89 lines
1.6 KiB
YAML
89 lines
1.6 KiB
YAML
|
---
|
||
|
|
- name: Remove cron.deny and at.deny
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item }}"
|
||
|
|
state: absent
|
||
|
|
with_items:
|
||
|
|
- /etc/at.deny
|
||
|
|
- /etc/cron.deny
|
||
|
|
tags:
|
||
|
|
- at
|
||
|
|
- cron
|
||
|
|
|
||
|
|
- name: Clean cron and at
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: "{{ item }}"
|
||
|
|
regexp: "^(?!root).*$"
|
||
|
|
state: absent
|
||
|
|
with_items:
|
||
|
|
- /etc/at.allow
|
||
|
|
- /etc/cron.allow
|
||
|
|
tags:
|
||
|
|
- at
|
||
|
|
- cron
|
||
|
|
- CIS-UBUNTU2004-5.1.8
|
||
|
|
- CIS-UBUNTU2004-5.1.9
|
||
|
|
|
||
|
|
- name: Allow root cron and at
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: "{{ item }}"
|
||
|
|
line: "root"
|
||
|
|
mode: "0600"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
with_items:
|
||
|
|
- /etc/at.allow
|
||
|
|
- /etc/cron.allow
|
||
|
|
tags:
|
||
|
|
- at
|
||
|
|
- cron
|
||
|
|
|
||
|
|
- name: Mask atd
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: atd
|
||
|
|
masked: true
|
||
|
|
enabled: false
|
||
|
|
state: stopped
|
||
|
|
register: mask_atd
|
||
|
|
failed_when: mask_atd is not success and not "Could not find the requested service" in mask_atd.msg
|
||
|
|
tags:
|
||
|
|
- at
|
||
|
|
- systemd
|
||
|
|
|
||
|
|
- name: Set cron permissions
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item }}"
|
||
|
|
mode: "0700"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
with_items:
|
||
|
|
- /etc/cron.d
|
||
|
|
- /etc/cron.daily
|
||
|
|
- /etc/cron.hourly
|
||
|
|
- /etc/cron.weekly
|
||
|
|
- /etc/cron.monthly
|
||
|
|
tags:
|
||
|
|
- cron
|
||
|
|
- CIS-UBUNTU2004-5.1.3
|
||
|
|
- CIS-UBUNTU2004-5.1.4
|
||
|
|
- CIS-UBUNTU2004-5.1.5
|
||
|
|
- CIS-UBUNTU2004-5.1.6
|
||
|
|
- CIS-UBUNTU2004-5.1.7
|
||
|
|
|
||
|
|
- name: Set crontab permissions
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/crontab
|
||
|
|
mode: "0600"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
tags:
|
||
|
|
- cron
|
||
|
|
- crontab
|
||
|
|
- CIS-UBUNTU2004-5.1.2
|