Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,125 @@
+---
+- name: Stat init.d/rc
+  become: true
+  ansible.builtin.stat:
+    path: /etc/init.d/rc
+  register: initdrc
+  tags:
+    - umask
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Set default rc umask
+  become: true
+  ansible.builtin.replace:
+    regexp: 'umask(\s+.*)'
+    replace: "umask {{ umask_value }}"
+    dest: /etc/init.d/rc
+    mode: "0755"
+  when: initdrc.stat.exists
+  tags:
+    - umask
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Stat bashrc
+  become: true
+  ansible.builtin.stat:
+    path: /etc/bashrc
+  register: bashrc
+  tags:
+    - bash
+    - umask
+    - CCE-81036-6
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Set default bashrc umask
+  become: true
+  ansible.builtin.replace:
+    regexp: 'umask(\s+.*)'
+    replace: "umask {{ umask_value }}"
+    dest: /etc/bashrc
+    mode: "0644"
+  when: bashrc.stat.exists
+  tags:
+    - bash
+    - umask
+    - CCE-81036-6
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Stat csh.cshrc
+  become: true
+  ansible.builtin.stat:
+    path: /etc/csh.cshrc
+  register: cshrc
+  tags:
+    - csh
+    - umask
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Set default csh.cshrc umask
+  become: true
+  ansible.builtin.replace:
+    regexp: 'umask(\s+.*)'
+    replace: "umask {{ umask_value }}"
+    dest: /etc/csh.cshrc
+    mode: "0644"
+  when: cshrc.stat.exists
+  tags:
+    - csh
+    - umask
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Set default profile umask
+  become: true
+  ansible.builtin.replace:
+    regexp: 'umask(\s+.*)'
+    replace: "umask {{ umask_value }}"
+    dest: /etc/profile
+    mode: "0644"
+  tags:
+    - umask
+    - CIS-UBUNTU2004-5.5.4
+    - M1022
+
+- name: Configure readonly TMOUT
+  become: true
+  ansible.builtin.lineinfile:
+    line: "readonly TMOUT"
+    dest: /etc/profile
+    mode: "0644"
+    state: present
+    create: false
+    insertbefore: "^export"
+  tags:
+    - tmout
+
+- name: Set TMOUT
+  become: true
+  ansible.builtin.lineinfile:
+    line: "TMOUT=600"
+    dest: /etc/profile
+    mode: "0644"
+    state: present
+    create: false
+    insertbefore: "^readonly TMOUT"
+  tags:
+    - tmout
+    - CIS-UBUNTU2004-5.5.5
+    - UBTU-20-010013
+
+- name: Export TMOUT
+  become: true
+  ansible.builtin.lineinfile:
+    line: "export TMOUT"
+    dest: /etc/profile
+    mode: "0644"
+    state: present
+    create: false
+    insertafter: "^readonly TMOUT"
+  tags:
+    - tmout