Issues March24 (#366)

* #359 addressed thanks to @bbaassssiiee Signed-off-by: Mark Bolwell <[email protected]> * sysctl matches requirement & handler added Signed-off-by: Mark Bolwell <[email protected]> * container updated and cautions updated Signed-off-by: Mark Bolwell <[email protected]> * issues #360 addressed thanks to @bbaassssiiee Signed-off-by: Mark Bolwell <[email protected]> * updated Signed-off-by: Mark Bolwell <[email protected]> * Added #361 ensure local interface on 3.4.2.2 Signed-off-by: Mark Bolwell <[email protected]> * issue #363 addressed Signed-off-by: Mark Bolwell <[email protected]> * variable naming and lint Signed-off-by: Mark Bolwell <[email protected]> * variable naming and lint Signed-off-by: Mark Bolwell <[email protected]> * updated handler Signed-off-by: Mark Bolwell <[email protected]> * variable naming and lint updates Signed-off-by: Mark Bolwell <[email protected]> * updated Signed-off-by: Mark Bolwell <[email protected]> * fix issues with pam_unix Signed-off-by: Mark Bolwell <[email protected]> * added extra options Signed-off-by: Mark Bolwell <[email protected]> * issue #365 addressed Signed-off-by: Mark Bolwell <[email protected]> * fixed commenting alternate file Signed-off-by: Mark Bolwell <[email protected]> * updated var name to discovered Signed-off-by: Mark Bolwell <[email protected]> * renamed variable tomake it clearer Signed-off-by: Mark Bolwell <[email protected]> * updated Signed-off-by: Mark Bolwell <[email protected]> * fix typo Signed-off-by: Mark Bolwell <[email protected]> * updated discovered variable naming Signed-off-by: Mark Bolwell <[email protected]> * updated variable naming Signed-off-by: Mark Bolwell <[email protected]> --------- Signed-off-by: Mark Bolwell <[email protected]>
ansible-lockdown · Mar 27, 2024 · 59dcd8f · 59dcd8f
1 parent 4d0daba
commit 59dcd8f
Show file tree

Hide file tree

Showing 47 changed files with 687 additions and 615 deletions.
diff --git a/Changelog.md b/Changelog.md
@@ -6,10 +6,19 @@
 
 ### Changes and improvements (March24)
 
+Changes to variable naming for those variables discovered
+some lint updates
+
 thanks to @bbaassssiiee
 
 - #353
 - #354
+- #359
+- #360
+- #361
+- #363
+- #364
+- #365
 
 Audit and audit_only changed to run prior to any significant changes
 

diff --git a/README.md b/README.md
@@ -47,13 +47,19 @@ Join us on our [Discord Server](https://www.lockdownenterprise.com/discord) to a
 
 This role **will make changes to the system** which may have unintended consequences. This is not an auditing tool but rather a remediation tool to be used after an audit has been conducted.
 
-Check Mode is not supported! The role will complete in check mode without errors, but it is not supported and should be used with caution. The RHEL8-CIS-Audit role or a compliance scanner should be used for compliance checking over check mode.
+- Testing is the most important thing you can do.
 
-This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review this role for any site specific changes that are needed.
+- Check Mode is not supported! The role will complete in check mode without errors, but it is not supported and should be used with caution. The RHEL8-CIS-Audit role or a compliance scanner should be used for compliance checking over check mode.
 
-To use release version please point to main branch and relevant release for the cis benchmark you wish to work with.
+- This role was developed against a clean install of the Operating System. If you are implementing to an existing system please review this role for any site specific changes that are needed.
 
-If moving across major releases e.g. v2.0.0 - v3.0.0 there are significant changes to the benchmarks and controls it is suggested to start as a new standard not to upgrade.
+- To use release version please point to main branch and relevant release/tag for the cis benchmark you wish to work with.
+
+- If moving across major releases e.g. v2.0.0 - v3.0.0 there are significant changes to the benchmarks and controls it is suggested to start as a new standard not to upgrade.
+
+- Containers references vars/is_container.yml this is an example and to be updated for your requirements
+
+- Did we mention testing??
 
 ---
 

diff --git a/defaults/main.yml b/defaults/main.yml
@@ -705,10 +705,10 @@ rhel8cis_pass:
     warn_age: 7
 
 ## Set the following to true if you wish to adjust accounts greater than rhel8cis_pass['max_days']
-rhel8cis_4_5_1_2_set_max_expiry: false
+rhel8cis_set_max_expiry: false
 
 ## Add users to be skipped if required
-rhel8cis_4_5_1_2_user_skip_list:
+rhel8cis_user_skip_list:
     root
 
 rhel8cis_root_umask: '0027'  # 0027 or more restrictive

diff --git a/handlers/main.yml b/handlers/main.yml
@@ -15,6 +15,9 @@
       masked: false
       state: reloaded
 
+- name: Reload_sysctl
+  ansible.builtin.shell: sysctl --system
+
 - name: Sysctl_flush_ipv4_routes
   ansible.posix.sysctl:
       name: net.ipv4.route.flush
@@ -71,7 +74,7 @@
       state: restarted
 
 - name: Rebuild_grub
-  ansible.builtin.shell: "grub2-mkconfig -o {{ grub_cfg.stat.lnk_source }}"
+  ansible.builtin.shell: "grub2-mkconfig -o {{ discovered_grub_cfg.stat.lnk_source }}"
   ignore_errors: true  # noqa ignore-errors
   notify: Change_requires_reboot
   tags:
@@ -91,14 +94,14 @@
 - name: Auditd_immutable_check
   ansible.builtin.shell: grep -c "^-e 2" /etc/audit/rules.d/99_auditd.rules
   changed_when: false
-  register: auditd_immutable_check
+  register: discovered_auditd_immutable_check
 
 - name: Audit_immutable_fact
   ansible.builtin.debug:
       msg: "Reboot required for auditd to apply new rules as immutable set"
   notify: Change_requires_reboot
   when:
-      - auditd_immutable_check.stdout == '1'
+      - discovered_auditd_immutable_check.stdout == '1'
 
 - name: Restart_auditd
   ansible.builtin.shell: /sbin/service auditd restart

diff --git a/tasks/auditd.yml b/tasks/auditd.yml
@@ -1,13 +1,12 @@
 ---
 
-- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added
+- name: POST | AUDITD | Apply auditd template will for section 5.2.3 - only required rules will be added
   ansible.builtin.template:
       src: audit/99_auditd.rules.j2
       dest: /etc/audit/rules.d/99_auditd.rules
       owner: root
       group: root
-      mode: 0600
-  register: audit_rules_updated
+      mode: '0600'
   notify:
       - Auditd_immutable_check
       - Audit_immutable_fact

diff --git a/tasks/main.yml b/tasks/main.yml
@@ -56,11 +56,11 @@
         ansible.builtin.shell: passwd -S root | grep -E "(Password set, SHA512 crypt|Password locked|root\s(LK|L)\s)"
         changed_when: false
         failed_when: false
-        register: root_passwd_set
+        register: discovered_root_passwd_set
 
       - name: Ensure root password is set
         ansible.builtin.assert:
-            that: root_passwd_set.rc == 0
+            that: discovered_root_passwd_set.rc == 0
             fail_msg: "You have rule 4.5.2.4 enabled this requires that you have a root password set"
             success_msg: "You have a root password set"
 
@@ -98,11 +98,11 @@
         changed_when: false
         failed_when: false
         check_mode: false
-        register: ansible_user_password_set
+        register: discovered_ansible_user_password_set
 
       - name: "Assert that password set for {{ ansible_env.SUDO_USER }} and account not locked"
         ansible.builtin.assert:
-            that: ansible_user_password_set.stdout | length != 0 and ansible_user_password_set.stdout != "!!"
+            that: discovered_ansible_user_password_set.stdout | length != 0 and discovered_ansible_user_password_set.stdout != "!!"
             fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_env.SUDO_USER }} has no password set - It can break access"
             success_msg: "You have a password set for the {{ ansible_env.SUDO_USER }} user"
         vars:

diff --git a/tasks/parse_etc_password.yml b/tasks/parse_etc_password.yml
@@ -6,12 +6,12 @@
         ansible.builtin.shell: cat /etc/passwd
         changed_when: false
         check_mode: false
-        register: rhel8cis_passwd_file_audit
+        register: discovered_passwd_file_audit
 
       - name: "PRELIM | 5.5.2 | 6.2.7 | 6.2.8 | 6.2.20 | Split passwd entries"
         ansible.builtin.set_fact:
-            rhel8cis_passwd: "{{ rhel8cis_passwd_file_audit.stdout_lines | map('regex_replace', ld_passwd_regex, ld_passwd_yaml) | map('from_yaml') | list }}"
-        with_items: "{{ rhel8cis_passwd_file_audit.stdout_lines }}"
+            rhel8cis_passwd: "{{ discovered_passwd_file_audit.stdout_lines | map('regex_replace', ld_passwd_regex, ld_passwd_yaml) | map('from_yaml') | list }}"
+        with_items: "{{ discovered_passwd_file_audit.stdout_lines }}"
         vars:
             ld_passwd_regex: >-
                 ^(?P<id>[^:]*):(?P<password>[^:]*):(?P<uid>[^:]*):(?P<gid>[^:]*):(?P<gecos>[^:]*):(?P<dir>[^:]*):(?P<shell>[^:]*)

diff --git a/tasks/post_remediation_audit.yml b/tasks/post_remediation_audit.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: Post Audit | Run post_remediation {{ benchmark }} audit
-  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g {{ group_names }}"
+  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g \"{{ group_names }}\""
   changed_when: true
   environment:
       AUDIT_BIN: "{{ audit_bin }}"
@@ -23,12 +23,12 @@
   block:
       - name: Post Audit | Capture data {{ post_audit_outfile }}
         ansible.builtin.shell: cat {{ post_audit_outfile }}
-        register: post_audit
+        register: discovered_post_audit
         changed_when: false
 
       - name: Post Audit | Capture post-audit result
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}"
+            post_audit_summary: "{{ discovered_post_audit.stdout | from_json | json_query(summary) }}"
         vars:
             summary: summary."summary-line"
 
@@ -38,9 +38,9 @@
   block:
       - name: Post Audit | Capture data {{ post_audit_outfile }}
         ansible.builtin.shell: tail -2 {{ post_audit_outfile }}
-        register: post_audit
+        register: discovered_post_audit
         changed_when: false
 
       - name: Post Audit | Capture post-audit result
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ post_audit.stdout_lines }}"
+            post_audit_summary: "{{ discovered_post_audit.stdout_lines }}"
diff --git a/tasks/pre_remediation_audit.yml b/tasks/pre_remediation_audit.yml
@@ -58,11 +58,11 @@
       - name: Pre Audit Setup | Check for goss file
         ansible.builtin.stat:
             path: "{{ audit_bin }}"
-        register: goss_available
+        register: discovered_goss_available
 
       - name: Pre Audit Setup | If audit ensure goss is available
         ansible.builtin.assert:
-            that: goss_available.stat.exists
+            that: discovered_goss_available.stat.exists
             msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
 
 - name: Pre Audit Setup | Copy ansible default vars values to test audit
@@ -77,7 +77,7 @@
       mode: '0600'
 
 - name: Pre Audit | Run pre_remediation {{ benchmark }} audit
-  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
+  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
   changed_when: true
   environment:
       AUDIT_BIN: "{{ audit_bin }}"
@@ -88,29 +88,29 @@
   when:
       - audit_format == "json"
   block:
-      - name: capture data {{ pre_audit_outfile }}
+      - name: Pre Audit | Capture data {{ pre_audit_outfile }}
         ansible.builtin.shell: cat {{ pre_audit_outfile }}
-        register: pre_audit
+        register: discovered_pre_audit
         changed_when: false
 
       - name: Pre Audit | Capture pre-audit result
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
+            pre_audit_summary: "{{ discovered_pre_audit.stdout | from_json | json_query(summary) }}"
         vars:
             summary: summary."summary-line"
 
 - name: Pre Audit | Capture audit data if documentation format
   when:
       - audit_format == "documentation"
   block:
-      - name: Pre Audit | capture data {{ pre_audit_outfile }} | documentation format
+      - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
         ansible.builtin.shell: tail -2 {{ pre_audit_outfile }}
-        register: pre_audit
+        register: discovered_pre_audit
         changed_when: false
 
       - name: Pre Audit | Capture pre-audit result | documentation format
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ pre_audit.stdout_lines }}"
+            pre_audit_summary: "{{ discovered_pre_audit.stdout_lines }}"
 
 - name: Audit_Only | Run Audit Only
   when: