71 lines
1.4 KiB
YAML
71 lines
1.4 KiB
YAML
|
---
|
||
|
|
- name: Stat access.conf
|
||
|
|
become: true
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: /etc/security/access.conf
|
||
|
|
register: security_access_conf
|
||
|
|
tags:
|
||
|
|
- access_conf
|
||
|
|
|
||
|
|
- name: Stat securetty
|
||
|
|
become: true
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: /etc/securetty
|
||
|
|
register: etc_securetty
|
||
|
|
tags:
|
||
|
|
- securetty
|
||
|
|
|
||
|
|
- name: Clean access.conf
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /etc/security/access.conf
|
||
|
|
regexp: '^(?!\+:root:127.0.0.1)$'
|
||
|
|
mode: "0644"
|
||
|
|
state: absent
|
||
|
|
when: security_access_conf.stat.exists
|
||
|
|
tags:
|
||
|
|
- access_conf
|
||
|
|
|
||
|
|
- name: Allow localhost root in access.conf
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /etc/security/access.conf
|
||
|
|
line: "+:root:127.0.0.1"
|
||
|
|
mode: "0644"
|
||
|
|
state: present
|
||
|
|
when: security_access_conf.stat.exists
|
||
|
|
tags:
|
||
|
|
- access_conf
|
||
|
|
|
||
|
|
- name: Clean securetty
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /etc/securetty
|
||
|
|
regexp: "^(?!console).*$"
|
||
|
|
state: absent
|
||
|
|
when: etc_securetty.stat.exists
|
||
|
|
tags:
|
||
|
|
- securetty
|
||
|
|
|
||
|
|
- name: Allow console in securetty
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /etc/securetty
|
||
|
|
line: "console"
|
||
|
|
mode: "0644"
|
||
|
|
state: present
|
||
|
|
when: etc_securetty.stat.exists
|
||
|
|
tags:
|
||
|
|
- securetty
|
||
|
|
- CIS-UBUNTU2004-5.6
|
||
|
|
|
||
|
|
- name: Mask systemd debug-shell
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: debug-shell.service
|
||
|
|
masked: true
|
||
|
|
tags:
|
||
|
|
- systemd
|
||
|
|
- debug-shell
|
||
|
|
- CCE-80876-6
|