a13labs.infra/ansible/roles/cis/tasks/password.yml

---
- name: Stat faillock
  become: true
  ansible.builtin.find:
    paths:
      [
        "/usr/local/sbin",
        "/usr/local/bin",
        "/usr/sbin",
        "/usr/bin",
        "/sbin",
        "/bin",
        "/snap/bin",
      ]
    patterns: "faillock"
    recurse: true
  register: faillock
  tags:
    - common-account
    - common-auth
    - pam

- name: Stat faillock configuration file
  become: true
  ansible.builtin.stat:
    path: /etc/security/faillock.conf
  register: faillockconf
  tags:
    - common-account
    - common-auth
    - pam

- name: Configure faillock.conf
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/security/faillock.conf
    mode: "0644"
    state: present
    line: "{{ item }}"
  with_items:
    - "audit"
    - "local_users_only"
    - "deny = 5"
    - "fail_interval = 900"
  when: faillockconf.stat.exists
  tags:
    - common-account
    - common-auth
    - pam

- name: Debian OS family PAM configuration
  become: true
  when: ansible_os_family == "Debian"
  block:
    - name: Configure common-password
      ansible.builtin.template:
        src: etc/pam.d/common-password.j2
        dest: /etc/pam.d/common-password
        backup: true
        mode: "0644"
        owner: root
        group: root
      tags:
        - common-password
        - pam
        - CIS-UBUNTU2004-5.4.3
        - CIS-UBUNTU2004-5.4.4
        - UBTU-20-010070

    - name: Configure common-auth
      ansible.builtin.template:
        src: etc/pam.d/common-auth.j2
        dest: /etc/pam.d/common-auth
        backup: true
        mode: "0644"
        owner: root
        group: root
      tags:
        - common-auth
        - pam
        - CIS-UBUNTU2004-5.4.2
        - M1036
        - UBTU-20-010072

    - name: Configure common-account
      ansible.builtin.template:
        src: etc/pam.d/common-account.j2
        dest: /etc/pam.d/common-account
        backup: true
        mode: "0644"
        owner: root
        group: root
      tags:
        - common-account
        - pam
        - M1036

    - name: Configure login
      ansible.builtin.template:
        src: etc/pam.d/login.j2
        dest: /etc/pam.d/login
        backup: true
        mode: "0644"
        owner: root
        group: root
      tags:
        - login
        - pam
        - UBTU-20-010075

- name: RedHat OS family PAM configuration
  become: true
  when: ansible_os_family == "RedHat"
  block:
    - name: Remove nullok from system-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: "nullok"
        mode: "0644"
        owner: root
        group: root
      tags:
        - system-auth
        - pam
        - CCE-80841-0

    - name: Remove nullok from password-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: "nullok"
        mode: "0644"
        owner: root
        group: root
      tags:
        - password-auth
        - pam

    - name: Check if sssd-shadowutils exists
      ansible.builtin.stat:
        path: /etc/pam.d/sssd-shadowutils
      register: sssd_shadowutils
      tags:
        - sssd-shadowutils
        - pam

    - name: Remove nullok from sssd-shadowutils
      become: true
      ansible.builtin.replace:
        dest: /etc/pam.d/sssd-shadowutils
        regexp: "nullok"
        mode: "0644"
        owner: root
        group: root
      when: sssd_shadowutils.stat.exists
      tags:
        - sssd-shadowutils
        - pam

    - name: Set system-auth remember
      ansible.builtin.replace:
        regexp: 'use_authtok(\s+.*)'
        replace: "use_authtok remember=5"
        dest: /etc/pam.d/system-auth
        mode: "0644"
        owner: root
        group: root
      tags:
        - system-auth
        - CCE-80666-1

- name: Configure pwquality
  become: true
  ansible.builtin.lineinfile:
    path: /etc/security/pwquality.conf
    line: "{{ item.key }} = {{ item.value }}"
    regexp: ".*{{ item.key }} = "
    state: present
    mode: "0644"
    owner: root
    group: root
  with_dict: "{{ pwquality_config }}"
  tags:
    - pwquality
    - pam
    - CCE-80653-9
    - CCE-80654-7
    - CCE-80655-4
    - CCE-80656-2
    - CCE-80663-8
    - CCE-80665-3
    - CCE-82066-2
    - CCE-82046-4
    - CIS-UBUNTU2004-5.4.1
    - D3-SPP
    - M1027
    - UBTU-20-010050
    - UBTU-20-010051
    - UBTU-20-010052
    - UBTU-20-010053
    - UBTU-20-010054
    - UBTU-20-010055
    - UBTU-20-010056
    - UBTU-20-010057

- name: Stat libuser configuration
  become: true
  ansible.builtin.stat:
    path: /etc/libuser.conf
  register: libuser
  tags:
    - libuser

- name: Set libuser crypt_style to sha512
  become: true
  ansible.builtin.replace:
    regexp: 'crypt_style(\s+.*)'
    replace: "crypt_style = sha512"
    dest: /etc/libuser.conf
    mode: "0644"
    owner: root
    group: root
  when: libuser.stat.exists
  tags:
    - libuser
    - CCE-80891-5

- name: Stat crypto-policies config
  become: true
  ansible.builtin.stat:
    path: /etc/crypto-policies/config
  register: crypto_policies_config
  tags:
    - crypto-policy

- name: Get crypto-policies value
  environment:
    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  ansible.builtin.command: grep -qo "^{{ crypto_policy }}$" /etc/crypto-policies/config
  register: crypto_policy_set
  when: crypto_policies_config.stat.exists
  changed_when: crypto_policy_set.rc != 0
  failed_when: crypto_policy_set.rc > 1
  tags:
    - crypto-policy
    - M1041

- name: Set crypto-policies
  become: true
  ansible.builtin.command: update-crypto-policies --set "{{ crypto_policy | upper }}"
  register: set_crypto_policies
  changed_when: set_crypto_policies.rc != 0
  failed_when: set_crypto_policies.rc != 0
  when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0
  tags:
    - crypto-policy
    - CCE-80935-0
    - M1041

- name: Set FIPS mode
  become: true
  ansible.builtin.command: fips-mode-setup --enable # noqa no-changed-when
  when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0 and crypto_policy.upper == "FIPS"
  tags:
    - crypto-policy
    - CCE-80935-0
    - CCE-80942-6
    - CCE-84027-2
    - M1041

- name: Add cracklib password list
  become: true
  ansible.builtin.copy:
    src: usr/share/dict/passwords.list
    dest: /usr/share/dict/passwords
    backup: true
    mode: "0644"
    owner: root
    group: root
  notify:
    - Update Debian cracklib
    - Update RedHat cracklib
  tags:
    - cracklib
    - pam

- name: Add local information to password list
  become: true
  ansible.builtin.lineinfile:
    dest: /usr/share/dict/passwords.local
    mode: "0644"
    owner: root
    group: root
    state: present
    create: true
    line: "{{ item }}"
  notify:
    - Update Debian cracklib
    - Update RedHat cracklib
  with_items:
    - "{{ ansible_hostname | lower }}"
    - "{{ ansible_hostname | upper }}"
    - "{{ ansible_os_family | lower }}"
    - "{{ ansible_os_family | upper }}"
  tags:
    - cracklib
    - pam