129 lines
3.1 KiB
YAML
129 lines
3.1 KiB
YAML
|
---
|
||
|
|
- name: Configure sudo
|
||
|
|
become: true
|
||
|
|
tags:
|
||
|
|
- sudo
|
||
|
|
block:
|
||
|
|
- name: Configure sudo use_pty
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults use_pty"
|
||
|
|
dest: /etc/sudoers.d/011_use_pty
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
tags:
|
||
|
|
- CIS-UBUNTU2004-5.2.2
|
||
|
|
|
||
|
|
- name: Configure sudo logfile
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: 'Defaults logfile="/var/log/sudo.log"'
|
||
|
|
dest: /etc/sudoers.d/012_logfile
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
tags:
|
||
|
|
- CIS-UBUNTU2004-5.2.3
|
||
|
|
|
||
|
|
- name: Configure sudo disable pwfeedback
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults !pwfeedback"
|
||
|
|
dest: /etc/sudoers.d/013_pwfeedback
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
|
||
|
|
- name: Configure sudo disable visiblepw
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults !visiblepw"
|
||
|
|
dest: /etc/sudoers.d/014_visiblepw
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
|
||
|
|
- name: Remove inconsistently named sudoer file
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /etc/sudoers.d/15_timeout
|
||
|
|
state: absent
|
||
|
|
|
||
|
|
- name: Configure sudo passwd_timeout
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults passwd_timeout=1"
|
||
|
|
dest: /etc/sudoers.d/015_passwdtimeout
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
|
||
|
|
- name: Configure sudo timestamp_timeout
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults timestamp_timeout=5"
|
||
|
|
dest: /etc/sudoers.d/016_timestamptimeout
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
|
||
|
|
- name: Configure sudo timestamp_type
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults timestamp_type=tty"
|
||
|
|
dest: /etc/sudoers.d/017_timestamptype
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
tags:
|
||
|
|
- M1028
|
||
|
|
|
||
|
|
- name: Configure sudo user password for privilege escalation
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "Defaults {{ item }}"
|
||
|
|
dest: /etc/sudoers.d/018_userpassword
|
||
|
|
mode: "0440"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
validate: visudo -cf %s
|
||
|
|
with_items:
|
||
|
|
- "!rootpw"
|
||
|
|
- "!runaspw"
|
||
|
|
- "!targetpw"
|
||
|
|
tags:
|
||
|
|
- V-237642
|
||
|
|
|
||
|
|
- name: Create su group sugroup
|
||
|
|
become: true
|
||
|
|
ansible.builtin.group:
|
||
|
|
name: sugroup
|
||
|
|
state: present
|
||
|
|
tags:
|
||
|
|
- pam
|
||
|
|
- su
|
||
|
|
- sudo
|
||
|
|
- CIS-UBUNTU2004-5.7
|
||
|
|
|
||
|
|
- name: Configure su group
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "auth required pam_wheel.so use_uid group=sugroup"
|
||
|
|
dest: /etc/pam.d/su
|
||
|
|
mode: "0644"
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
tags:
|
||
|
|
- pam
|
||
|
|
- su
|
||
|
|
- sudo
|
||
|
|
- CIS-UBUNTU2004-5.7
|