colin
/
UBUNTU24-CIS
mirror of https://github.com/ansible-lockdown/UBUNTU24-CIS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

5.4.3.3 updated to add profile script 

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2025-01-10 12:37:54 +00:00
parent 9709aa503b
commit cc307541a9
No known key found for this signature in database
GPG Key ID: 997FF7FE93AEB5B9
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tasks/section_5/cis_5.4.3.x.yml
View File

@ -34,7 +34,7 @@
state: "{{ item.state }}" state: "{{ item.state }}"
marker: "# {mark} - CIS benchmark - Ansible-lockdown" marker: "# {mark} - CIS benchmark - Ansible-lockdown"
create: true create: true
mode: 'go-w' mode: 'go-wx'
block: | block: |
TMOUT={{ ubtu24cis_shell_session_timeout }} TMOUT={{ ubtu24cis_shell_session_timeout }}
readonly TMOUT readonly TMOUT
@ -54,6 +54,8 @@
- rule_5.4.3.3 - rule_5.4.3.3
- NIST800-53R5_AC-3 - NIST800-53R5_AC-3
- NIST800-53R5_MP-2 - NIST800-53R5_MP-2
block:
- name: "5.4.3.3 | PATCH | Ensure default user umask is configured | update current settings"
ansible.builtin.replace: ansible.builtin.replace:
path: "{{ item.path }}" path: "{{ item.path }}"
regexp: (?i)(umask\s+\d\d\d) regexp: (?i)(umask\s+\d\d\d)
@ -61,3 +63,11 @@
loop: loop:
- { path: '/etc/profile', line: 'umask' } - { path: '/etc/profile', line: 'umask' }
- { path: '/etc/login.defs', line: 'UMASK' } - { path: '/etc/login.defs', line: 'UMASK' }
- name: "5.4.3.3 | PATCH | Ensure default user umask is configured | add profile script to set"
ansible.builtin.template:
src: etc/profile.d/50-umask.sh.j2
dest: /etc/profile.d/50-umask.sh
owner: root
group: root
mode: 'go+r,go-wx'