colin
/
UBUNTU24-CIS
mirror of https://github.com/ansible-lockdown/UBUNTU24-CIS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
UBUNTU24-CIS/tasks/prelim.yml

317 lines
10 KiB
YAML
Raw Blame History

---
- name: "PRELIM | AUDIT | Set default values for facts"
ansible.builtin.set_fact:
control_1_6_1_4_was_run: false
ubtu24cis_apparmor_enforce_only: false
changed_when: false
- name: "PRELIM | AUDIT | Register if snap being used"
when: ubtu24cis_rule_1_1_1_7
tags: always
ansible.builtin.shell: df -h | grep -wc "/snap"
changed_when: false
failed_when: prelim_snap_pkg_mgr.rc not in [ 0, 1 ]
register: prelim_snap_pkg_mgr
- name: "PRELIM | AUDIT | Register if squashfs is built into the kernel"
when: ubtu24cis_rule_1_1_1_7
tags: always
ansible.builtin.shell: cat /lib/modules/$(uname -r)/modules.builtin | grep -c "squashfs"
changed_when: false
failed_when: prelim_squashfs_builtin.rc not in [ 0, 1 ]
register: prelim_squashfs_builtin
- name: PRELIM | AUDIT | Section 1.1 | Create list of mount points
tags: always
ansible.builtin.set_fact:
prelim_mount_names: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
- name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options
tags: always
block:
- name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options - call mount # noqa command-instead-of-module
ansible.builtin.shell: |
mount | awk '{print $1, $3, $5, $6}'
changed_when: false
register: prelim_mount_output
- name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options - build fact # This is inherited and used in mountpoints tasks
ansible.builtin.set_fact:
prelim_mount_point_fs_and_options: >-
{%- set prelim_mount_point_fs_and_options = {} -%}
{%- for line in prelim_mount_output.stdout_lines -%}
{%- set fields = line.split() -%}
{%- set _ = prelim_mount_point_fs_and_options.update({fields[1]: {'src': fields[0], 'fs_type': fields[2], 'original_options': fields[3][1:-1].split(','), 'options': fields[3][1:-1].split(',')}}) -%}
{%- endfor -%}
{{ prelim_mount_point_fs_and_options }}
- name: "PRELIM | AUDIT | Debug of mount variables to assist in troubleshooting"
when: ubtu24cis_debug_mount_data
ansible.builtin.debug:
msg: "{{ prelim_mount_point_fs_and_options }}"
- name: "PRELIM | PATCH | Run apt update"
tags: always
ansible.builtin.package:
update_cache: true
changed_when: not ubtu24cis_ignore_apt_update_changed_when
- name: Include audit specific variables
when:
- run_audit or audit_only
- setup_audit
tags:
- setup_audit
- run_audit
ansible.builtin.include_vars:
file: audit.yml
- name: Include pre-remediation audit tasks
when:
- run_audit or audit_only
- setup_audit
tags:
- run_audit
ansible.builtin.import_tasks:
file: pre_remediation_audit.yml
- name: "PRELIM | AUDIT | Wireless adapter pre-requisites"
when:
- ubtu24cis_rule_3_1_2
- not system_is_container
tags: always
block:
- name: "PRELIM | AUDIT | Discover is wireless adapter on system"
ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless
changed_when: false
failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ]
register: prelim_wireless_adapters
- name: "PRELIM | AUDIT | If wireless adapter present capture module"
when: prelim_wireless_adapters.rc == 0
ansible.builtin.shell: |
for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname);
do basename "$(readlink -f "$driverdir"/device/driver/module)";
done | sort -u
changed_when: false
failed_when: prelim_wireless_modules.rc not in [ 0, 1 ]
register: prelim_wireless_modules
- name: "PRELIM | PATCH | Find all sudoers files."
when:
- ubtu24cis_rule_5_2_4 or
ubtu24cis_rule_5_2_5
tags: always
ansible.builtin.shell: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"
changed_when: false
failed_when: false
check_mode: false
register: prelim_sudoers_files
- name: "PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x"
when:
- ubtu24cis_rule_5_3_3_2_1 or
ubtu24cis_rule_5_3_3_2_2 or
ubtu24cis_rule_5_3_3_2_3 or
ubtu24cis_rule_5_3_3_2_4 or
ubtu24cis_rule_5_3_3_2_5 or
ubtu24cis_rule_5_3_3_2_6
tags: always
ansible.builtin.file:
path: '/etc/security/pwquality.conf.d'
state: directory
owner: root
group: root
mode: 'u+x,g-w,o-rwx'
- name: "PRELIM | AUDIT | Discover Interactive UID MIN and MIN from logins.def"
when: not discover_int_uid
tags: always
block:
- name: "PRELIM | AUDIT | Capture UID_MIN information from logins.def"
ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_uid_min_id
- name: "PRELIM | AUDIT | Capture UID_MAX information from logins.def"
ansible.builtin.shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_uid_max_id
- name: "PRELIM | AUDIT | Capture GID_MIN information from logins.def"
ansible.builtin.shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_gid_min_id
- name: "PRELIM | AUDIT | Set_facts for interactive uid/gid"
ansible.builtin.set_fact:
min_int_uid: "{{ prelim_uid_min_id.stdout }}"
max_int_uid: "{{ prelim_uid_max_id.stdout }}"
min_int_gid: "{{ prelim_gid_min_id.stdout }}"
- name: "PRELIM | AUDIT | Capture pam configs related files"
tags: always
ansible.builtin.find:
paths:
- '/usr/share/pam-configs/'
- '/etc/pam.d/'
register: prelim_pam_conf_files
- name: PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x
when:
- ubtu24cis_rule_5_3_3_2_1 or
ubtu24cis_rule_5_3_3_2_6
tags: always
ansible.builtin.file:
path: "{{ item.path }}"
state: "{{ item.state }}"
owner: root
group: root
mode: 'g-w,o-rwx'
modification_time: preserve
access_time: preserve
register: prelim_pwquality_dummy
changed_when: prelim_pwquality_dummy.diff == "absent"
loop:
- { path: '/etc/security/pwquality.conf.d', state: 'directory' }
- { path: '/etc/security/pwquality.conf.d/cis_dummy.conf', state: 'touch' }
- name: "PRELIM | AUDIT | Capture pam security related files"
tags: always
ansible.builtin.find:
paths:
- /etc/security/pwquality.conf.d/
patterns: '*.conf'
register: prelim_pam_pwquality_confs
- name: "PRELIM | AUDIT | Interactive Users"
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $1 }'
changed_when: false
register: prelim_interactive_usernames
- name: "PRELIM | AUDIT | Interactive User accounts home directories"
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $6 }'
changed_when: false
register: prelim_interactive_users_home
- name: "PRELIM | AUDIT | Interactive UIDs"
tags: always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $3 }'
changed_when: false
register: prelim_interactive_uids
- name: "PRELIM | AUDIT | Gather UID 0 accounts other than root"
when: ubtu24cis_rule_5_4_2_1
tags: always
ansible.builtin.shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
changed_when: false
check_mode: false
register: prelim_uid_zero_accounts_except_root
- name: "PRELIM | PATCH | Create journald conf.d directory"
when:
- ubtu24cis_rule_6_1_2_2 or
ubtu24cis_rule_6_1_2_3 or
ubtu24cis_rule_6_1_2_4
tags: always
ansible.builtin.file:
path: /etc/systemd/journald.conf.d
state: directory
owner: root
group: root
mode: 'u+x,go-w'
- name: "PRELIM | PATCH | Ensure auditd is installed"
when:
- ubtu24cis_rule_6_2_1_1 or
ubtu24cis_rule_6_2_4_1 or
ubtu24cis_rule_6_2_4_6 or
ubtu24cis_rule_6_2_4_8
tags: always
block:
- name: "PRELIM | PATCH | Ensure auditd is installed"
ansible.builtin.package:
name: ['auditd', 'audispd-plugins']
state: present
- name: "PRELIM | AUDIT | Audit conf and rules files | list files"
ansible.builtin.find:
path: /etc/audit/
file_type: file
recurse: true
patterns: '*.conf,*.rules'
register: prelim_auditd_conf_files
- name: "PRELIM | AUDIT | Check if auditd is immutable before changes"
when: "'auditd' in ansible_facts.packages"
tags: always
ansible.builtin.shell: auditctl -s | grep "enabled 2"
changed_when: false
failed_when: prelim_auditd_immutable_check.rc not in [ 0, 1 ]
register: prelim_auditd_immutable_check
- name: "PRELIM | AUDIT | 6.2.4.x | Capture information about auditd logfile path | discover file"
when:
- ubtu24cis_rule_6_2_4_1 or
ubtu24cis_rule_6_2_4_2 or
ubtu24cis_rule_6_2_4_3 or
ubtu24cis_rule_6_2_4_4
tags: always
ansible.builtin.shell: "grep ^log_file /etc/audit/auditd.conf | awk '{ print $NF }'"
changed_when: false
check_mode: false
failed_when: prelim_auditd_logfile.rc not in [ 0, 1 ]
register: prelim_auditd_logfile
- name: "PRELIM | PATCH | Install ACL"
when:
- ubtu24cis_rule_7_2_9
- "'acl' not in ansible_facts.packages"
tags: always
ansible.builtin.package:
name: acl
state: present
- name: "PRELIM | PATCH | Install cron"
when: ubtu24cis_rule_2_4_1_1
tags: always
ansible.builtin.package:
name: cron
state: present
- name: "PRELIM | PATCH | Install UFW"
when:
- ubtu24cis_rule_2_4_1_1
- ubtu24cis_firewall_package == "ufw"
tags: always
ansible.builtin.package:
name: ufw
state: present
## Optional
- name: "Optional | PATCH | UFW firewall force to use /etc/sysctl.conf settings"
when:
- ubtu24cis_firewall_package == "ufw"
- ubtu24cis_ufw_use_sysctl
tags: always
ansible.builtin.lineinfile:
path: /etc/default/ufw
regexp: ^IPT_SYSCTL=.*
line: IPT_SYSCTL=/etc/sysctl.conf
mode: 'u-x,go-wx'
- name: "OPTIONAL | PATCH | Install Logrotate if missing"
when:
- ubtu24cis_rule_6_1_3_8
- ubtu24cis_logrotate_pkg_install
ansible.builtin.package:
name: logrotate
state: present
Reference in New Issue View Git Blame Copy Permalink