---
- name: Configure rkhunter
  become: true
  ansible.builtin.template:
    src: etc/default/rkhunter.j2
    dest: /etc/default/rkhunter
    backup: true
    mode: "0644"
    owner: root
    group: root
  when: ansible_os_family == "Debian"
  notify:
    - Run rkhunter propupd
  tags:
    - packages
    - rkhunter
    - M1049

- name: SSH root access should be disabled
  become: true
  ansible.builtin.lineinfile:
    regexp: "ALLOW_SSH_ROOT_USER"
    line: "ALLOW_SSH_ROOT_USER=no"
    dest: /etc/rkhunter.conf
    mode: "0640"
    state: present
    create: false
    backrefs: true
  notify:
    - Run rkhunter propupd
  tags:
    - packages
    - rkhunter
    - M1049

- name: SSH v1 should not be used
  become: true
  ansible.builtin.lineinfile:
    regexp: "ALLOW_SSH_PROT_V1"
    line: "ALLOW_SSH_PROT_V1=0"
    dest: /etc/rkhunter.conf
    mode: "0640"
    state: present
    create: false
    backrefs: true
  notify:
    - Run rkhunter propupd
  tags:
    - packages
    - rkhunter
    - M1049