Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,70 @@
+---
+- name: Stat access.conf
+  become: true
+  ansible.builtin.stat:
+    path: /etc/security/access.conf
+  register: security_access_conf
+  tags:
+    - access_conf
+
+- name: Stat securetty
+  become: true
+  ansible.builtin.stat:
+    path: /etc/securetty
+  register: etc_securetty
+  tags:
+    - securetty
+
+- name: Clean access.conf
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/security/access.conf
+    regexp: '^(?!\+:root:127.0.0.1)$'
+    mode: "0644"
+    state: absent
+  when: security_access_conf.stat.exists
+  tags:
+    - access_conf
+
+- name: Allow localhost root in access.conf
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/security/access.conf
+    line: "+:root:127.0.0.1"
+    mode: "0644"
+    state: present
+  when: security_access_conf.stat.exists
+  tags:
+    - access_conf
+
+- name: Clean securetty
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/securetty
+    regexp: "^(?!console).*$"
+    state: absent
+  when: etc_securetty.stat.exists
+  tags:
+    - securetty
+
+- name: Allow console in securetty
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/securetty
+    line: "console"
+    mode: "0644"
+    state: present
+  when: etc_securetty.stat.exists
+  tags:
+    - securetty
+    - CIS-UBUNTU2004-5.6
+
+- name: Mask systemd debug-shell
+  become: true
+  ansible.builtin.systemd:
+    name: debug-shell.service
+    masked: true
+  tags:
+    - systemd
+    - debug-shell
+    - CCE-80876-6