Initial ansible onboard

ansible/roles/cis_hardening/tasks/rkhunter.yml

@@ -0,0 +1,51 @@
+---
+- name: Configure rkhunter
+  become: true
+  ansible.builtin.template:
+    src: etc/default/rkhunter.j2
+    dest: /etc/default/rkhunter
+    backup: true
+    mode: "0644"
+    owner: root
+    group: root
+  when: ansible_os_family == "Debian"
+  notify:
+    - Run rkhunter propupd
+  tags:
+    - packages
+    - rkhunter
+    - M1049
+
+- name: SSH root access should be disabled
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "ALLOW_SSH_ROOT_USER"
+    line: "ALLOW_SSH_ROOT_USER=no"
+    dest: /etc/rkhunter.conf
+    mode: "0640"
+    state: present
+    create: false
+    backrefs: true
+  notify:
+    - Run rkhunter propupd
+  tags:
+    - packages
+    - rkhunter
+    - M1049
+
+- name: SSH v1 should not be used
+  become: true
+  ansible.builtin.lineinfile:
+    regexp: "ALLOW_SSH_PROT_V1"
+    line: "ALLOW_SSH_PROT_V1=0"
+    dest: /etc/rkhunter.conf
+    mode: "0640"
+    state: present
+    create: false
+    backrefs: true
+  notify:
+    - Run rkhunter propupd
+  tags:
+    - packages
+    - rkhunter
+    - M1049