diff --git a/defaults/main.yml b/defaults/main.yml index 3a6a356..28b802e 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -665,7 +665,6 @@ ubtu24cis_apparmor_mode: complain # HAVING THAT PW EXPOSED IN RAW TEXT IS NOT SECURE!!!! ubtu24cis_grub_user: root ubtu24cis_set_grub_user_pass: false -ubtu24cis_grub_user_passwd: '$y$j9T$MBA5l/tQyWifM869nQjsi.$cTy0ConcNjIYOn6Cppo5NAky20osrkRxz4fEWA8xac6' # Set to changeme ubtu24cis_grub_user_file: /etc/grub.d/00_user ubtu24cis_bootloader_password_hash: "grub.pbkdf2.sha512.changethispassword" # pragma: allowlist secret ubtu24cis_set_boot_pass: false diff --git a/tasks/main.yml b/tasks/main.yml index e246e7f..cfdb641 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -62,31 +62,6 @@ that: ubtu24cis_bootloader_password_hash.find('grub.pbkdf2.sha512') != -1 and ubtu24cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword' # pragma: allowlist secret msg: "This role will not be able to run single user password commands as ubtu24cis_bootloader_password_hash variable has not been set correctly" -- name: Check ubtu24cis_grub_user password variable has been changed - when: ubtu24cis_rule_1_4_1 - tags: always - block: - - name: Check ubtu24cis_grub_user password variable has been changed | check password is set - ansible.builtin.shell: "grep ^{{ ubtu24cis_grub_user }} /etc/shadow | awk -F : '{print $2}'" - changed_when: false - register: ubtu24cis_password_set_grub_user - - - name: Check ubtu24cis_grub_user password variable has been changed | check password is set - when: - - "'$y$' in ubtu24cis_password_set_grub_user.stdout" - - ubtu24cis_set_grub_user_pass - - ubtu24cis_rule_1_4_1 - ansible.builtin.assert: - that: ubtu24cis_password_set_grub_user.stdout.find('$y$') != -1 or ubtu24cis_grub_user_passwd.find('$y$') != -1 and ubtu24cis_grub_user_passwd != '$y$j9T$MBA5l/tQyWifM869nQjsi.$cTy0ConcNjIYOn6Cppo5NAky20osrkRxz4fEWA8xac6' - msg: "This role will not set the {{ ubtu24cis_grub_user }} user password is not set or ubtu24cis_grub_user_passwd variable has not been set correctly" - - - name: Check ubtu24cis_grub_user password variable has been changed | if password blank or incorrect type and not being set - when: not ubtu24cis_set_grub_user_pass - ansible.builtin.assert: - that: ( ubtu24cis_password_set_grub_user.stdout | length > 10 ) and '$y$' in ubtu24cis_password_set_grub_user.stdout - fail_msg: "Grub User {{ ubtu24cis_grub_user }} has no password set or incorrect encryption" - success_msg: "Grub User {{ ubtu24cis_grub_user }} has a valid password set to be used in single user mode" - - name: Setup rules if container when: - ansible_connection == 'docker' or diff --git a/templates/ansible_vars_goss.yml.j2 b/templates/ansible_vars_goss.yml.j2 index f558438..02d8c3e 100644 --- a/templates/ansible_vars_goss.yml.j2 +++ b/templates/ansible_vars_goss.yml.j2 @@ -484,7 +484,7 @@ ubtu24cis_apparmor_disable: {{ ubtu24cis_apparmor_disable }} # THIS VALUE IS WHAT THE ROOT PW WILL BECOME!!!!!!!! # HAVING THAT PW EXPOSED IN RAW TEXT IS NOT SECURE!!!! ubtu24cis_grub_user: {{ ubtu24cis_grub_user }} -ubtu24cis_bootloader_password_hash: {{ ubtu24cis_grub_user_passwd }} # pragma: allowlist secret +ubtu24cis_bootloader_password_hash: {{ ubtu24cis_bootloader_password_hash }} # pragma: allowlist secret ## Controls 1.5.x