Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,297 @@
+---
+- name: Stat faillock
+  become: true
+  ansible.builtin.find:
+    paths:
+      [
+        "/usr/local/sbin",
+        "/usr/local/bin",
+        "/usr/sbin",
+        "/usr/bin",
+        "/sbin",
+        "/bin",
+        "/snap/bin",
+      ]
+    patterns: "faillock"
+    recurse: true
+  register: faillock
+  tags:
+    - common-account
+    - common-auth
+    - pam
+
+- name: Stat faillock configuration file
+  become: true
+  ansible.builtin.stat:
+    path: /etc/security/faillock.conf
+  register: faillockconf
+  tags:
+    - common-account
+    - common-auth
+    - pam
+
+- name: Configure faillock.conf
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/security/faillock.conf
+    mode: "0644"
+    state: present
+    line: "{{ item }}"
+  with_items:
+    - "audit"
+    - "local_users_only"
+    - "deny = 5"
+    - "fail_interval = 900"
+  when: faillockconf.stat.exists
+  tags:
+    - common-account
+    - common-auth
+    - pam
+
+- name: Debian OS family PAM configuration
+  become: true
+  when: ansible_os_family == "Debian"
+  block:
+    - name: Configure common-password
+      ansible.builtin.template:
+        src: etc/pam.d/common-password.j2
+        dest: /etc/pam.d/common-password
+        backup: true
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - common-password
+        - pam
+        - CIS-UBUNTU2004-5.4.3
+        - CIS-UBUNTU2004-5.4.4
+        - UBTU-20-010070
+
+    - name: Configure common-auth
+      ansible.builtin.template:
+        src: etc/pam.d/common-auth.j2
+        dest: /etc/pam.d/common-auth
+        backup: true
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - common-auth
+        - pam
+        - CIS-UBUNTU2004-5.4.2
+        - M1036
+        - UBTU-20-010072
+
+    - name: Configure common-account
+      ansible.builtin.template:
+        src: etc/pam.d/common-account.j2
+        dest: /etc/pam.d/common-account
+        backup: true
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - common-account
+        - pam
+        - M1036
+
+    - name: Configure login
+      ansible.builtin.template:
+        src: etc/pam.d/login.j2
+        dest: /etc/pam.d/login
+        backup: true
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - login
+        - pam
+        - UBTU-20-010075
+
+- name: RedHat OS family PAM configuration
+  become: true
+  when: ansible_os_family == "RedHat"
+  block:
+    - name: Remove nullok from system-auth
+      ansible.builtin.replace:
+        dest: /etc/pam.d/system-auth
+        regexp: "nullok"
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - system-auth
+        - pam
+        - CCE-80841-0
+
+    - name: Remove nullok from password-auth
+      ansible.builtin.replace:
+        dest: /etc/pam.d/password-auth
+        regexp: "nullok"
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - password-auth
+        - pam
+
+    - name: Remove nullok from sssd-shadowutils
+      become: true
+      ansible.builtin.replace:
+        dest: /etc/pam.d/sssd-shadowutils
+        regexp: "nullok"
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - sssd-shadowutils
+        - pam
+
+    - name: Set system-auth remember
+      ansible.builtin.replace:
+        regexp: 'use_authtok(\s+.*)'
+        replace: "use_authtok remember=5"
+        dest: /etc/pam.d/system-auth
+        mode: "0644"
+        owner: root
+        group: root
+      tags:
+        - system-auth
+        - CCE-80666-1
+
+- name: Configure pwquality
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/security/pwquality.conf
+    line: "{{ item.key }} = {{ item.value }}"
+    regexp: ".*{{ item.key }} = "
+    state: present
+    mode: "0644"
+    owner: root
+    group: root
+  with_dict: "{{ pwquality_config }}"
+  tags:
+    - pwquality
+    - pam
+    - CCE-80653-9
+    - CCE-80654-7
+    - CCE-80655-4
+    - CCE-80656-2
+    - CCE-80663-8
+    - CCE-80665-3
+    - CCE-82066-2
+    - CCE-82046-4
+    - CIS-UBUNTU2004-5.4.1
+    - D3-SPP
+    - M1027
+    - UBTU-20-010050
+    - UBTU-20-010051
+    - UBTU-20-010052
+    - UBTU-20-010053
+    - UBTU-20-010054
+    - UBTU-20-010055
+    - UBTU-20-010056
+    - UBTU-20-010057
+
+- name: Stat libuser configuration
+  become: true
+  ansible.builtin.stat:
+    path: /etc/libuser.conf
+  register: libuser
+  tags:
+    - libuser
+
+- name: Set libuser crypt_style to sha512
+  become: true
+  ansible.builtin.replace:
+    regexp: 'crypt_style(\s+.*)'
+    replace: "crypt_style = sha512"
+    dest: /etc/libuser.conf
+    mode: "0644"
+    owner: root
+    group: root
+  when: libuser.stat.exists
+  tags:
+    - libuser
+    - CCE-80891-5
+
+- name: Stat crypto-policies config
+  become: true
+  ansible.builtin.stat:
+    path: /etc/crypto-policies/config
+  register: crypto_policies_config
+  tags:
+    - crypto-policy
+
+- name: Get crypto-policies value
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  ansible.builtin.command: grep -qo "^{{ crypto_policy }}$" /etc/crypto-policies/config
+  register: crypto_policy_set
+  when: crypto_policies_config.stat.exists
+  changed_when: crypto_policy_set.rc != 0
+  failed_when: crypto_policy_set.rc > 1
+  tags:
+    - crypto-policy
+    - M1041
+
+- name: Set crypto-policies
+  become: true
+  ansible.builtin.command: update-crypto-policies --set "{{ crypto_policy | upper }}"
+  register: set_crypto_policies
+  changed_when: set_crypto_policies.rc != 0
+  failed_when: set_crypto_policies.rc != 0
+  when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0
+  tags:
+    - crypto-policy
+    - CCE-80935-0
+    - M1041
+
+- name: Set FIPS mode
+  become: true
+  ansible.builtin.command: fips-mode-setup --enable # noqa no-changed-when
+  when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0 and crypto_policy.upper == "FIPS"
+  tags:
+    - crypto-policy
+    - CCE-80935-0
+    - CCE-80942-6
+    - CCE-84027-2
+    - M1041
+
+- name: Add cracklib password list
+  become: true
+  ansible.builtin.copy:
+    src: usr/share/dict/passwords.list
+    dest: /usr/share/dict/passwords
+    backup: true
+    mode: "0644"
+    owner: root
+    group: root
+  notify:
+    - Update Debian cracklib
+    - Update RedHat cracklib
+  tags:
+    - cracklib
+    - pam
+
+- name: Add local information to password list
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /usr/share/dict/passwords.local
+    mode: "0644"
+    owner: root
+    group: root
+    state: present
+    create: true
+    line: "{{ item }}"
+  notify:
+    - Update Debian cracklib
+    - Update RedHat cracklib
+  with_items:
+    - "{{ ansible_hostname | lower }}"
+    - "{{ ansible_hostname | upper }}"
+    - "{{ ansible_os_family | lower }}"
+    - "{{ ansible_os_family | upper }}"
+  tags:
+    - cracklib
+    - pam