Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,88 @@
+---
+- name: Remove cron.deny and at.deny
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  with_items:
+    - /etc/at.deny
+    - /etc/cron.deny
+  tags:
+    - at
+    - cron
+
+- name: Clean cron and at
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ item }}"
+    regexp: "^(?!root).*$"
+    state: absent
+  with_items:
+    - /etc/at.allow
+    - /etc/cron.allow
+  tags:
+    - at
+    - cron
+    - CIS-UBUNTU2004-5.1.8
+    - CIS-UBUNTU2004-5.1.9
+
+- name: Allow root cron and at
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ item }}"
+    line: "root"
+    mode: "0600"
+    state: present
+    create: true
+  with_items:
+    - /etc/at.allow
+    - /etc/cron.allow
+  tags:
+    - at
+    - cron
+
+- name: Mask atd
+  become: true
+  ansible.builtin.systemd:
+    name: atd
+    masked: true
+    enabled: false
+    state: stopped
+  register: mask_atd
+  failed_when: mask_atd is not success and not "Could not find the requested service" in mask_atd.msg
+  tags:
+    - at
+    - systemd
+
+- name: Set cron permissions
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    mode: "0700"
+    owner: root
+    group: root
+  with_items:
+    - /etc/cron.d
+    - /etc/cron.daily
+    - /etc/cron.hourly
+    - /etc/cron.weekly
+    - /etc/cron.monthly
+  tags:
+    - cron
+    - CIS-UBUNTU2004-5.1.3
+    - CIS-UBUNTU2004-5.1.4
+    - CIS-UBUNTU2004-5.1.5
+    - CIS-UBUNTU2004-5.1.6
+    - CIS-UBUNTU2004-5.1.7
+
+- name: Set crontab permissions
+  become: true
+  ansible.builtin.file:
+    path: /etc/crontab
+    mode: "0600"
+    owner: root
+    group: root
+  tags:
+    - cron
+    - crontab
+    - CIS-UBUNTU2004-5.1.2