---
- name: Configure sudo
  become: true
  tags:
    - sudo
  block:
    - name: Configure sudo use_pty
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults use_pty"
        dest: /etc/sudoers.d/011_use_pty
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s
      tags:
        - CIS-UBUNTU2004-5.2.2

    - name: Configure sudo logfile
      become: true
      ansible.builtin.lineinfile:
        line: 'Defaults logfile="/var/log/sudo.log"'
        dest: /etc/sudoers.d/012_logfile
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s
      tags:
        - CIS-UBUNTU2004-5.2.3

    - name: Configure sudo disable pwfeedback
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults !pwfeedback"
        dest: /etc/sudoers.d/013_pwfeedback
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s

    - name: Configure sudo disable visiblepw
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults !visiblepw"
        dest: /etc/sudoers.d/014_visiblepw
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s

    - name: Remove inconsistently named sudoer file
      become: true
      ansible.builtin.file:
        path: /etc/sudoers.d/15_timeout
        state: absent

    - name: Configure sudo passwd_timeout
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults passwd_timeout=1"
        dest: /etc/sudoers.d/015_passwdtimeout
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s

    - name: Configure sudo timestamp_timeout
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults timestamp_timeout=5"
        dest: /etc/sudoers.d/016_timestamptimeout
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s

    - name: Configure sudo timestamp_type
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults timestamp_type=tty"
        dest: /etc/sudoers.d/017_timestamptype
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s
      tags:
        - M1028

    - name: Configure sudo user password for privilege escalation
      become: true
      ansible.builtin.lineinfile:
        line: "Defaults {{ item }}"
        dest: /etc/sudoers.d/018_userpassword
        mode: "0440"
        state: present
        create: true
        validate: visudo -cf %s
      with_items:
        - "!rootpw"
        - "!runaspw"
        - "!targetpw"
      tags:
        - V-237642

- name: Create su group sugroup
  become: true
  ansible.builtin.group:
    name: sugroup
    state: present
  tags:
    - pam
    - su
    - sudo
    - CIS-UBUNTU2004-5.7

- name: Configure su group
  become: true
  ansible.builtin.lineinfile:
    line: "auth required pam_wheel.so use_uid group=sugroup"
    dest: /etc/pam.d/su
    mode: "0644"
    state: present
    create: true
  tags:
    - pam
    - su
    - sudo
    - CIS-UBUNTU2004-5.7