From 4af134cd74760fdde2cc422b470196a10077eabd Mon Sep 17 00:00:00 2001 From: Shawn Hardwick Date: Wed, 5 Feb 2025 12:03:30 -0500 Subject: [PATCH] Update rule 5.4.1.5 to use shell task which supports pipes instead of command task; previously this would silently fail Signed-off-by: Shawn Hardwick --- tasks/section_5/cis_5.4.1.x.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/section_5/cis_5.4.1.x.yml b/tasks/section_5/cis_5.4.1.x.yml index ccb0427..bb2019e 100644 --- a/tasks/section_5/cis_5.4.1.x.yml +++ b/tasks/section_5/cis_5.4.1.x.yml @@ -130,13 +130,13 @@ - login block: - name: "5.4.1.5 | AUDIT | Ensure inactive password lock is configured | General setting" - ansible.builtin.command: useradd -D | grep INACTIVE | cut -d= -f2 + ansible.builtin.shell: useradd -D | grep INACTIVE | cut -d= -f2 changed_when: false failed_when: false register: discovered_passwd_inactive_setting - name: "5.4.1.5 | PATCH | Ensure inactive password lock is configured| Set inactive period for new users" - when: discovered_passwd_inactive_setting.stdout != ubtu24cis_pass_inactive | string + when: discovered_passwd_inactive_setting.stdout != (ubtu24cis_pass_inactive | string) ansible.builtin.command: useradd -D -f {{ ubtu24cis_pass_inactive }} failed_when: false changed_when: true