - Get packages with incorrect file permissions or ownership - name: V-71849 - Get packages with incorrect file permissions or ownership
shell: "grep '^.M' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'" # noqa risky-shell-pipe ansible.builtin.shell: "grep '^.M' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
register: rpmverify_package_list register: rpmverify_package_list
changed_when: false changed_when: false
when: when:
@@ -47,7 +47,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: Search for files/directories with an invalid owner - name: Search for files/directories with an invalid owner
command: find / -xdev -nouser -fstype local # noqa: command-instead-of-module ansible.builtin.command: find / -xdev -nouser -fstype local
register: invalid_owner_files register: invalid_owner_files
changed_when: false changed_when: false
when: when:
@@ -56,7 +56,7 @@
- always - always
- name: V-72007 - All files and directories must have a valid owner. - name: V-72007 - All files and directories must have a valid owner.
debug: ansible.builtin.debug:
msg: | msg: |
Files and directories were found that are owned by an invalid user: Files and directories were found that are owned by an invalid user:
{{ invalid_owner_files.stdout_lines | join('\n') }} {{ invalid_owner_files.stdout_lines | join('\n') }}
@@ -70,7 +70,7 @@
- V-72007 - V-72007
- name: Search for files/directories with an invalid group owner - name: Search for files/directories with an invalid group owner
command: find / -xdev -nogroup -fstype local # noqa: command-instead-of-module ansible.builtin.command: find / -xdev -nogroup -fstype local
register: invalid_group_owner_files register: invalid_group_owner_files
changed_when: false changed_when: false
when: when:
@@ -79,7 +79,7 @@
- always - always
- name: V-72009 - All files and directories must have a valid group owner. - name: V-72009 - All files and directories must have a valid group owner.
debug: ansible.builtin.debug:
msg: | msg: |
Files and directories were found that are owned by an invalid group: Files and directories were found that are owned by an invalid group:
{{ invalid_group_owner_files.stdout_lines | join('\n') }} {{ invalid_group_owner_files.stdout_lines | join('\n') }}
@@ -93,7 +93,7 @@
- V-72009 - V-72009
- name: Set proper owner, group owner, and permissions on home directories - name: Set proper owner, group owner, and permissions on home directories
file: ansible.builtin.file:
dest: "{{ item.dir }}" dest: "{{ item.dir }}"
owner: "{{ item.name }}" owner: "{{ item.name }}"
group: "{{ item.group.name }}" group: "{{ item.group.name }}"
@@ -111,7 +111,7 @@
- V-72021 - V-72021
- name: Find all world-writable directories - name: Find all world-writable directories
shell: "find / -perm -002 -type d -exec ls -lLd {} \\; | tr -s ' ' | cut -d' ' -f 4,9 | grep -v ^root" # noqa risky-shell-pipe ansible.builtin.shell: "find / -perm -002 -type d -exec ls -lLd {} \\; | tr -s ' ' | cut -d' ' -f 4,9 | grep -v ^root"
register: world_writable_dirs register: world_writable_dirs
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -122,7 +122,7 @@
- always - always
- name: V-72047 - All world-writable directories must be group-owned by root, sys, bin, or an application group. - name: V-72047 - All world-writable directories must be group-owned by root, sys, bin, or an application group.
debug: ansible.builtin.debug:
msg: | msg: |
The group owners on the following world-writable directories should be examined: The group owners on the following world-writable directories should be examined:
{{ world_writable_dirs.stdout }} {{ world_writable_dirs.stdout }}
@@ -135,14 +135,14 @@
- V-72047 - V-72047
- name: Check if /etc/cron.allow exists - name: Check if /etc/cron.allow exists
stat: ansible.builtin.stat:
path: /etc/cron.allow path: /etc/cron.allow
register: cron_allow_check register: cron_allow_check
tags: tags:
- always - always
- name: Set owner/group owner on /etc/cron.allow - name: Set owner/group owner on /etc/cron.allow
file: ansible.builtin.file:
path: /etc/cron.allow path: /etc/cron.allow
owner: root owner: root
group: root group: root

20
tasks/rhel7stig/graphical.yml
View File

@@ -14,13 +14,13 @@
# limitations under the License. # limitations under the License.
- name: Check if gdm is installed and configured - name: Check if gdm is installed and configured
stat: ansible.builtin.stat:
path: /etc/gdm/custom.conf path: /etc/gdm/custom.conf
register: gdm_conf_check register: gdm_conf_check
check_mode: false check_mode: false
- name: V-71953 - The operating system must not allow an unattended or automatic logon to the system via a graphical user interface - name: V-71953 - The operating system must not allow an unattended or automatic logon to the system via a graphical user interface
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm/custom.conf dest: /etc/gdm/custom.conf
line: "^AutomaticLoginEnable=true" line: "^AutomaticLoginEnable=true"
state: absent state: absent
@@ -33,7 +33,7 @@
- V-71953 - V-71953
- name: V-71955 - The operating system must not allow guest logon to the system. - name: V-71955 - The operating system must not allow guest logon to the system.
lineinfile: ansible.builtin.lineinfile:
dest: /etc/gdm/custom.conf dest: /etc/gdm/custom.conf
line: "^TimedLoginEnable=true" line: "^TimedLoginEnable=true"
state: absent state: absent
@@ -46,14 +46,14 @@
- V-71955 - V-71955
- name: Check for dconf profiles - name: Check for dconf profiles
stat: ansible.builtin.stat:
path: /etc/dconf/profile path: /etc/dconf/profile
register: dconf_check register: dconf_check
tags: tags:
- always - always
- name: Create a user profile in dconf - name: Create a user profile in dconf
copy: ansible.builtin.copy:
src: dconf-user-profile src: dconf-user-profile
dest: /etc/dconf/profile/user dest: /etc/dconf/profile/user
mode: "0644" mode: "0644"
@@ -67,7 +67,7 @@
- V-71901 - V-71901
- name: Create dconf directories - name: Create dconf directories
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
state: directory state: directory
mode: "0755" mode: "0755"
@@ -86,7 +86,7 @@
- V-71901 - V-71901
- name: Configure graphical session locking - name: Configure graphical session locking
template: ansible.builtin.template:
src: dconf-screensaver-lock.j2 src: dconf-screensaver-lock.j2
dest: /etc/dconf/db/local.d/00-screensaver dest: /etc/dconf/db/local.d/00-screensaver
mode: "0644" mode: "0644"
@@ -102,7 +102,7 @@
- V-71901 - V-71901
- name: Prevent users from changing graphical session locking configurations - name: Prevent users from changing graphical session locking configurations
template: ansible.builtin.template:
src: dconf-session-user-config-lockout.j2 src: dconf-session-user-config-lockout.j2
dest: /etc/dconf/db/local.d/locks/session dest: /etc/dconf/db/local.d/locks/session
mode: "0644" mode: "0644"
@@ -118,7 +118,7 @@
- V-71901 - V-71901
- name: Create a GDM profile for displaying a login banner - name: Create a GDM profile for displaying a login banner
copy: ansible.builtin.copy:
src: dconf-profile-gdm src: dconf-profile-gdm
dest: /etc/dconf/profile/gdm dest: /etc/dconf/profile/gdm
mode: "0644" mode: "0644"
@@ -132,7 +132,7 @@
- V-71859 - V-71859
- name: Create a GDM keyfile for machine-wide settings - name: Create a GDM keyfile for machine-wide settings
template: ansible.builtin.template:
src: dconf-gdm-banner-message.j2 src: dconf-gdm-banner-message.j2
dest: "{{ item }}" dest: "{{ item }}"
mode: "0644" mode: "0644"

14
tasks/rhel7stig/kernel.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: V-71983 - USB mass storage must be disabled. - name: V-71983 - USB mass storage must be disabled.
lineinfile: ansible.builtin.lineinfile:
dest: /etc/modprobe.d/ansible-hardening-disable-usb-storage.conf dest: /etc/modprobe.d/ansible-hardening-disable-usb-storage.conf
line: install usb-storage /bin/true line: install usb-storage /bin/true
create: true create: true
@@ -27,7 +27,7 @@
- V-71983 - V-71983
- name: Set sysctl configurations - name: Set sysctl configurations
sysctl: ansible.posix.sysctl:
name: "{{ item.name }}" name: "{{ item.name }}"
value: "{{ item.value }}" value: "{{ item.value }}"
state: "{{ item.enabled | ternary('present', 'absent') }}" state: "{{ item.enabled | ternary('present', 'absent') }}"
@@ -51,7 +51,7 @@
- C-00001 - C-00001
- name: Check kdump service - name: Check kdump service
command: systemctl status kdump # noqa: command-instead-of-module ansible.builtin.command: systemctl status kdump
register: kdump_service_check register: kdump_service_check
failed_when: kdump_service_check.rc not in [0,3,4] failed_when: kdump_service_check.rc not in [0,3,4]
changed_when: false changed_when: false
@@ -62,7 +62,7 @@
- V-72057 - V-72057
- name: V-72057 - Kernel core dumps must be disabled unless needed. - name: V-72057 - Kernel core dumps must be disabled unless needed.
service: ansible.builtin.service:
name: kdump name: kdump
state: stopped state: stopped
enabled: false enabled: false
@@ -75,7 +75,7 @@
- V-72057 - V-72057
- name: Check if FIPS is enabled - name: Check if FIPS is enabled
command: cat /proc/sys/crypto/fips_enabled ansible.builtin.command: cat /proc/sys/crypto/fips_enabled
register: fips_check register: fips_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -86,7 +86,7 @@
- always - always
- name: Print a warning if FIPS isn't enabled - name: Print a warning if FIPS isn't enabled
debug: ansible.builtin.debug:
msg: > msg: >
FIPS is not enabled at boot time on this server. FIPS is not enabled at boot time on this server.
The STIG requires FIPS to be enabled at boot time. The STIG requires FIPS to be enabled at boot time.
@@ -100,7 +100,7 @@
- V-72067 - V-72067
- name: V-77821 - Datagram Congestion Control Protocol (DCCP) kernel module must be disabled - name: V-77821 - Datagram Congestion Control Protocol (DCCP) kernel module must be disabled
copy: ansible.builtin.copy:
src: ansible-hardening-disable-dccp.conf src: ansible-hardening-disable-dccp.conf
dest: /etc/modprobe.d/ansible-hardening-disable-dccp.conf dest: /etc/modprobe.d/ansible-hardening-disable-dccp.conf
mode: "0644" mode: "0644"

16
tasks/rhel7stig/lsm.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Check apparmor_status output - name: Check apparmor_status output
command: apparmor_status ansible.builtin.command: apparmor_status
register: apparmor_status_output register: apparmor_status_output
check_mode: false check_mode: false
changed_when: false changed_when: false
@@ -32,7 +32,7 @@
# started apparmor each time. This breaks idempotency and we check # started apparmor each time. This breaks idempotency and we check
# systemd's status directly as an alternative. # systemd's status directly as an alternative.
- name: Check if apparmor is running - name: Check if apparmor is running
command: "systemctl status apparmor" # noqa: command-instead-of-module ansible.builtin.command: "systemctl status apparmor"
register: systemctl_apparmor_status register: systemctl_apparmor_status
check_mode: false check_mode: false
changed_when: false changed_when: false
@@ -45,7 +45,7 @@
- V-71989 - V-71989
- name: Ensure AppArmor is enabled at boot time - name: Ensure AppArmor is enabled at boot time
service: ansible.builtin.service:
name: apparmor name: apparmor
enabled: true enabled: true
when: when:
@@ -60,7 +60,7 @@
# unit will always say AppArmor is dead. This means that the following task # unit will always say AppArmor is dead. This means that the following task
# will always start the unit every time it runs (which breaks idempotency). # will always start the unit every time it runs (which breaks idempotency).
- name: Ensure AppArmor is running - name: Ensure AppArmor is running
service: ansible.builtin.service:
name: apparmor name: apparmor
state: started state: started
changed_when: changed_when:
@@ -79,7 +79,7 @@
# to switch to permissive/enforcing in an online way when SELinux is completely # to switch to permissive/enforcing in an online way when SELinux is completely
# disabled at boot time. # disabled at boot time.
- name: Ensure SELinux is in enforcing mode on the next reboot - name: Ensure SELinux is in enforcing mode on the next reboot
selinux: ansible.posix.selinux:
state: enforcing state: enforcing
policy: targeted policy: targeted
register: selinux_status_change register: selinux_status_change
@@ -93,7 +93,7 @@
- V-71991 - V-71991
- name: Relabel files on next boot if SELinux mode changed - name: Relabel files on next boot if SELinux mode changed
file: ansible.builtin.file:
path: /.autorelabel path: /.autorelabel
state: touch state: touch
mode: "0644" mode: "0644"
@@ -109,7 +109,7 @@
# NOTE(mhayden): Ansible's find module doesn't support searching for files # NOTE(mhayden): Ansible's find module doesn't support searching for files
# based on SELinux contexts yet. # based on SELinux contexts yet.
- name: Check for unlabeled device files - name: Check for unlabeled device files
command: "find /dev -context '*unlabeled_t*'" ansible.builtin.command: "find /dev -context '*unlabeled_t*'"
register: unlabeled_devices register: unlabeled_devices
changed_when: false changed_when: false
check_mode: false check_mode: false
@@ -122,7 +122,7 @@
- V-72039 - V-72039
- name: V-72039 - All system device files must be correctly labeled to prevent unauthorized modification. - name: V-72039 - All system device files must be correctly labeled to prevent unauthorized modification.
debug: ansible.builtin.debug:
msg: | msg: |
Devices were found without SELinux labels: Devices were found without SELinux labels:
{% for device in unlabeled_devices.stdout_lines %} {% for device in unlabeled_devices.stdout_lines %}

35
tasks/rhel7stig/main.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Create temporary directory to hold any temporary files - name: Create temporary directory to hold any temporary files
tempfile: ansible.builtin.tempfile:
state: directory state: directory
suffix: hardening suffix: hardening
register: mktemp_result register: mktemp_result
@@ -24,7 +24,7 @@
- always - always
- name: Set a fact for the temporary directory - name: Set a fact for the temporary directory
set_fact: ansible.builtin.set_fact:
temp_dir: "{{ mktemp_result.path }}" temp_dir: "{{ mktemp_result.path }}"
changed_when: false changed_when: false
when: when:
@@ -35,8 +35,7 @@
# Some of the tasks in the role may take a long time to run. Let's start them # Some of the tasks in the role may take a long time to run. Let's start them
# as early as possible so they have time to finish. # as early as possible so they have time to finish.
- name: Importing async_tasks tasks - name: Importing async_tasks tasks
import_tasks: async_tasks.yml ansible.builtin.import_tasks: async_tasks.yml
- name: Get user data for all users on the system - name: Get user data for all users on the system
get_users: get_users:
min_uid: 0 min_uid: 0
@@ -56,7 +55,7 @@
# NOTE(mhayden): EPEL is only needed for the clamav packages. We should only # NOTE(mhayden): EPEL is only needed for the clamav packages. We should only
# install EPEL if the deployer asked for clamav to be installed. # install EPEL if the deployer asked for clamav to be installed.
- name: Install EPEL repository - name: Install EPEL repository
yum: ansible.builtin.dnf:
name: "{{ security_epel_release_package }}" name: "{{ security_epel_release_package }}"
state: "{{ security_package_state }}" state: "{{ security_package_state }}"
when: when:
@@ -69,43 +68,43 @@
# Package installations and removals must come first so that configuration # Package installations and removals must come first so that configuration
# changes can be made later. # changes can be made later.
- name: Importing packages tasks - name: Importing packages tasks
import_tasks: packages.yml ansible.builtin.import_tasks: packages.yml
tags: tags:
- always - always
# Package managers are managed first since the changes in these tasks will # Package managers are managed first since the changes in these tasks will
# affect the remainder of the tasks in the role. # affect the remainder of the tasks in the role.
- name: Including OS-specific tasks - name: Including OS-specific tasks
include_tasks: "{{ ansible_facts['pkg_mgr'] }}.yml" ansible.builtin.include_tasks: "{{ ansible_facts['pkg_mgr'] }}.yml"
# The bulk of the security changes are applied in these tasks. The tasks in # The bulk of the security changes are applied in these tasks. The tasks in
# each file are tagged with the same name (for example, tasks in `auth.yml` # each file are tagged with the same name (for example, tasks in `auth.yml`
# are tagged with `auth`). Also, the tag name matches up with the "STIG # are tagged with `auth`). Also, the tag name matches up with the "STIG
# Controls by Tag" section of the role documentation. # Controls by Tag" section of the role documentation.
- name: Importing accounts tasks - name: Importing accounts tasks
import_tasks: accounts.yml ansible.builtin.import_tasks: accounts.yml
- name: Importing aide tasks - name: Importing aide tasks
import_tasks: aide.yml ansible.builtin.import_tasks: aide.yml
when: security_rhel7_enable_aide | bool when: security_rhel7_enable_aide | bool
- name: Importing auditd tasks - name: Importing auditd tasks
import_tasks: auditd.yml ansible.builtin.import_tasks: auditd.yml
- name: Importing auth tasks - name: Importing auth tasks
import_tasks: auth.yml ansible.builtin.import_tasks: auth.yml
- name: Importing file_perms tasks - name: Importing file_perms tasks
import_tasks: file_perms.yml ansible.builtin.import_tasks: file_perms.yml
- name: Importing graphical tasks - name: Importing graphical tasks
import_tasks: graphical.yml ansible.builtin.import_tasks: graphical.yml
- name: Importing kernel tasks - name: Importing kernel tasks
import_tasks: kernel.yml ansible.builtin.import_tasks: kernel.yml
- name: Importing lsm tasks - name: Importing lsm tasks
import_tasks: lsm.yml ansible.builtin.import_tasks: lsm.yml
- name: Importing misc tasks - name: Importing misc tasks
import_tasks: misc.yml ansible.builtin.import_tasks: misc.yml
- name: Importing sshd tasks - name: Importing sshd tasks
import_tasks: sshd.yml ansible.builtin.import_tasks: sshd.yml
- name: Remove the temporary directory - name: Remove the temporary directory
file: ansible.builtin.file:
path: "{{ temp_dir }}" path: "{{ temp_dir }}"
state: absent state: absent
changed_when: false changed_when: false

72
tasks/rhel7stig/misc.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Check autofs service - name: Check autofs service
command: systemctl status autofs # noqa: command-instead-of-module ansible.builtin.command: systemctl status autofs # noqa: command-instead-of-module
register: autofs_check register: autofs_check
failed_when: autofs_check.rc not in [0,3,4] failed_when: autofs_check.rc not in [0,3,4]
changed_when: false changed_when: false
@@ -23,7 +23,7 @@
- always - always
- name: V-71985 - File system automounter must be disabled unless required. - name: V-71985 - File system automounter must be disabled unless required.
service: ansible.builtin.service:
name: autofs name: autofs
state: stopped state: stopped
enabled: false enabled: false
@@ -39,7 +39,7 @@
# https://github.com/ansible/ansible/issues/68680 # https://github.com/ansible/ansible/issues/68680
# This returns an exit code of 0 if it's running, 3 if it's masked. # This returns an exit code of 0 if it's running, 3 if it's masked.
- name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled - name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled
systemd: ansible.builtin.systemd:
name: ctrl-alt-del.target name: ctrl-alt-del.target
enabled: false enabled: false
when: when:
@@ -50,7 +50,7 @@
- V-71993 - V-71993
- name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled - name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled
systemd: ansible.builtin.systemd:
name: ctrl-alt-del.target name: ctrl-alt-del.target
masked: true masked: true
daemon_reload: true daemon_reload: true
@@ -62,7 +62,7 @@
- V-71993 - V-71993
- name: Check for /home on mounted filesystem - name: Check for /home on mounted filesystem
debug: ansible.builtin.debug:
msg: | msg: |
The STIG requires that /home is on its own filesystem, but this system The STIG requires that /home is on its own filesystem, but this system
does not appear to be following the requirement. does not appear to be following the requirement.
@@ -74,7 +74,7 @@
- V-72059 - V-72059
- name: Check for /var on mounted filesystem - name: Check for /var on mounted filesystem
debug: ansible.builtin.debug:
msg: | msg: |
The STIG requires that /var is on its own filesystem, but this system The STIG requires that /var is on its own filesystem, but this system
does not appear to be following the requirement. does not appear to be following the requirement.
@@ -86,7 +86,7 @@
- V-72067 - V-72067
- name: Check for /var/log/audit on mounted filesystem - name: Check for /var/log/audit on mounted filesystem
debug: ansible.builtin.debug:
msg: | msg: |
The STIG requires that /var/log/audit is on its own filesystem, but this system The STIG requires that /var/log/audit is on its own filesystem, but this system
does not appear to be following the requirement. does not appear to be following the requirement.
@@ -98,7 +98,7 @@
- V-72063 - V-72063
- name: Check for /tmp on mounted filesystem - name: Check for /tmp on mounted filesystem
debug: ansible.builtin.debug:
msg: | msg: |
The STIG requires that /tmp is on its own filesystem, but this system The STIG requires that /tmp is on its own filesystem, but this system
does not appear to be following the requirement. does not appear to be following the requirement.
@@ -110,7 +110,7 @@
- V-72065 - V-72065
- name: Check if syslog output is being sent to another server - name: Check if syslog output is being sent to another server
command: 'grep "^[^#].*@" /etc/rsyslog.conf' ansible.builtin.command: 'grep "^[^#].*@" /etc/rsyslog.conf'
register: rsyslog_transmit_check register: rsyslog_transmit_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -119,7 +119,7 @@
- always - always
- name: V-72209 - The system must send rsyslog output to a log aggregation server. - name: V-72209 - The system must send rsyslog output to a log aggregation server.
debug: ansible.builtin.debug:
msg: Output from syslog must be sent to another server. msg: Output from syslog must be sent to another server.
when: when:
- rsyslog_transmit_check is defined - rsyslog_transmit_check is defined
@@ -130,7 +130,7 @@
- V-72209 - V-72209
- name: Check if ClamAV is installed - name: Check if ClamAV is installed
stat: ansible.builtin.stat:
path: /usr/bin/clamdscan path: /usr/bin/clamdscan
register: clamav_install_check register: clamav_install_check
changed_when: false changed_when: false
@@ -138,7 +138,7 @@
- always - always
- name: Remove 'Example' line from ClamAV configuration files - name: Remove 'Example' line from ClamAV configuration files
lineinfile: ansible.builtin.lineinfile:
dest: "{{ item }}" dest: "{{ item }}"
regexp: "^Example" regexp: "^Example"
state: absent state: absent
@@ -156,7 +156,7 @@
- V-72213 - V-72213
- name: Set ClamAV server type as socket - name: Set ClamAV server type as socket
lineinfile: ansible.builtin.lineinfile:
dest: /etc/clamd.d/scan.conf dest: /etc/clamd.d/scan.conf
regexp: "^(#)?LocalSocket (.*)$" regexp: "^(#)?LocalSocket (.*)$"
line: "LocalSocket {{ clamav_service_details['socket_path'] }}" line: "LocalSocket {{ clamav_service_details['socket_path'] }}"
@@ -172,7 +172,7 @@
- V-72213 - V-72213
- name: Ensure ClamAV socket directory exists - name: Ensure ClamAV socket directory exists
file: ansible.builtin.file:
path: "{{ clamav_service_details['socket_path'] | dirname }}" path: "{{ clamav_service_details['socket_path'] | dirname }}"
owner: "{{ clamav_service_details['user'] }}" owner: "{{ clamav_service_details['user'] }}"
group: "{{ clamav_service_details['group'] }}" group: "{{ clamav_service_details['group'] }}"
@@ -188,7 +188,7 @@
- V-72213 - V-72213
- name: Allow automatic freshclam updates - name: Allow automatic freshclam updates
lineinfile: ansible.builtin.lineinfile:
dest: /etc/sysconfig/freshclam dest: /etc/sysconfig/freshclam
regexp: "^FRESHCLAM_DELAY" regexp: "^FRESHCLAM_DELAY"
state: absent state: absent
@@ -203,7 +203,7 @@
- V-72213 - V-72213
- name: Check if ClamAV update process is already running - name: Check if ClamAV update process is already running
shell: "set -o pipefail; ps -ef | egrep [f]reshclam -q" ansible.builtin.shell: "set -o pipefail; ps -ef | egrep [f]reshclam -q"
register: freshclam_proc register: freshclam_proc
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -212,7 +212,7 @@
- always - always
- name: Update ClamAV database - name: Update ClamAV database
command: freshclam ansible.builtin.command: freshclam
changed_when: false changed_when: false
when: when:
- freshclam_proc.rc != 0 - freshclam_proc.rc != 0
@@ -226,7 +226,7 @@
- V-72213 - V-72213
- name: Ensure ClamAV is running - name: Ensure ClamAV is running
service: ansible.builtin.service:
name: "{{ clamav_service }}" name: "{{ clamav_service }}"
state: started state: started
enabled: true enabled: true
@@ -243,7 +243,7 @@
# errors on the command prompt. See LP bug 1736702. # errors on the command prompt. See LP bug 1736702.
# TODO(mhayden): Remove this task when the Rocky release is in development. # TODO(mhayden): Remove this task when the Rocky release is in development.
- name: Remove old config block for V-72223 from openstack-ansible-security - name: Remove old config block for V-72223 from openstack-ansible-security
blockinfile: ansible.builtin.blockinfile:
dest: /etc/profile dest: /etc/profile
state: absent state: absent
insertbefore: EOF insertbefore: EOF
@@ -254,7 +254,7 @@
- V-72223 - V-72223
- name: V-72223 - Set 10 minute timeout on communication sessions - name: V-72223 - Set 10 minute timeout on communication sessions
blockinfile: ansible.builtin.blockinfile:
dest: /etc/profile dest: /etc/profile
state: present state: present
insertbefore: EOF insertbefore: EOF
@@ -270,7 +270,7 @@
- V-72223 - V-72223
- name: Start and enable chrony - name: Start and enable chrony
service: ansible.builtin.service:
name: "{{ chrony_service }}" name: "{{ chrony_service }}"
state: started state: started
enabled: true enabled: true
@@ -283,14 +283,14 @@
- V-72269 - V-72269
- name: Check if chrony configuration file exists - name: Check if chrony configuration file exists
stat: ansible.builtin.stat:
path: "{{ chrony_conf_file }}" path: "{{ chrony_conf_file }}"
register: chrony_conf_check register: chrony_conf_check
tags: tags:
- always - always
- name: V-72269 - Synchronize system clock (configuration file) - name: V-72269 - Synchronize system clock (configuration file)
template: ansible.builtin.template:
src: chrony.conf.j2 src: chrony.conf.j2
dest: "{{ chrony_conf_file }}" dest: "{{ chrony_conf_file }}"
mode: "0644" mode: "0644"
@@ -306,7 +306,7 @@
# Returns 0 if installed, 3 if not installed # Returns 0 if installed, 3 if not installed
- name: Check firewalld status - name: Check firewalld status
command: systemctl status firewalld # noqa: command-instead-of-module ansible.builtin.command: systemctl status firewalld
register: firewalld_status_check register: firewalld_status_check
failed_when: firewalld_status_check.rc not in [0,3,4] failed_when: firewalld_status_check.rc not in [0,3,4]
changed_when: false changed_when: false
@@ -315,7 +315,7 @@
- always - always
- name: Ensure firewalld is running and enabled - name: Ensure firewalld is running and enabled
service: ansible.builtin.service:
name: firewalld name: firewalld
state: started state: started
enabled: true enabled: true
@@ -328,7 +328,7 @@
- V-72273 - V-72273
- name: Limit new TCP connections to 25/minute and allow bursting to 100 - name: Limit new TCP connections to 25/minute and allow bursting to 100
command: >- ansible.builtin.command: >-
firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp -m limit --limit {{ firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp -m limit --limit {{
security_enable_firewalld_rate_limit_per_minute }}/minute --limit-burst {{ security_enable_firewalld_rate_limit_burst }} -j ACCEPT security_enable_firewalld_rate_limit_per_minute }}/minute --limit-burst {{ security_enable_firewalld_rate_limit_burst }} -j ACCEPT
register: add_rate_limit_firewalld_rule register: add_rate_limit_firewalld_rule
@@ -354,7 +354,7 @@
- skip_ansible_lint - skip_ansible_lint
- name: V-72281 - For systems using DNS resolution, at least two name servers must be configured. - name: V-72281 - For systems using DNS resolution, at least two name servers must be configured.
debug: ansible.builtin.debug:
msg: | msg: |
Two or more nameservers must be configured in /etc/resolv.conf. Two or more nameservers must be configured in /etc/resolv.conf.
Nameservers found: {{ nameserver_check.stdout_lines | length }} Nameservers found: {{ nameserver_check.stdout_lines | length }}
@@ -367,7 +367,7 @@
- V-72281 - V-72281
- name: Check for interfaces in promiscuous mode - name: Check for interfaces in promiscuous mode
shell: "set -o pipefail; ip link | grep -i promisc" ansible.builtin.shell: "set -o pipefail; ip link | grep -i promisc"
register: promiscuous_interface_check register: promiscuous_interface_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -376,7 +376,7 @@
- always - always
- name: V-72295 - Network interfaces must not be in promiscuous mode. - name: V-72295 - Network interfaces must not be in promiscuous mode.
debug: ansible.builtin.debug:
msg: > msg: >
One or more network interfaces were found to be in promiscuous mode. One or more network interfaces were found to be in promiscuous mode.
Review all interfaces and disable promiscuous mode. Review all interfaces and disable promiscuous mode.
@@ -388,14 +388,14 @@
- V-72295 - V-72295
- name: Check for postfix configuration file - name: Check for postfix configuration file
stat: ansible.builtin.stat:
path: /etc/postfix/main.cf path: /etc/postfix/main.cf
register: postfix_conf_check register: postfix_conf_check
tags: tags:
- always - always
- name: V-72297 - Prevent unrestricted mail relaying - name: V-72297 - Prevent unrestricted mail relaying
lineinfile: ansible.builtin.lineinfile:
dest: /etc/postfix/main.cf dest: /etc/postfix/main.cf
regexp: "^smtpd_client_restrictions" regexp: "^smtpd_client_restrictions"
line: "smtpd_client_restrictions = permit_mynetworks, reject" line: "smtpd_client_restrictions = permit_mynetworks, reject"
@@ -408,7 +408,7 @@
- V-72297 - V-72297
- name: Check for TFTP server configuration file - name: Check for TFTP server configuration file
stat: ansible.builtin.stat:
path: /etc/xinetd.d/tftp path: /etc/xinetd.d/tftp
register: tftp_config_check register: tftp_config_check
check_mode: false check_mode: false
@@ -416,7 +416,7 @@
- always - always
- name: Check TFTP configuration mode - name: Check TFTP configuration mode
command: "grep server_args /etc/xinetd.d/tftp" ansible.builtin.command: "grep server_args /etc/xinetd.d/tftp"
register: tftp_secure_check register: tftp_secure_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -427,7 +427,7 @@
- always - always
- name: V-72305 - TFTP must be configured to operate in secure mode - name: V-72305 - TFTP must be configured to operate in secure mode
debug: ansible.builtin.debug:
msg: TFTP must be configured to run in secure mode with the '-s' flag. msg: TFTP must be configured to run in secure mode with the '-s' flag.
when: when:
- tftp_config_check.stat.exists - tftp_config_check.stat.exists
@@ -438,7 +438,7 @@
- V-72305 - V-72305
- name: Check to see if snmpd config contains public/private - name: Check to see if snmpd config contains public/private
command: 'egrep "^[^#].*(public|private)" /etc/snmp/snmpd.conf' ansible.builtin.command: 'egrep "^[^#].*(public|private)" /etc/snmp/snmpd.conf'
register: snmp_public_private_check register: snmp_public_private_check
changed_when: false changed_when: false
failed_when: false failed_when: false
@@ -447,7 +447,7 @@
- always - always
- name: V-72313 - Change SNMP community strings from default. - name: V-72313 - Change SNMP community strings from default.
debug: ansible.builtin.debug:
msg: > msg: >
Change the SNMP community strings from the defaults of 'public' and Change the SNMP community strings from the defaults of 'public' and
'private' to meet the requirements of V-72313. 'private' to meet the requirements of V-72313.

4
tasks/rhel7stig/packages.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Add packages based on STIG requirements - name: Add packages based on STIG requirements
package: ansible.builtin.package:
name: "{{ stig_packages_rhel7 | selectattr('enabled') | selectattr('state', 'equalto', item) | sum(attribute='packages', start=[]) }}" name: "{{ stig_packages_rhel7 | selectattr('enabled') | selectattr('state', 'equalto', item) | sum(attribute='packages', start=[]) }}"
state: "{{ item }}" state: "{{ item }}"
with_items: with_items:
@@ -35,7 +35,7 @@
- V-72307 - V-72307
- name: Remove packages based on STIG requirements - name: Remove packages based on STIG requirements
package: ansible.builtin.package:
name: "{{ stig_packages_rhel7 | selectattr('enabled') | selectattr('state', 'equalto', item) | sum(attribute='packages', start=[]) }}" name: "{{ stig_packages_rhel7 | selectattr('enabled') | selectattr('state', 'equalto', item) | sum(attribute='packages', start=[]) }}"
state: "{{ item }}" state: "{{ item }}"
with_items: with_items:

10
tasks/rhel7stig/rpm.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Ensure RPM verification task has finished - name: Ensure RPM verification task has finished
async_status: ansible.builtin.async_status:
jid: "{{ rpmverify_task.ansible_job_id }}" jid: "{{ rpmverify_task.ansible_job_id }}"
failed_when: false failed_when: false
changed_when: false changed_when: false
@@ -30,7 +30,7 @@
- V-71855 - V-71855
- name: V-71855 - Get files with invalid checksums (rpm) - name: V-71855 - Get files with invalid checksums (rpm)
shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'" # noqa risky-shell-pipe ansible.builtin.shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
register: invalid_checksum_files register: invalid_checksum_files
changed_when: false changed_when: false
when: when:
@@ -43,7 +43,7 @@
- V-71855 - V-71855
- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm) - name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
debug: ansible.builtin.debug:
msg: | msg: |
The following files have checksums that differ from the checksum provided The following files have checksums that differ from the checksum provided
with their package. Each of these should be verified manually to ensure with their package. Each of these should be verified manually to ensure
@@ -64,7 +64,7 @@
- V-71855 - V-71855
- name: V-71977 - Require digital signatures for all packages - name: V-71977 - Require digital signatures for all packages
lineinfile: ansible.builtin.lineinfile:
dest: "{{ pkg_mgr_config }}" dest: "{{ pkg_mgr_config }}"
regexp: "{{ item.regexp }}" regexp: "{{ item.regexp }}"
line: "{{ item.line }}" line: "{{ item.line }}"
@@ -78,7 +78,7 @@
- V-71981 - V-71981
- name: V-71987 - Clean requirements/dependencies when removing packages (RedHat) - name: V-71987 - Clean requirements/dependencies when removing packages (RedHat)
lineinfile: ansible.builtin.lineinfile:
dest: "{{ pkg_mgr_config }}" dest: "{{ pkg_mgr_config }}"
regexp: "^(#)?clean_requirements_on_remove" regexp: "^(#)?clean_requirements_on_remove"
line: "clean_requirements_on_remove=1" line: "clean_requirements_on_remove=1"

18
tasks/rhel7stig/sshd.yml
View File

@@ -14,7 +14,7 @@
# limitations under the License. # limitations under the License.
- name: Copy login warning banner - name: Copy login warning banner
copy: ansible.builtin.copy:
content: "{{ security_login_banner_text }}" content: "{{ security_login_banner_text }}"
dest: "{{ security_sshd_banner_file }}" dest: "{{ security_sshd_banner_file }}"
owner: root owner: root
@@ -27,7 +27,7 @@
- V-72225 - V-72225
- name: Drop options from SSH config that we manage - name: Drop options from SSH config that we manage
lineinfile: ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
state: absent state: absent
regexp: "^{{ item.name }}\\s+(?!{{ item.value }})" regexp: "^{{ item.name }}\\s+(?!{{ item.value }})"
@@ -59,7 +59,7 @@
- V-72263 - V-72263
- name: Adjust ssh server configuration based on STIG requirements - name: Adjust ssh server configuration based on STIG requirements
blockinfile: ansible.builtin.blockinfile:
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
state: present state: present
marker: "# {mark} MANAGED BY ANSIBLE-HARDENING" marker: "# {mark} MANAGED BY ANSIBLE-HARDENING"
@@ -97,7 +97,7 @@
- V-72263 - V-72263
- name: Ensure sshd is enabled at boot time - name: Ensure sshd is enabled at boot time
service: ansible.builtin.service:
name: "{{ ssh_service }}" name: "{{ ssh_service }}"
enabled: true enabled: true
when: when:
@@ -108,7 +108,7 @@
- V-72235 - V-72235
- name: Determine existing public ssh host keys - name: Determine existing public ssh host keys
shell: ls /etc/ssh/*.pub ansible.builtin.shell: ls /etc/ssh/*.pub
register: public_ssh_host_keys register: public_ssh_host_keys
# The shell command will always report 'changed' so we need to # The shell command will always report 'changed' so we need to
# ignore that since this role is supposed to be idempotent. # ignore that since this role is supposed to be idempotent.
@@ -118,7 +118,7 @@
- always - always
- name: Public host key files must have mode 0644 or less - name: Public host key files must have mode 0644 or less
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
mode: "u-xX,g-wxs,o-wxt" mode: "u-xX,g-wxs,o-wxt"
with_items: with_items:
@@ -129,7 +129,7 @@
- V-72255 - V-72255
- name: Determine existing private ssh host keys - name: Determine existing private ssh host keys
shell: ls /etc/ssh/*_key ansible.builtin.shell: ls /etc/ssh/*_key
register: private_ssh_host_keys register: private_ssh_host_keys
# The shell command will always report 'changed' so we need to # The shell command will always report 'changed' so we need to
# ignore that since this role is supposed to be idempotent # ignore that since this role is supposed to be idempotent
@@ -139,7 +139,7 @@
- always - always
- name: Private host key files must have mode 0600 or less - name: Private host key files must have mode 0600 or less
file: ansible.builtin.file:
path: "{{ item }}" path: "{{ item }}"
mode: "u-xX,g-rwxs,o-rwxt" mode: "u-xX,g-rwxs,o-rwxt"
with_items: with_items:
@@ -150,7 +150,7 @@
- V-72257 - V-72257
- name: Manage motd in pam.d - name: Manage motd in pam.d
replace: ansible.builtin.replace:
path: /etc/pam.d/sshd path: /etc/pam.d/sshd
regexp: "^(#\\s)?(session\\s*optional\\s*pam_motd.so.*)$" regexp: "^(#\\s)?(session\\s*optional\\s*pam_motd.so.*)$"
replace: '{{ (security_sshd_dynamic_banner_disable | bool) | ternary("# \2", "\2") }}' replace: '{{ (security_sshd_dynamic_banner_disable | bool) | ternary("# \2", "\2") }}'

6
tasks/rhel7stig/yum.yml
View File

@@ -14,10 +14,10 @@
# limitations under the License. # limitations under the License.
- name: Including rpm tasks - name: Including rpm tasks
include_tasks: rpm.yml ansible.builtin.include_tasks: rpm.yml
- name: Check if /etc/yum/yum-cron.conf exists - name: Check if /etc/yum/yum-cron.conf exists
stat: ansible.builtin.stat:
path: /etc/yum/yum-cron.conf path: /etc/yum/yum-cron.conf
check_mode: false check_mode: false
register: yum_cron_config_check register: yum_cron_config_check
@@ -27,7 +27,7 @@
- always - always
- name: Enable automatic package updates (yum) - name: Enable automatic package updates (yum)
lineinfile: ansible.builtin.lineinfile:
dest: /etc/yum/yum-cron.conf dest: /etc/yum/yum-cron.conf
regexp: "^apply_updates" regexp: "^apply_updates"
line: "apply_updates = yes" line: "apply_updates = yes"

14
tasks/rhel7stig/zypper.yml
View File

@@ -15,7 +15,7 @@
# limitations under the License. # limitations under the License.
- name: Ensure RPM verification task has finished - name: Ensure RPM verification task has finished
async_status: ansible.builtin.async_status:
jid: "{{ rpmverify_task.ansible_job_id }}" jid: "{{ rpmverify_task.ansible_job_id }}"
failed_when: false failed_when: false
changed_when: false changed_when: false
@@ -31,7 +31,7 @@
- V-71855 - V-71855
- name: V-71855 - Get files with invalid checksums (rpm) - name: V-71855 - Get files with invalid checksums (rpm)
shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'" # noqa risky-shell-pipe ansible.builtin.shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
register: invalid_checksum_files register: invalid_checksum_files
changed_when: false changed_when: false
when: when:
@@ -43,7 +43,7 @@
- V-71855 - V-71855
- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm) - name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
debug: ansible.builtin.debug:
msg: | msg: |
The following files have checksums that differ from the checksum provided The following files have checksums that differ from the checksum provided
with their package. Each of these should be verified manually to ensure with their package. Each of these should be verified manually to ensure
@@ -63,12 +63,12 @@
- V-71855 - V-71855
- name: Determine all SUSE repositories - name: Determine all SUSE repositories
shell: ls /etc/zypp/repos.d/*.repo ansible.builtin.shell: ls /etc/zypp/repos.d/*.repo
changed_when: false changed_when: false
register: all_zypper_repositories register: all_zypper_repositories
- name: V-71977 - Require digital signatures for all packages and repositories - name: V-71977 - Require digital signatures for all packages and repositories
lineinfile: ansible.builtin.lineinfile:
dest: "{{ item }}" dest: "{{ item }}"
regexp: "^(#)?\\s*gpgcheck" regexp: "^(#)?\\s*gpgcheck"
line: "gpgcheck=1" line: "gpgcheck=1"
@@ -84,7 +84,7 @@
- V-71981 - V-71981
- name: V-71987 - Clean requirements/dependencies when removing packages (SUSE) - name: V-71987 - Clean requirements/dependencies when removing packages (SUSE)
lineinfile: ansible.builtin.lineinfile:
dest: "{{ pkg_mgr_config }}" dest: "{{ pkg_mgr_config }}"
regexp: "^(#)?\\s*solver\\.cleandepsOnRemove" regexp: "^(#)?\\s*solver\\.cleandepsOnRemove"
line: "solver.cleandepsOnRemove = true" line: "solver.cleandepsOnRemove = true"
@@ -97,7 +97,7 @@
- V-71987 - V-71987
- name: Enable automatic package updates (SUSE) - name: Enable automatic package updates (SUSE)
copy: ansible.builtin.copy:
src: zypper-autoupdates src: zypper-autoupdates
dest: /etc/cron.daily/zypper-autoupdates dest: /etc/cron.daily/zypper-autoupdates
mode: "0750" mode: "0750"