Initial ansible onboard

ansible/roles/cis_hardening/tasks/motdnews.yml

@@ -0,0 +1,92 @@
+---
+- name: Stat /etc/default/motd-news
+  ansible.builtin.stat:
+    path: /etc/default/motd-news
+  register: motd_news
+  when: ansible_os_family == "Debian"
+  tags:
+    - motd
+
+- name: Disable motd-news
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "^ENABLED="
+    line: "ENABLED=0"
+    dest: /etc/default/motd-news
+    mode: "0644"
+    state: present
+    create: false
+    backrefs: true
+  notify:
+    - Mask motdnews timer
+    - Mask motdnews service
+  when: ansible_os_family == "Debian" and motd_news.stat.exists
+  tags:
+    - motd
+
+- name: Find update-motd.d files
+  become: true
+  ansible.builtin.find:
+    paths: /etc/update-motd.d
+    file_type: file
+  register: update_motd_permissions
+  tags:
+    - motd
+
+- name: Update motd permissions
+  become: true
+  ansible.builtin.file:
+    dest: "{{ item.path }}"
+    mode: "0444"
+  with_items:
+    - "{{ update_motd_permissions.files }}"
+  when: ansible_os_family == "Debian"
+  tags:
+    - motd
+
+- name: Set /etc/update-motd.d permission
+  become: true
+  ansible.builtin.file:
+    dest: /etc/update-motd.d
+    mode: "0755"
+  when: ansible_os_family == "Debian"
+  tags:
+    - motd
+
+- name: Stat /usr/bin/pro
+  ansible.builtin.stat:
+    path: /usr/bin/pro
+  register: ubuntu_advantage_pro
+  when: ansible_os_family == "Debian"
+  tags:
+    - apt_news
+    - ubuntu-pro
+
+- name: Check apt_news status
+  ansible.builtin.shell: |
+    set -o pipefail
+    pro config show | grep '^apt_news.*False'
+  args:
+    executable: /bin/bash
+  register: ubuntu_advantage_pro_state
+  changed_when: ubuntu_advantage_pro_state.rc != 0
+  failed_when: ubuntu_advantage_pro_state.rc > 1
+  when: ansible_os_family == "Debian" and ubuntu_advantage_pro.stat.exists
+  tags:
+    - apt_news
+    - ubuntu-pro
+
+- name: Disable apt_news
+  become: true
+  ansible.builtin.command:
+    cmd: pro config set apt_news=false
+  register: disable_apt_news
+  changed_when: disable_apt_news.rc != 0
+  failed_when: disable_apt_news.rc != 0
+  when:
+    - ansible_os_family == "Debian"
+    - ubuntu_advantage_pro.stat.exists
+    - ubuntu_advantage_pro_state.rc != 0
+  tags:
+    - apt_news
+    - ubuntu-pro