a13labs.infra/ansible/roles/cis_hardening/tasks/main.yml

---
- name: Install local facts
  ansible.builtin.include_tasks: facts.yml
  tags: always

- name: Configure systemd resolved
  ansible.builtin.include_tasks: resolvedconf.yml
  tags: always

- name: Install epel-release and python dependencies
  ansible.builtin.include_tasks: pre.yml
  tags: always

- name: Install and configure UFW
  ansible.builtin.include_tasks:
    file: ufw.yml
    apply:
      environment:
        PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  when: ufw_enable
  tags:
    - ufw
    - roles::cis::ufw

- name: Configure sysctl
  ansible.builtin.include_tasks: sysctl.yml
  tags:
    - sysctl
    - roles::cis::sysctl

- name: Disable kernel network modules
  ansible.builtin.include_tasks: disablenet.yml

- name: Disable file system kernel modules
  ansible.builtin.include_tasks: disablefs.yml

- name: Disable IPv6
  ansible.builtin.include_tasks: ipv6.yml
  when: disable_ipv6

- name: Configure systemd system and users
  ansible.builtin.include_tasks: systemdconf.yml

- name: Configure systemd journald and logrotate
  ansible.builtin.include_tasks: journalconf.yml

- name: Configure systemd timesyncd
  ansible.builtin.include_tasks: timesyncd.yml

- name: Clean fstab
  ansible.builtin.include_tasks: fstab.yml

- name: Configure shm and tmp mounts
  ansible.builtin.include_tasks: mount.yml

- name: Disable prelink
  ansible.builtin.include_tasks: prelink.yml

- name: Configure package managers, update caches and install updates
  ansible.builtin.include_tasks: packagemgmt.yml

- name: Configure hosts.allow and hosts.deny
  when: not custom_hosts_acls
  ansible.builtin.include_tasks: hosts.yml

- name: Configure login.defs
  ansible.builtin.include_tasks: logindefs.yml

- name: Set limits
  ansible.builtin.include_tasks: limits.yml

- name: Configure adduser and useradd
  ansible.builtin.include_tasks: adduser.yml

- name: Restrict root access
  ansible.builtin.include_tasks: rootaccess.yml

- name: Configure needrestart, install and remove various packages
  ansible.builtin.include_tasks: packages.yml

- name: Configure ssh server and client
  ansible.builtin.include_tasks: sshconfig.yml
  tags:
    - ssh
    - sshd
    - roles::cis::sshd

- name: Configure PAM
  ansible.builtin.include_tasks: password.yml

- name: Configure and clean at and cron
  ansible.builtin.include_tasks: cron.yml

- name: Disable systemd ctrl-alt-del.target
  ansible.builtin.include_tasks: ctrlaltdel.yml

- name: Configure auditd
  ansible.builtin.include_tasks: auditd.yml

- name: Configure AppArmor
  ansible.builtin.include_tasks: apparmor.yml

- name: Disable misc kernel modules
  ansible.builtin.include_tasks: disablemod.yml

- name: Disable wireless interfaces
  ansible.builtin.include_tasks: disablewireless.yml
  when: disable_wireless

# https://bugs.launchpad.net/ubuntu/+source/aide/+bug/1903298
- name: Configure AIDE
  ansible.builtin.include_tasks: aide.yml
  when: >
    install_aide | bool and
    (not (ansible_os_family == "Debian" and
    (ansible_lsb.codename == "groovy" or
    ansible_lsb.codename == "hirsute")))

- name: Manage users
  ansible.builtin.include_tasks: users.yml

- name: Remove suid/sgid permissions
  ansible.builtin.include_tasks: suid.yml
  when: suid_sgid_permissions | bool

- name: Configure compiler permissions
  ansible.builtin.include_tasks: compilers.yml

- name: Set umask
  ansible.builtin.include_tasks: umask.yml

- name: Configure paths
  ansible.builtin.include_tasks: path.yml

- name: Configure systemd logind
  ansible.builtin.include_tasks: logindconf.yml

- name: Configure rkhunter
  ansible.builtin.include_tasks: rkhunter.yml

- name: Add issue message
  ansible.builtin.include_tasks: issue.yml

- name: Configure apport
  ansible.builtin.include_tasks: apport.yml

- name: Lock root account
  ansible.builtin.include_tasks: lockroot.yml

- name: Configure Postfix
  ansible.builtin.include_tasks: postfix.yml

- name: Configure motdnews
  ansible.builtin.include_tasks: motdnews.yml

- name: Configure sudo
  ansible.builtin.include_tasks: sudo.yml

- name: Miscellaneous extra tasks
  ansible.builtin.include_tasks: extras.yml

- name: Miscellaneous tasks after all handlers
  ansible.builtin.include_tasks: post.yml