4dbd95132c
Since ansible-core 2.10 it is recommended to use modules via FQCN In order to align with recommendation, we perform migration by applying suggestions made by `ansible-lint --fix=fqcn` Change-Id: I76bf3945bf413a8e9f0661f9aba697fdb8e993f7
115 lines
3.6 KiB
YAML
115 lines
3.6 KiB
YAML
---
|
|
# Copyright 2015, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Create temporary directory to hold any temporary files
|
|
ansible.builtin.tempfile:
|
|
state: directory
|
|
suffix: hardening
|
|
register: mktemp_result
|
|
when:
|
|
- not check_mode | bool
|
|
tags:
|
|
- always
|
|
|
|
- name: Set a fact for the temporary directory
|
|
ansible.builtin.set_fact:
|
|
temp_dir: "{{ mktemp_result.path }}"
|
|
changed_when: false
|
|
when:
|
|
- not check_mode | bool
|
|
tags:
|
|
- always
|
|
|
|
# Some of the tasks in the role may take a long time to run. Let's start them
|
|
# as early as possible so they have time to finish.
|
|
- name: Importing async_tasks tasks
|
|
ansible.builtin.import_tasks: async_tasks.yml
|
|
- name: Get user data for all users on the system
|
|
get_users:
|
|
min_uid: 0
|
|
register: hardening_user_list
|
|
check_mode: false
|
|
tags:
|
|
- always
|
|
|
|
- name: Get user data for all interactive users on the system
|
|
get_users:
|
|
min_uid: "{{ security_interactive_user_minimum_uid }}"
|
|
register: interactive_user_list
|
|
check_mode: false
|
|
tags:
|
|
- always
|
|
|
|
# NOTE(mhayden): EPEL is only needed for the clamav packages. We should only
|
|
# install EPEL if the deployer asked for clamav to be installed.
|
|
- name: Install EPEL repository
|
|
ansible.builtin.dnf:
|
|
name: "{{ security_epel_release_package }}"
|
|
state: "{{ security_package_state }}"
|
|
when:
|
|
- ansible_facts['pkg_mgr'] == 'dnf'
|
|
- security_epel_install_repository | bool
|
|
- security_enable_virus_scanner | bool
|
|
tags:
|
|
- always
|
|
|
|
# Package installations and removals must come first so that configuration
|
|
# changes can be made later.
|
|
- name: Importing packages tasks
|
|
ansible.builtin.import_tasks: packages.yml
|
|
tags:
|
|
- always
|
|
|
|
# Package managers are managed first since the changes in these tasks will
|
|
# affect the remainder of the tasks in the role.
|
|
- name: Including OS-specific tasks
|
|
ansible.builtin.include_tasks: "{{ ansible_facts['pkg_mgr'] }}.yml"
|
|
|
|
# The bulk of the security changes are applied in these tasks. The tasks in
|
|
# each file are tagged with the same name (for example, tasks in `auth.yml`
|
|
# are tagged with `auth`). Also, the tag name matches up with the "STIG
|
|
# Controls by Tag" section of the role documentation.
|
|
- name: Importing accounts tasks
|
|
ansible.builtin.import_tasks: accounts.yml
|
|
- name: Importing aide tasks
|
|
ansible.builtin.import_tasks: aide.yml
|
|
when: security_rhel7_enable_aide | bool
|
|
- name: Importing auditd tasks
|
|
ansible.builtin.import_tasks: auditd.yml
|
|
- name: Importing auth tasks
|
|
ansible.builtin.import_tasks: auth.yml
|
|
- name: Importing file_perms tasks
|
|
ansible.builtin.import_tasks: file_perms.yml
|
|
- name: Importing graphical tasks
|
|
ansible.builtin.import_tasks: graphical.yml
|
|
- name: Importing kernel tasks
|
|
ansible.builtin.import_tasks: kernel.yml
|
|
- name: Importing lsm tasks
|
|
ansible.builtin.import_tasks: lsm.yml
|
|
- name: Importing misc tasks
|
|
ansible.builtin.import_tasks: misc.yml
|
|
- name: Importing sshd tasks
|
|
ansible.builtin.import_tasks: sshd.yml
|
|
|
|
- name: Remove the temporary directory
|
|
ansible.builtin.file:
|
|
path: "{{ temp_dir }}"
|
|
state: absent
|
|
changed_when: false
|
|
when:
|
|
- not check_mode | bool
|
|
tags:
|
|
- always
|