Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use find instead of fileglob to search for files on remote machine #273

Closed
wants to merge 1 commit into from
Closed

use find instead of fileglob to search for files on remote machine #273

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 64 additions & 24 deletions tasks/section_5/cis_5.3.3.2.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,16 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Find conf files"
when: rhel9cis_disruption_high
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Remove difok from conf files except expected file"
when:
- item != rhel9cis_passwd_difok_file
Expand All @@ -18,10 +28,7 @@
path: "{{ item }}"
regexp: 'difok\s*=\s*\d+\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- /etc/pam.d/*-auth
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Ensure difok file exists"
ansible.builtin.template:
Expand Down Expand Up @@ -66,6 +73,16 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Find conf files"
when: rhel9cis_disruption_high
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Remove minlen from conf files except expected file"
when:
- item != rhel9cis_passwd_minlen_file
Expand All @@ -74,10 +91,7 @@
path: "{{ item }}"
regexp: 'minlen\s*=\s*\d+\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- '/etc/pam.d/*-auth'
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Ensure minlen file exists"
ansible.builtin.template:
Expand Down Expand Up @@ -122,6 +136,16 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Find conf files"
when: rhel9cis_disruption_high
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Remove pwd complex settings from conf files except expected file"
when:
- item != rhel9cis_passwd_complex_file
Expand All @@ -130,10 +154,7 @@
path: "{{ item }}"
regexp: '(minclass|[dulo]credit)\s*=\s*(-\d|\d+)\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- '/etc/pam.d/*-auth'
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Ensure complexity file exists"
ansible.builtin.template:
Expand Down Expand Up @@ -178,16 +199,22 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Find conf files"
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Remove maxrepeat settings from conf files except expected file"
when: item != rhel9cis_passwd_maxrepeat_file
ansible.builtin.replace:
path: "{{ item }}"
regexp: 'maxrepeat\s*=\s*\d+\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- '/etc/pam.d/*-auth'
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Ensure maxrepeat file exists"
ansible.builtin.template:
Expand Down Expand Up @@ -232,6 +259,16 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Find conf files"
when: rhel9cis_disruption_high
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Remove maxsequence settings from conf files except expected file"
when:
- item != rhel9cis_passwd_maxsequence_file
Expand All @@ -240,10 +277,7 @@
path: "{{ item }}"
regexp: 'maxsequence\s*=\s*\d+\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- '/etc/pam.d/*-auth'
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Ensure maxsequence file exists"
ansible.builtin.template:
Expand Down Expand Up @@ -288,17 +322,23 @@
- NIST800-53R5_IA-5
- pam
block:
- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Find conf files"
ansible.builtin.shell: |
find "/etc/security/pwquality.conf"
find "/etc/security/pwquality.conf.d/*.conf"
find "/etc/pam.d/*-auth"
changed_when: false
failed_when: false
register: discovered_conf_files

- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Remove dictcheck settings from conf files except expected file"
when:
- item != rhel9cis_passwd_dictcheck_file
ansible.builtin.replace:
path: "{{ item }}"
regexp: 'dictcheck\s*=\s*\d+\b'
replace: ''
with_fileglob:
- '/etc/security/pwquality.conf'
- '/etc/security/pwquality.conf.d/*.conf'
- '/etc/pam.d/*-auth'
loop: "{{ discovered_conf_files.stdout_lines | default([]) }}"

- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Ensure dictcheck file exists"
ansible.builtin.template:
Expand Down
Loading