a13labs.infra/ansible/roles/cis/tasks/packagemgmt.yml

---
- name: Configure apt
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/apt/apt.conf.d/98-hardening-ubuntu
    mode: "0644"
    state: present
    create: true
    line: "{{ item }}"
  with_items:
    - 'Acquire::AllowDowngradeToInsecureRepositories "false";'
    - 'Acquire::AllowInsecureRepositories "false";'
    - 'Acquire::http::AllowRedirect "false";'
    - 'APT::Get::AllowUnauthenticated "false";'
    - 'APT::Get::AutomaticRemove "true";'
    - 'APT::Install-Recommends "false";'
    - 'APT::Install-Suggests "false";'
    - 'APT::Periodic::AutocleanInterval "7";'
    - 'APT::Sandbox::Seccomp "1";'
    - 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
    - 'Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";'
    - 'Unattended-Upgrade::Automatic-Reboot "{{ unattended_reboot }}";'
    - 'Unattended-Upgrade::Automatic-Reboot-WithUsers "true";'
    - 'Unattended-Upgrade::Automatic-Reboot-Time "{{ unattended_reboot_time }}";'

  when: ansible_os_family == "Debian"
  tags:
    - apt
    - M1045

- name: Run apt update
  become: true
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 1800
  notify:
    - Run apt-get clean
    - Run apt-get autoremove
  when: ansible_os_family == "Debian"
  tags:
    - apt

- name: Run apt upgrade
  become: true
  ansible.builtin.apt:
    upgrade: safe
  register: apt_upgrade_response
  changed_when: apt_upgrade_response.stdout.find('0 upgraded') == -1
  when: ansible_os_family == "Debian" and system_upgrade | bool
  tags:
    - apt
    - CIS-UBUNTU2004-1.9
    - D3-SU
    - M1051

- name: Link dnf.conf
  become: true
  ansible.builtin.file:
    src: /etc/dnf/dnf.conf
    dest: /etc/yum.conf
    owner: root
    group: root
    state: link
  when: ansible_distribution == "Fedora"
  tags:
    - dnf
    - yum

- name: Import RedHat RPM key
  become: true
  ansible.builtin.rpm_key:
    state: present
    key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
  with_items:
    - "{{ redhat_signing_keys }}"
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - yum
    - CCE-80795-8

- name: Set yum.conf gpgcheck
  become: true
  ansible.builtin.lineinfile:
    regexp: "^gpgcheck="
    line: "gpgcheck=1"
    dest: /etc/yum.conf
    mode: "0644"
    state: present
    create: false
    backrefs: true
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - yum
    - CCE-80790-9
    - CCE-80792-5
    - M1045

- name: Set yum.conf clean_requirements
  become: true
  ansible.builtin.lineinfile:
    line: "clean_requirements_on_remove=True"
    dest: /etc/yum.conf
    mode: "0644"
    state: present
    create: true
    insertafter: "[main]"
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - yum
    - CCE-82476-3

- name: Set yum.conf localpkg_gpgcheck
  become: true
  ansible.builtin.lineinfile:
    line: "localpkg_gpgcheck=1"
    dest: /etc/yum.conf
    mode: "0644"
    state: present
    create: true
    insertafter: "[main]"
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - yum
    - CCE-80791-7
    - M1045

- name: Comment yum.conf repo_gpgcheck
  become: true
  ansible.builtin.lineinfile:
    line: "# repo_gpgcheck=1"
    dest: /etc/yum.conf
    mode: "0644"
    state: present
    create: true
    insertafter: "[main]"
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - yum

- name: RHEL8 package management tasks
  when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "8"
  block:
    - name: Import RHEL8 necessary GPG keys
      become: true
      ansible.builtin.rpm_key:
        state: present
        key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
      with_items:
        - "{{ epel8_signing_keys }}"
      tags:
        - dnf
        - packages
        - yum

    - name: RHEL8 EPEL repo installation
      become: true
      ansible.builtin.dnf:
        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm"
        state: present
      tags:
        - dnf
        - packages
        - yum

    - name: Install CodeReady repo for RHEL8
      become: true
      ansible.builtin.command: subscription-manager repos --enable "codeready-builder-for-rhel-8-{{ ansible_architecture }}-rpms"
      changed_when: false

- name: RHEL7 repo tasks
  when: ansible_distribution == "RedHat" and ansible_distribution_major_version == "7"
  block:
    - name: Import RHEL7 necessary GPG keys
      become: true
      ansible.builtin.rpm_key:
        state: present
        key: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x{{ item }}
      with_items:
        - "{{ epel7_signing_keys }}"
      tags:
        - dnf
        - packages
        - yum

    - name: RHEL7 EPEL repo installation
      become: true
      ansible.builtin.dnf:
        name: "https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm"
        state: present
      tags:
        - dnf
        - packages
        - yum

    - name: Install Extras and HA for RHEL7
      become: true
      ansible.builtin.command: >
        subscription-manager repos --enable "rhel-*-optional-rpms"
        --enable "rhel-*-extras-rpms"
        --enable "rhel-ha-for-rhel-*-server-rpms"
      changed_when: false
      tags:
        - dnf
        - packages
        - yum

- name: Stat PowerTools repository files
  ansible.builtin.stat:
    path: "{{ item }}"
  with_items:
    - /etc/yum.repos.d/almalinux-crb.repo
    - /etc/yum.repos.d/almalinux-powertools.repo
    - /etc/yum.repos.d/CentOS-Linux-PowerTools.repo
    - /etc/yum.repos.d/CentOS-PowerTools.repo
    - /etc/yum.repos.d/CentOS-Stream-PowerTools.repo
  register: powertools_repo
  when: ansible_os_family == "RedHat"
  tags:
    - dnf
    - packages
    - yum

- name: Enable the PowerTools repository
  become: true
  ansible.builtin.replace:
    regexp: "^enabled=.*$"
    replace: "enabled=1"
    dest: "{{ item.stat.path }}"
  with_items:
    - "{{ powertools_repo.results }}"
  when: ansible_os_family == "RedHat" and item.stat.exists
  tags:
    - dnf
    - packages
    - yum

- name: Update dnf cache
  become: true
  ansible.builtin.dnf:
    update_cache: true
  when: ansible_os_family == "RedHat"
  notify:
    - Run dnf autoremove
  tags:
    - dnf
    - yum

- name: Run dnf upgrade
  become: true
  ansible.builtin.dnf:
    name: "*" # noqa package-latest
    state: latest
    bugfix: true
    security: true
    nobest: true
  when: ansible_os_family == "RedHat" and system_upgrade | bool
  tags:
    - dnf
    - yum
    - CCE-80865-9
    - D3-SU
    - M1051