157 lines
3.4 KiB
YAML
157 lines
3.4 KiB
YAML
---
|
|
- name: Restart Debian auditd
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: auditd
|
|
state: restarted
|
|
when: ansible_os_family == "Debian"
|
|
tags:
|
|
- CCE-80872-5
|
|
|
|
# https://github.com/ansible/ansible/issues/22171
|
|
- name: Restart RedHat auditd # noqa command-instead-of-module no-changed-when
|
|
become: true
|
|
ansible.builtin.command: service auditd restart
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- CCE-80872-5
|
|
|
|
- name: Generate auditd rules # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command: augenrules
|
|
|
|
- name: Restart sysctl
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: systemd-sysctl
|
|
state: restarted
|
|
|
|
- name: Reload systemd
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Run rkhunter propupd # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command: rkhunter --propupd
|
|
|
|
- name: Enable aidecheck
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: aidecheck.timer
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Disable aidecheck
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: aidecheck.timer
|
|
state: stopped
|
|
enabled: false
|
|
|
|
- name: Mask aidecheck
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: aidecheck.timer
|
|
masked: true
|
|
state: stopped
|
|
enabled: false
|
|
|
|
- name: Restart ssh service
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|
|
register: ssh_service
|
|
failed_when: ssh_service is not success and not 'Could not find the requested service' in ssh_service.msg
|
|
|
|
- name: Restart sshd service
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|
|
register: sshd_service
|
|
failed_when: sshd_service is not success and not 'Could not find the requested service' in sshd_service.msg
|
|
|
|
- name: Restart Postfix
|
|
become: true
|
|
ansible.builtin.service:
|
|
name: postfix
|
|
state: restarted
|
|
|
|
- name: Run apt-get autoremove
|
|
become: true
|
|
ansible.builtin.apt:
|
|
autoremove: true
|
|
|
|
- name: Run apt-get clean
|
|
become: true
|
|
ansible.builtin.apt:
|
|
autoclean: true
|
|
clean: true
|
|
|
|
- name: Mask apport
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: apport.service
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
|
|
- name: Mask motdnews timer
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: motd-news.timer
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
|
|
- name: Mask motdnews service
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: motd-news.service
|
|
masked: true
|
|
enabled: false
|
|
state: stopped
|
|
|
|
- name: Run dnf autoremove
|
|
ansible.builtin.dnf:
|
|
autoremove: true
|
|
when: ansible_os_family == "RedHat"
|
|
tags:
|
|
- dnf
|
|
- packages
|
|
|
|
- name: Enable haveged
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: haveged
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Reboot node
|
|
become: true
|
|
ansible.builtin.reboot:
|
|
pre_reboot_delay: "{{ 3600 | random(start=1) }}"
|
|
|
|
- name: Update Debian cracklib # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.shell: |
|
|
update-cracklib
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Update RedHat cracklib # noqa no-changed-when
|
|
environment:
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
become: true
|
|
ansible.builtin.command: create-cracklib-dict /usr/share/dict/*
|
|
when: ansible_os_family == "RedHat"
|
|
|
|
- name: Update GRUB # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command: update-grub
|
|
|
|
- name: Update GRUB2 # noqa no-changed-when
|
|
become: true
|
|
ansible.builtin.command: grub2-mkconfig
|