a13labs.infra/ansible/roles/cis_hardening/tasks/main.yml

---
- name: Install local facts
  ansible.builtin.include_tasks: facts.yml
  tags: always

- name: Configure systemd resolved
  ansible.builtin.include_tasks: resolvedconf.yml
  tags: always

- name: Install epel-release and python dependencies
  ansible.builtin.include_tasks: pre.yml
  tags: always

- name: Install and configure UFW
  ansible.builtin.include_tasks:
    file: ufw.yml
    apply:
      environment:
        PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  when: ufw_enable
  tags:
    - roles::cis::ufw

- name: Configure sysctl
  ansible.builtin.include_tasks: sysctl.yml
  tags:
    - roles::cis::sysctl

- name: Disable kernel network modules
  ansible.builtin.include_tasks: disablenet.yml
  tags:
    - roles::cis::modules

- name: Disable file system kernel modules
  ansible.builtin.include_tasks: disablefs.yml
  tags:
    - roles::cis::modules

- name: Disable IPv6
  ansible.builtin.include_tasks: ipv6.yml
  when: disable_ipv6
  tags:
    - roles::cis::ipv6

- name: Configure systemd system and users
  ansible.builtin.include_tasks: systemdconf.yml
  tags:
    - roles::cis::users

- name: Configure systemd journald and logrotate
  ansible.builtin.include_tasks: journalconf.yml
  tags:
    - roles::cis::log

- name: Configure systemd timesyncd
  ansible.builtin.include_tasks: timesyncd.yml
  tags:
    - roles::cis::systemd

- name: Clean fstab
  ansible.builtin.include_tasks: fstab.yml
  tags:
    - roles::cis::fstab

- name: Configure shm and tmp mounts
  ansible.builtin.include_tasks: mount.yml
  tags:
    - roles::cis::mounts

- name: Disable prelink
  ansible.builtin.include_tasks: prelink.yml
  tags:
    - roles::cis::prelink

- name: Configure package managers, update caches and install updates
  ansible.builtin.include_tasks: packagemgmt.yml
  tags:
    - roles::cis::packages

- name: Configure hosts.allow and hosts.deny
  when: not custom_hosts_acls
  ansible.builtin.include_tasks: hosts.yml
  tags:
    - roles::cis::hosts

- name: Configure login.defs
  ansible.builtin.include_tasks: logindefs.yml
  tags:
    - roles::cis::logindefs 

- name: Set limits
  ansible.builtin.include_tasks: limits.yml
  tags:
    - roles::cis::limits

- name: Configure adduser and useradd
  ansible.builtin.include_tasks: adduser.yml
  tags:
    - roles::cis::adduser

- name: Restrict root access
  ansible.builtin.include_tasks: rootaccess.yml
  tags:
    - roles::cis::root

- name: Configure needrestart, install and remove various packages
  ansible.builtin.include_tasks: packages.yml
  tags:
    - roles::cis::packages

- name: Configure ssh server and client
  ansible.builtin.include_tasks: sshconfig.yml
  tags:
    - roles::cis::sshd
    - roles::cis::ssh

- name: Configure PAM
  ansible.builtin.include_tasks: password.yml
  tags:
    - roles::cis::pam

- name: Configure and clean at and cron
  ansible.builtin.include_tasks: cron.yml
  tags:
    - roles::cis::cron

- name: Disable systemd ctrl-alt-del.target
  ansible.builtin.include_tasks: ctrlaltdel.yml
  tags:
    - roles::cis::ctrlaltdel

- name: Configure auditd
  ansible.builtin.include_tasks: auditd.yml
  tags:
    - roles::cis::auditd

- name: Configure AppArmor
  ansible.builtin.include_tasks: apparmor.yml
  tags:
    - roles::cis::apparmor

- name: Disable misc kernel modules
  ansible.builtin.include_tasks: disablemod.yml
  tags:
    - roles::cis::modules

- name: Disable wireless interfaces
  ansible.builtin.include_tasks: disablewireless.yml
  when: disable_wireless
  tags:
    - roles::cis::wireless

- name: Manage users
  ansible.builtin.include_tasks: users.yml
  tags:
    - roles::cis::users

- name: Remove suid/sgid permissions
  ansible.builtin.include_tasks: suid.yml
  when: suid_sgid_permissions | bool
  tags:
    - roles::cis::suid

- name: Configure compiler permissions
  ansible.builtin.include_tasks: compilers.yml
  tags:
    - roles::cis::compilers

- name: Set umask
  ansible.builtin.include_tasks: umask.yml
  tags:
    - roles::cis::umask

- name: Configure paths
  ansible.builtin.include_tasks: path.yml
  tags:
    - roles::cis::path

- name: Configure systemd logind
  ansible.builtin.include_tasks: logindconf.yml
  tags:
    - roles::cis::logind

- name: Configure rkhunter
  ansible.builtin.include_tasks: rkhunter.yml
  tags:
    - roles::cis::rkhunter

- name: Add issue message
  ansible.builtin.include_tasks: issue.yml
  tags:
    - roles::cis::issue

- name: Configure apport
  ansible.builtin.include_tasks: apport.yml
  tags:
    - roles::cis::apport

- name: Lock root account
  ansible.builtin.include_tasks: lockroot.yml
  tags:
    - roles::cis::root

- name: Configure Postfix
  ansible.builtin.include_tasks: postfix.yml
  tags:
    - roles::cis::postfix

- name: Configure motdnews
  ansible.builtin.include_tasks: motdnews.yml
  tags:
    - roles::cis::motdnews

- name: Configure sudo
  ansible.builtin.include_tasks: sudo.yml
  tags:
    - roles::cis::sudo

- name: Miscellaneous extra tasks
  ansible.builtin.include_tasks: extras.yml
  tags:
    - roles::cis::extras

- name: Miscellaneous tasks after all handlers
  ansible.builtin.include_tasks: post.yml
  tags:
    - always