--- - name: Stat faillock become: true ansible.builtin.find: paths: [ "/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin", "/snap/bin", ] patterns: "faillock" recurse: true register: faillock tags: - common-account - common-auth - pam - name: Stat faillock configuration file become: true ansible.builtin.stat: path: /etc/security/faillock.conf register: faillockconf tags: - common-account - common-auth - pam - name: Configure faillock.conf become: true ansible.builtin.lineinfile: dest: /etc/security/faillock.conf mode: "0644" state: present line: "{{ item }}" with_items: - "audit" - "local_users_only" - "deny = 5" - "fail_interval = 900" when: faillockconf.stat.exists tags: - common-account - common-auth - pam - name: Debian OS family PAM configuration become: true when: ansible_os_family == "Debian" block: - name: Configure common-password ansible.builtin.template: src: etc/pam.d/common-password.j2 dest: /etc/pam.d/common-password backup: true mode: "0644" owner: root group: root tags: - common-password - pam - CIS-UBUNTU2004-5.4.3 - CIS-UBUNTU2004-5.4.4 - UBTU-20-010070 - name: Configure common-auth ansible.builtin.template: src: etc/pam.d/common-auth.j2 dest: /etc/pam.d/common-auth backup: true mode: "0644" owner: root group: root tags: - common-auth - pam - CIS-UBUNTU2004-5.4.2 - M1036 - UBTU-20-010072 - name: Configure common-account ansible.builtin.template: src: etc/pam.d/common-account.j2 dest: /etc/pam.d/common-account backup: true mode: "0644" owner: root group: root tags: - common-account - pam - M1036 - name: Configure login ansible.builtin.template: src: etc/pam.d/login.j2 dest: /etc/pam.d/login backup: true mode: "0644" owner: root group: root tags: - login - pam - UBTU-20-010075 - name: RedHat OS family PAM configuration become: true when: ansible_os_family == "RedHat" block: - name: Remove nullok from system-auth ansible.builtin.replace: dest: /etc/pam.d/system-auth regexp: "nullok" mode: "0644" owner: root group: root tags: - system-auth - pam - CCE-80841-0 - name: Remove nullok from password-auth ansible.builtin.replace: dest: /etc/pam.d/password-auth regexp: "nullok" mode: "0644" owner: root group: root tags: - password-auth - pam - name: Check if sssd-shadowutils exists ansible.builtin.stat: path: /etc/pam.d/sssd-shadowutils register: sssd_shadowutils tags: - sssd-shadowutils - pam - name: Remove nullok from sssd-shadowutils become: true ansible.builtin.replace: dest: /etc/pam.d/sssd-shadowutils regexp: "nullok" mode: "0644" owner: root group: root when: sssd_shadowutils.stat.exists tags: - sssd-shadowutils - pam - name: Set system-auth remember ansible.builtin.replace: regexp: 'use_authtok(\s+.*)' replace: "use_authtok remember=5" dest: /etc/pam.d/system-auth mode: "0644" owner: root group: root tags: - system-auth - CCE-80666-1 - name: Configure pwquality become: true ansible.builtin.lineinfile: path: /etc/security/pwquality.conf line: "{{ item.key }} = {{ item.value }}" regexp: ".*{{ item.key }} = " state: present mode: "0644" owner: root group: root with_dict: "{{ pwquality_config }}" tags: - pwquality - pam - CCE-80653-9 - CCE-80654-7 - CCE-80655-4 - CCE-80656-2 - CCE-80663-8 - CCE-80665-3 - CCE-82066-2 - CCE-82046-4 - CIS-UBUNTU2004-5.4.1 - D3-SPP - M1027 - UBTU-20-010050 - UBTU-20-010051 - UBTU-20-010052 - UBTU-20-010053 - UBTU-20-010054 - UBTU-20-010055 - UBTU-20-010056 - UBTU-20-010057 - name: Stat libuser configuration become: true ansible.builtin.stat: path: /etc/libuser.conf register: libuser tags: - libuser - name: Set libuser crypt_style to sha512 become: true ansible.builtin.replace: regexp: 'crypt_style(\s+.*)' replace: "crypt_style = sha512" dest: /etc/libuser.conf mode: "0644" owner: root group: root when: libuser.stat.exists tags: - libuser - CCE-80891-5 - name: Stat crypto-policies config become: true ansible.builtin.stat: path: /etc/crypto-policies/config register: crypto_policies_config tags: - crypto-policy - name: Get crypto-policies value environment: PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ansible.builtin.command: grep -qo "^{{ crypto_policy }}$" /etc/crypto-policies/config register: crypto_policy_set when: crypto_policies_config.stat.exists changed_when: crypto_policy_set.rc != 0 failed_when: crypto_policy_set.rc > 1 tags: - crypto-policy - M1041 - name: Set crypto-policies become: true ansible.builtin.command: update-crypto-policies --set "{{ crypto_policy | upper }}" register: set_crypto_policies changed_when: set_crypto_policies.rc != 0 failed_when: set_crypto_policies.rc != 0 when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0 tags: - crypto-policy - CCE-80935-0 - M1041 - name: Set FIPS mode become: true ansible.builtin.command: fips-mode-setup --enable # noqa no-changed-when when: crypto_policies_config.stat.exists and crypto_policy_set.rc != 0 and crypto_policy.upper == "FIPS" tags: - crypto-policy - CCE-80935-0 - CCE-80942-6 - CCE-84027-2 - M1041 - name: Add cracklib password list become: true ansible.builtin.copy: src: usr/share/dict/passwords.list dest: /usr/share/dict/passwords backup: true mode: "0644" owner: root group: root notify: - Update Debian cracklib - Update RedHat cracklib tags: - cracklib - pam - name: Add local information to password list become: true ansible.builtin.lineinfile: dest: /usr/share/dict/passwords.local mode: "0644" owner: root group: root state: present create: true line: "{{ item }}" notify: - Update Debian cracklib - Update RedHat cracklib with_items: - "{{ ansible_hostname | lower }}" - "{{ ansible_hostname | upper }}" - "{{ ansible_os_family | lower }}" - "{{ ansible_os_family | upper }}" tags: - cracklib - pam