---
- name: Stat access.conf
  become: true
  ansible.builtin.stat:
    path: /etc/security/access.conf
  register: security_access_conf
  tags:
    - access_conf

- name: Stat securetty
  become: true
  ansible.builtin.stat:
    path: /etc/securetty
  register: etc_securetty
  tags:
    - securetty

- name: Clean access.conf
  become: true
  ansible.builtin.lineinfile:
    path: /etc/security/access.conf
    regexp: '^(?!\+:root:127.0.0.1)$'
    mode: "0644"
    state: absent
  when: security_access_conf.stat.exists
  tags:
    - access_conf

- name: Allow localhost root in access.conf
  become: true
  ansible.builtin.lineinfile:
    path: /etc/security/access.conf
    line: "+:root:127.0.0.1"
    mode: "0644"
    state: present
  when: security_access_conf.stat.exists
  tags:
    - access_conf

- name: Clean securetty
  become: true
  ansible.builtin.lineinfile:
    path: /etc/securetty
    regexp: "^(?!console).*$"
    state: absent
  when: etc_securetty.stat.exists
  tags:
    - securetty

- name: Allow console in securetty
  become: true
  ansible.builtin.lineinfile:
    path: /etc/securetty
    line: "console"
    mode: "0644"
    state: present
  when: etc_securetty.stat.exists
  tags:
    - securetty
    - CIS-UBUNTU2004-5.6

- name: Mask systemd debug-shell
  become: true
  ansible.builtin.systemd:
    name: debug-shell.service
    masked: true
  tags:
    - systemd
    - debug-shell
    - CCE-80876-6