Skip to content

Commit cf84c5c

Browse files
georgenalengeorgenalen
authored
Merge pull request #11 from ansible-lockdown/devel
Minor Fixes Signed-off-by: George Nalen <georgen@mindpointgroup.com>
2 parents 2cf8d51 + ca5397a commit cf84c5c

2 files changed

Lines changed: 24 additions & 27 deletions

File tree

‎defaults/main.yml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,4 @@
11
---
2-
# If you would like a report at the end accordin to OpenSCAP as to the report results
3-
# then you should set rhel8stig_oscap_scan to true/yes.
4-
# NOTE: This requires the python_xmltojson package on the control host.
5-
rhel8stig_oscap_scan: no
6-
rhel8stig_report_dir: /tmp
72

83
rhel8stig_cat1_patch: true
94
rhel8stig_cat2_patch: true
@@ -108,9 +103,8 @@ rhel_08_010360: true
108103
rhel_08_010372: true
109104
rhel_08_010373: true
110105
rhel_08_010374: true
111-
# !!!!!!!!!!!!!!!--------------!!!!!!!!!!!!!!!!!!CHANGE TO TRUE BEFORE FINALIZATION. SET TO FALSE TO PREVENT THE VAGRANT USER FROM AUTHENTICATING WHEN USING SUDO (380/381)
112-
rhel_08_010380: false
113-
rhel_08_010381: false
106+
rhel_08_010380: true
107+
rhel_08_010381: true
114108
rhel_08_010390: true
115109
rhel_08_010400: true
116110
rhel_08_010410: true
@@ -155,7 +149,7 @@ rhel_08_010720: true
155149
rhel_08_010730: true
156150
rhel_08_010740: true
157151
rhel_08_010750: true
158-
rhel_01_010760: true
152+
rhel_08_010760: true
159153
rhel_08_010770: true
160154
rhel_08_010780: true
161155
rhel_08_010790: true

‎tasks/fix-cat2.yml‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,15 @@
4444
"MEDIUM | RHEL-08-010040 | PATCH | RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a ssh logon. | Set banner message""
4545
"MEDIUM | RHEL-08-010060 | PATCH | RHEL 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon. | Set banner message""
4646
copy:
47-
dest: /etc/issue
47+
dest: "{{ item }}"
4848
content: "{{ rhel8stig_logon_banner }}"
4949
owner: root
5050
group: root
5151
mode: '0644'
5252
notify: restart sshd
53+
with_items:
54+
- /etc/issue
55+
- /etc/issue.net
5356
when:
5457
# - not system_is_ec2
5558
- rhel_08_010040 or
@@ -247,8 +250,8 @@
247250
- kerberos
248251

249252
- name: |
250-
"HIGH | RHEL-08-010170 | PATCH | RHEL8 must use a Linux Security Module configured to enforce limits on system services."
251-
"HIGH | RHEL-08-010450 | PATCH | RHEL 8 must enable the SELinux targeted policy."
253+
"MEDIUM | RHEL-08-010170 | PATCH | RHEL8 must use a Linux Security Module configured to enforce limits on system services."
254+
"MEDIUM | RHEL-08-010450 | PATCH | RHEL 8 must enable the SELinux targeted policy."
252255
selinux:
253256
state: enforcing
254257
policy: targeted
@@ -296,7 +299,7 @@
296299
file:
297300
path: "{{ item }}"
298301
mode: '1777'
299-
with_items:
302+
with_items:
300303
- "{{ rhel_08_010190_world_writable_files.stdout_lines }}"
301304
when:
302305
- rhel_08_010190
@@ -651,7 +654,7 @@
651654
name: esc
652655
state: present
653656
when: rhel8stig_gui
654-
657+
655658
- name: "MEDIUM | RHEL-08-010390 | PATCH | RHEL 8 must have the packages required for multifactor authentication installed. | Install non-GUI related packages"
656659
dnf:
657660
name: openssl-pkcs11
@@ -1575,15 +1578,15 @@
15751578
tags:
15761579
- RHEL-08-010750
15771580

1578-
- name: "MEDIUM | REHL-08-010760 | PATCH | All RHEL 8 local interactive user accounts must be assigned a home directory upon creation."
1581+
- name: "MEDIUM | RHEL-08-010760 | PATCH | All RHEL 8 local interactive user accounts must be assigned a home directory upon creation."
15791582
lineinfile:
15801583
path: /etc/login.defs
15811584
regexp: '.*?CREATE_HOME.*'
15821585
line: CREATE_HOME yes
15831586
when:
1584-
- rhel_01_010760
1587+
- rhel_08_010760
15851588
tags:
1586-
- REHL-08-010760
1589+
- RHEL-08-010760
15871590
- login
15881591
- home
15891592

@@ -1597,7 +1600,7 @@
15971600
- rhel_08_010770
15981601
- rhel8stig_disruption_high
15991602
- rhel_08_stig_interactive_homedir_inifiles is defined
1600-
tags:
1603+
tags:
16011604
- RHEL-08-010770
16021605
- complexity-high
16031606

@@ -1671,7 +1674,7 @@
16711674

16721675
- name: "MEDIUM | RHEL-08-020000 | AUDIT | RHEL 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less."
16731676
debug:
1674-
msg:
1677+
msg:
16751678
- "ALERT!!!! Please check temporary accounts for expiration dates to be 72 hours or less."
16761679
- "To do this please run sudo chage -l account_name for the accounts you need to check"
16771680
- "The results will display the Account Expires information"
@@ -2218,7 +2221,7 @@
22182221
lineinfile:
22192222
path: "/etc/pam.d/{{ item }}"
22202223
regexp: '^auth required pam_faillock.so preauth'
2221-
line: "auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny={{ rhel8stig_pam_faillock.attempts }}{{ (rhel8stig_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}fail_interval={{ rhel8stig_pam_faillock.interval }} unlock_time={{ rhel8stig_pam_faillock.unlock_time }}"
2224+
line: "auth required pam_faillock.so preauth dir=/var/log/faillock silent audit deny={{ rhel8stig_pam_faillock.attempts }}{{ (rhel8stig_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}sfail_interval={{ rhel8stig_pam_faillock.interval }} unlock_time={{ rhel8stig_pam_faillock.unlock_time }}"
22222225
insertafter: '^auth'
22232226
notify: restart sssd
22242227
with_items:
@@ -2881,7 +2884,7 @@
28812884
path: /etc/security/pwquality.conf
28822885
create: yes
28832886
regexp: '^#?\s*dictcheck'
2884-
line: "dictcheck = {{ rhel8stig_password_complexity.dictcheck | default('1') }}"
2887+
line: "dictcheck = {{ rhel8stig_password_complexity.dictcheck | default('1') }}"
28852888
when:
28862889
- rhel_08_020300
28872890
tags:
@@ -3373,7 +3376,7 @@
33733376
with_items:
33743377
- -a always,exit -F arch=b32 -S lsetxattr -F auid>={{ rhel8stig_interactive_uid_start }} -F auid!=unset -k perm_mod
33753378
- -a always,exit -F arch=b64 -S lsetxattr -F auid>={{ rhel8stig_interactive_uid_start }} -F auid!=unset -k perm_mod
3376-
- -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod
3379+
- -a always,exit -F arch=b32 -S lsetxattr -F auid=0 -k perm_mod
33773380
- -a always,exit -F arch=b64 -S lsetxattr -F auid=0 -k perm_mod
33783381
notify: restart auditd
33793382
when:
@@ -3406,7 +3409,7 @@
34063409
- -a always,exit -F arch=b32 -S fremovexattr -F auid>={{ rhel8stig_interactive_uid_start }} -F auid!=unset -k perm_mod
34073410
- -a always,exit -F arch=b64 -S fremovexattr -F auid>={{ rhel8stig_interactive_uid_start }} -F auid!=unset -k perm_mod
34083411
- -a always,exit -F arch=b32 -S fremovexattr -F auid=0 -k perm_mod
3409-
- -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod
3412+
- -a always,exit -F arch=b64 -S fremovexattr -F auid=0 -k perm_mod
34103413
notify: restart auditd
34113414
when:
34123415
- rhel_08_030240
@@ -3623,7 +3626,7 @@
36233626
tags:
36243627
- RHEL-08-030340
36253628
- auditd
3626-
3629+
36273630
- name: "MEDIUM | RHEL-08-030350 | PATCH | Successful/unsuccessful uses of the newgrp command in RHEL 8 must generate an audit record."
36283631
lineinfile:
36293632
path: /etc/audit/rules.d/audit.rules
@@ -4319,7 +4322,7 @@
43194322

43204323
- name: "MEDIUM | RHEL-08-040030 | AUDIT | RHEL 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments. | Message out findings"
43214324
debug:
4322-
msg:
4325+
msg:
43234326
- "The following output is what firewalld is accepting on service ports to {{ ansible_hostname }}."
43244327
- "{{ rhel8stig_PPSM_CLSA_check_firewalld.stdout_lines }}"
43254328
changed_when: true
@@ -4487,7 +4490,7 @@
44874490
- rhel_08_040090
44884491
tags:
44894492
- RHEL-08-040090
4490-
- firewall
4493+
- firewall
44914494

44924495
- name: "MEDIUM | RHEL-08-040110 | PATCH | RHEL 8 wireless network adapters must be disabled."
44934496
block:
@@ -5177,7 +5180,7 @@
51775180
tags:
51785181
- RHEL-08-040330
51795182

5180-
- name: "HIGH | RHEL-08-040340 | PATCH | Remote X connections for interactive users must be encrypted in RHEL 8."
5183+
- name: "MEDIUM | RHEL-08-040340 | PATCH | Remote X connections for interactive users must be encrypted in RHEL 8."
51815184
lineinfile:
51825185
path: /etc/ssh/sshd_config
51835186
regexp: '^.*X11Forwarding'

0 commit comments

Comments
 (0)