---
- name: Remove cron.deny and at.deny
  become: true
  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  with_items:
    - /etc/at.deny
    - /etc/cron.deny
  tags:
    - at
    - cron

- name: Clean cron and at
  become: true
  ansible.builtin.lineinfile:
    path: "{{ item }}"
    regexp: "^(?!root).*$"
    state: absent
  with_items:
    - /etc/at.allow
    - /etc/cron.allow
  tags:
    - at
    - cron
    - CIS-UBUNTU2004-5.1.8
    - CIS-UBUNTU2004-5.1.9

- name: Allow root cron and at
  become: true
  ansible.builtin.lineinfile:
    path: "{{ item }}"
    line: "root"
    mode: "0600"
    state: present
    create: true
  with_items:
    - /etc/at.allow
    - /etc/cron.allow
  tags:
    - at
    - cron

- name: Mask atd
  become: true
  ansible.builtin.systemd:
    name: atd
    masked: true
    enabled: false
    state: stopped
  register: mask_atd
  failed_when: mask_atd is not success and not "Could not find the requested service" in mask_atd.msg
  tags:
    - at
    - systemd

- name: Set cron permissions
  become: true
  ansible.builtin.file:
    path: "{{ item }}"
    mode: "0700"
    owner: root
    group: root
  with_items:
    - /etc/cron.d
    - /etc/cron.daily
    - /etc/cron.hourly
    - /etc/cron.weekly
    - /etc/cron.monthly
  tags:
    - cron
    - CIS-UBUNTU2004-5.1.3
    - CIS-UBUNTU2004-5.1.4
    - CIS-UBUNTU2004-5.1.5
    - CIS-UBUNTU2004-5.1.6
    - CIS-UBUNTU2004-5.1.7

- name: Set crontab permissions
  become: true
  ansible.builtin.file:
    path: /etc/crontab
    mode: "0600"
    owner: root
    group: root
  tags:
    - cron
    - crontab
    - CIS-UBUNTU2004-5.1.2