ptoal/product-demos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: ptoal:jce/disa-update
Branches Tags
ptoal:main ptoal:fix_ci ptoal:cnv_fixes2 ptoal:jce/cloud-cleanup ptoal:jce/firewalld-fix ptoal:fix_aws_groups ptoal:windows_change_pass ptoal:jce/multi-arch-ee ptoal:abandon-galaxy ptoal:wtome-devspaces ptoal:jce/devcontainer ptoal:jce/ansible-cfg ptoal:jce/disa-update ptoal:jce/apd-org ptoal:jce/session-timeout ptoal:jce/az-fix ptoal:collection ptoal:wtome/2.5 ptoal:usr_app ptoal:wtome/windows-bsod ptoal:jce/goals ptoal:small_fixes ptoal:azure-finops ptoal:csv-inventory ptoal:gitlab_ver ptoal:creds-exist ptoal:rhpd_test ptoal:rhc ptoal:master
ptoal:test ptoal:TEST
..
compare: ptoal:collection
Branches Tags
ptoal:main ptoal:fix_ci ptoal:cnv_fixes2 ptoal:jce/cloud-cleanup ptoal:jce/firewalld-fix ptoal:fix_aws_groups ptoal:windows_change_pass ptoal:jce/multi-arch-ee ptoal:abandon-galaxy ptoal:wtome-devspaces ptoal:jce/devcontainer ptoal:jce/ansible-cfg ptoal:jce/disa-update ptoal:jce/apd-org ptoal:jce/session-timeout ptoal:jce/az-fix ptoal:collection ptoal:wtome/2.5 ptoal:usr_app ptoal:wtome/windows-bsod ptoal:jce/goals ptoal:small_fixes ptoal:azure-finops ptoal:csv-inventory ptoal:gitlab_ver ptoal:creds-exist ptoal:rhpd_test ptoal:rhc ptoal:master
ptoal:test ptoal:TEST

1 Commits
jce/disa-u ... collection

Author SHA1 Message Date
willtome
c86bfd0a10 add playbook 2024-11-18 21:03:20 -05:00
37 changed files with 3147 additions and 3474 deletions
Expand all files Collapse all files

3
.gitignore vendored
View File

@@ -10,6 +10,3 @@ choose_demo_example_aws.yml
roles/* roles/*
!roles/requirements.yml !roles/requirements.yml
.deployment_id .deployment_id
.cache/
.ansible/
**/tmp/

3
.vscode/settings.json vendored
View File

@@ -1,3 +1,4 @@
{ {
"editor.renderWhitespace": "all" "editor.renderWhitespace": "all",
"ansible.python.interpreterPath": "/usr/local/bin/python3"
} }

15
cloud/README.md
View File

@@ -19,11 +19,12 @@ This category of demos shows examples of multi-cloud provisioning and management
### Jobs ### Jobs
- [**Cloud / AWS / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider - [**Cloud / Create Infra**](create_infra.yml) - Creates a VPC with required routing and firewall rules for provisioning VMs
- [**Cloud / AWS / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted. - [**Cloud / Create Keypair**](aws_key.yml) - Creates a keypair for connecting to EC2 instances
- [**Cloud / AWS / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot. - [**Cloud / Create VM**](create_vm.yml) - Create a VM based on a [blueprint](blueprints/) in the selected cloud provider
- [**Cloud / AWS / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider. By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched. - [**Cloud / Destroy VM**](destroy_vm.yml) - Destroy a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be deleted.
- [**Cloud / Resize EC2**](resize_ec2.yml) - Re-size an EC2 instance. - [**Cloud / Snapshot EC2**](snapshot_ec2.yml) - Snapshot a VM that has been created in a cloud provider. VM must be imported into dynamic inventory to be snapshot.
- [**Cloud / Restore EC2 from Snapshot**](snapshot_ec2.yml) - Restore a VM that has been created in a cloud provider. By default, volumes will be restored from their latest snapshot. VM must be imported into dynamic inventory to be patched.
### Inventory ### Inventory
@@ -58,13 +59,11 @@ After running the setup job template, there are a few steps required to make the
## Suggested Usage ## Suggested Usage
**Deploy Cloud Stack in AWS** - This workflow builds out many helpful and convient resources in AWS. Given an AWS region, key, and some organizational paremetres for tagging it builds a default VPC, keypair, five VMs (three RHEL and two Windows), and even provides a report for cloud stats. It is the typical starting point for using Ansible Product-Demos in AWS. **Cloud / Create Keypair** - The Create Keypair job creates an EC2 keypair which can be used when creating EC2 instances to enable SSH access.
**Cloud / Create VM** - The Create VM job builds a VM in the given provider based on the included `demo.cloud` collection. VM [blueprints](blueprints/) define variables for each provider that override the defaults in the collection. When creating VMs it is recommended to follow naming conventions that can be used as host patterns. (eg. VM names: `win1`, `win2`, `win3`. Host Pattern: `win*` ) **Cloud / Create VM** - The Create VM job builds a VM in the given provider based on the included `demo.cloud` collection. VM [blueprints](blueprints/) define variables for each provider that override the defaults in the collection. When creating VMs it is recommended to follow naming conventions that can be used as host patterns. (eg. VM names: `win1`, `win2`, `win3`. Host Pattern: `win*` )
**Cloud / AWS / Patch EC2 Workflow** - Create a VPC and one or more linux VM(s) in AWS using the `Cloud / Create VPC` and `Cloud / Create VM` templates. Run the workflow and observe the instance snapshots followed by patching operation. Optionally, use the survey to force a patch failure in order to demonstrate the restore path. At this time, the workflow does not support patching Windows instances. **Cloud / AWS / Patch EC2 Workflow** - Create a VPC and one or more linux VM(s) in AWS using the `Cloud / Create VPC` and `Cloud / Create VM` templates. Run the workflow and observe the instance snapshots followed by patching operation. Optionally, use the survey to force a patch failure in order to demonstrate the restore path. At this time, the workflow does not support patching Windows instances.
**Cloud / AWS / Resize EC2** - Given an EC2 instance, change its size. This takes an AWS region, target host pattern, and a target instance size as parameters. As a final step, this job refreshes the AWS inventory so the re-created instance is accessible from AAP.
## Known Issues ## Known Issues
Azure does not work without a custom execution environment that includes the Azure dependencies. Azure does not work without a custom execution environment that includes the Azure dependencies.

25
cloud/create_vpc.yml
View File

@@ -2,7 +2,6 @@
- name: Create Cloud Infra - name: Create Cloud Infra
hosts: localhost hosts: localhost
gather_facts: false gather_facts: false
vars: vars:
aws_vpc_name: aws-test-vpc aws_vpc_name: aws-test-vpc
aws_owner_tag: default aws_owner_tag: default
@@ -14,27 +13,6 @@
aws_subnet_name: aws-test-subnet aws_subnet_name: aws-test-subnet
aws_rt_name: aws-test-rt aws_rt_name: aws-test-rt
# map of availability zones to use per region, added since not all
# instance types are available in all AZs. must match the drop-down
# list for the create_vm_aws_region variable described in cloud/setup.yml
_azs:
us-east-1:
- us-east-1a
- us-east-1b
- us-east-1c
us-east-2:
- us-east-2a
- us-east-2b
- us-east-2c
us-west-1:
# us-west-1a not available when last checked 20250218
- us-west-1b
- us-west-1c
us-west-2:
- us-west-2a
- us-west-2b
- us-west-2c
tasks: tasks:
- name: Create VPC - name: Create VPC
amazon.aws.ec2_vpc_net: amazon.aws.ec2_vpc_net:
@@ -117,13 +95,12 @@
owner: "{{ aws_owner_tag }}" owner: "{{ aws_owner_tag }}"
purpose: "{{ aws_purpose_tag }}" purpose: "{{ aws_purpose_tag }}"
- name: Create a subnet in the VPC - name: Create a subnet on the VPC
amazon.aws.ec2_vpc_subnet: amazon.aws.ec2_vpc_subnet:
state: present state: present
vpc_id: "{{ aws_vpc.vpc.id }}" vpc_id: "{{ aws_vpc.vpc.id }}"
cidr: "{{ aws_subnet_cidr }}" cidr: "{{ aws_subnet_cidr }}"
region: "{{ create_vm_aws_region }}" region: "{{ create_vm_aws_region }}"
az: "{{ _azs[create_vm_aws_region] | shuffle | first }}"
map_public: true map_public: true
tags: tags:
Name: "{{ aws_subnet_name }}" Name: "{{ aws_subnet_name }}"

10
cloud/resize_ec2.yml
View File

@@ -1,10 +0,0 @@
---
- name: Resize ec2 instances
hosts: "{{ _hosts | default(omit) }}"
gather_facts: false
tasks:
- name: Include snapshot role
ansible.builtin.include_role:
name: "demo.cloud.aws"
tasks_from: resize_ec2

2
cloud/setup.yml
View File

@@ -283,7 +283,7 @@ controller_workflows:
- identifier: Deploy Windows GUI Blueprint - identifier: Deploy Windows GUI Blueprint
unified_job_template: Cloud / AWS / Create VM unified_job_template: Cloud / AWS / Create VM
extra_data: extra_data:
create_vm_vm_name: aws-dc create_vm_vm_name: aws_dc
vm_blueprint: windows_full vm_blueprint: windows_full
success_nodes: success_nodes:
- Update Inventory - Update Inventory

45
collections/ansible_collections/demo/cloud/roles/aws/tasks/resize_ec2.yml
View File

@@ -1,45 +0,0 @@
---
# parameters
# instance_type: new instance type, e.g. t3.large
- name: AWS | RESIZE VM
delegate_to: localhost
vars:
controller_dependency_check: false # noqa: var-naming[no-role-prefix]
controller_inventory_sources:
- name: AWS Inventory
inventory: Demo Inventory
organization: Default
wait: true
block:
- name: AWS | RESIZE EC2 | assert required vars
ansible.builtin.assert:
that:
- instance_id is defined
- aws_region is defined
fail_msg: "instance_id, aws_region is required for resize operations"
- name: AWS | RESIZE EC2 | shutdown instance
amazon.aws.ec2_instance:
instance_ids: "{{ instance_id }}"
region: "{{ aws_region }}"
state: stopped
wait: true
- name: AWS | RESIZE EC2 | update instance type
amazon.aws.ec2_instance:
region: "{{ aws_region }}"
instance_ids: "{{ instance_id }}"
instance_type: "{{ instance_type }}"
wait: true
- name: AWS | RESIZE EC2 | start instance
amazon.aws.ec2_instance:
instance_ids: "{{ instance_id }}"
region: "{{ aws_region }}"
state: started
wait: true
- name: Synchronize inventory
run_once: true
ansible.builtin.include_role:
name: infra.controller_configuration.inventory_source_update

7
collections/ansible_collections/demo/compliance/playbooks/playbook.yml Normal file
View File

@@ -0,0 +1,7 @@
---
- hosts: localhost
gather_facts: no
tasks:
- debug:
msg: Hello world!

25
collections/ansible_collections/demo/compliance/roles/rhel8STIG/defaults/main.yml
View File

@@ -3,7 +3,7 @@ rhel8STIG_stigrule_230225_Manage: True
rhel8STIG_stigrule_230225_banner_Line: banner /etc/issue rhel8STIG_stigrule_230225_banner_Line: banner /etc/issue
# R-230226 RHEL-08-010050 # R-230226 RHEL-08-010050
rhel8STIG_stigrule_230226_Manage: True rhel8STIG_stigrule_230226_Manage: True
rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: "''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.''" rhel8STIG_stigrule_230226__etc_dconf_db_local_d_01_banner_message_Value: '''You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.'''
# R-230227 RHEL-08-010060 # R-230227 RHEL-08-010060
rhel8STIG_stigrule_230227_Manage: True rhel8STIG_stigrule_230227_Manage: True
rhel8STIG_stigrule_230227__etc_issue_Dest: /etc/issue rhel8STIG_stigrule_230227__etc_issue_Dest: /etc/issue
@@ -43,6 +43,9 @@ rhel8STIG_stigrule_230241_policycoreutils_State: installed
# R-230244 RHEL-08-010200 # R-230244 RHEL-08-010200
rhel8STIG_stigrule_230244_Manage: True rhel8STIG_stigrule_230244_Manage: True
rhel8STIG_stigrule_230244_ClientAliveCountMax_Line: ClientAliveCountMax 1 rhel8STIG_stigrule_230244_ClientAliveCountMax_Line: ClientAliveCountMax 1
# R-230252 RHEL-08-010291
rhel8STIG_stigrule_230252_Manage: True
rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
# R-230255 RHEL-08-010294 # R-230255 RHEL-08-010294
rhel8STIG_stigrule_230255_Manage: True rhel8STIG_stigrule_230255_Manage: True
rhel8STIG_stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'MinProtocol = TLSv1.2' rhel8STIG_stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'MinProtocol = TLSv1.2'
@@ -135,9 +138,16 @@ rhel8STIG_stigrule_230346__etc_security_limits_conf_Line: '* hard maxlogins 10'
# R-230347 RHEL-08-020030 # R-230347 RHEL-08-020030
rhel8STIG_stigrule_230347_Manage: True rhel8STIG_stigrule_230347_Manage: True
rhel8STIG_stigrule_230347__etc_dconf_db_local_d_00_screensaver_Value: 'true' rhel8STIG_stigrule_230347__etc_dconf_db_local_d_00_screensaver_Value: 'true'
# R-230348 RHEL-08-020040
rhel8STIG_stigrule_230348_Manage: True
rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State: installed
rhel8STIG_stigrule_230348__etc_tmux_conf_Line: 'set -g lock-command vlock'
# R-230352 RHEL-08-020060 # R-230352 RHEL-08-020060
rhel8STIG_stigrule_230352_Manage: True rhel8STIG_stigrule_230352_Manage: True
rhel8STIG_stigrule_230352__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900' rhel8STIG_stigrule_230352__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 900'
# R-230353 RHEL-08-020070
rhel8STIG_stigrule_230353_Manage: True
rhel8STIG_stigrule_230353__etc_tmux_conf_Line: 'set -g lock-after-time 900'
# R-230354 RHEL-08-020080 # R-230354 RHEL-08-020080
rhel8STIG_stigrule_230354_Manage: True rhel8STIG_stigrule_230354_Manage: True
rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line: '/org/gnome/desktop/screensaver/lock-delay' rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line: '/org/gnome/desktop/screensaver/lock-delay'
@@ -325,8 +335,8 @@ rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32_Line: '
rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64_Line: '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng' rhel8STIG_stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64_Line: '-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng'
# R-230439 RHEL-08-030361 # R-230439 RHEL-08-030361
rhel8STIG_stigrule_230439_Manage: True rhel8STIG_stigrule_230439_Manage: True
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete' rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line: '-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete' rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line: '-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng'
# R-230444 RHEL-08-030370 # R-230444 RHEL-08-030370
rhel8STIG_stigrule_230444_Manage: True rhel8STIG_stigrule_230444_Manage: True
rhel8STIG_stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd_Line: '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd' rhel8STIG_stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd_Line: '-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd'
@@ -422,8 +432,7 @@ rhel8STIG_stigrule_230527_Manage: True
rhel8STIG_stigrule_230527_RekeyLimit_Line: RekeyLimit 1G 1h rhel8STIG_stigrule_230527_RekeyLimit_Line: RekeyLimit 1G 1h
# R-230529 RHEL-08-040170 # R-230529 RHEL-08-040170
rhel8STIG_stigrule_230529_Manage: True rhel8STIG_stigrule_230529_Manage: True
rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled: false rhel8STIG_stigrule_230529_systemctl_mask_ctrl_alt_del_target_Command: systemctl mask ctrl-alt-del.target
rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked: true
# R-230531 RHEL-08-040172 # R-230531 RHEL-08-040172
rhel8STIG_stigrule_230531_Manage: True rhel8STIG_stigrule_230531_Manage: True
rhel8STIG_stigrule_230531__etc_systemd_system_conf_Value: 'none' rhel8STIG_stigrule_230531__etc_systemd_system_conf_Value: 'none'
@@ -505,9 +514,6 @@ rhel8STIG_stigrule_244523__usr_lib_systemd_system_emergency_service_Value: '-/us
# R-244525 RHEL-08-010201 # R-244525 RHEL-08-010201
rhel8STIG_stigrule_244525_Manage: True rhel8STIG_stigrule_244525_Manage: True
rhel8STIG_stigrule_244525_ClientAliveInterval_Line: ClientAliveInterval 600 rhel8STIG_stigrule_244525_ClientAliveInterval_Line: ClientAliveInterval 600
# R-244526 RHEL-08-010287
rhel8STIG_stigrule_244526_Manage: True
rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line: '# CRYPTO_POLICY='
# R-244527 RHEL-08-010472 # R-244527 RHEL-08-010472
rhel8STIG_stigrule_244527_Manage: True rhel8STIG_stigrule_244527_Manage: True
rhel8STIG_stigrule_244527_rng_tools_State: installed rhel8STIG_stigrule_244527_rng_tools_State: installed
@@ -520,6 +526,9 @@ rhel8STIG_stigrule_244535__etc_dconf_db_local_d_00_screensaver_Value: 'uint32 5'
# R-244536 RHEL-08-020032 # R-244536 RHEL-08-020032
rhel8STIG_stigrule_244536_Manage: True rhel8STIG_stigrule_244536_Manage: True
rhel8STIG_stigrule_244536__etc_dconf_db_local_d_02_login_screen_Value: 'true' rhel8STIG_stigrule_244536__etc_dconf_db_local_d_02_login_screen_Value: 'true'
# R-244537 RHEL-08-020039
rhel8STIG_stigrule_244537_Manage: True
rhel8STIG_stigrule_244537_tmux_State: installed
# R-244538 RHEL-08-020081 # R-244538 RHEL-08-020081
rhel8STIG_stigrule_244538_Manage: True rhel8STIG_stigrule_244538_Manage: True
rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line: '/org/gnome/desktop/session/idle-delay' rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line: '/org/gnome/desktop/session/idle-delay'

1740
collections/ansible_collections/demo/compliance/roles/rhel8STIG/files/U_RHEL_8_STIG_V2R3_Manual-xccdf.xml → collections/ansible_collections/demo/compliance/roles/rhel8STIG/files/U_RHEL_8_STIG_V1R13_Manual-xccdf.xml
View File

File diff suppressed because one or more lines are too long

19
collections/ansible_collections/demo/compliance/roles/rhel8STIG/handlers/main.yml
View File

@@ -6,25 +6,6 @@
service: service:
name: sshd name: sshd
state: restarted state: restarted
- name: rsyslog_restart
service:
name: rsyslog
state: restarted
- name: sysctl_load_settings
command: sysctl --system
- name: daemon_reload
systemd:
daemon_reload: true
- name: networkmanager_reload
service:
name: NetworkManager
state: reloaded
- name: logind_restart
service:
name: systemd-logind
state: restarted
- name: with_faillock_enable
command: authselect enable-feature with-faillock
- name: do_reboot - name: do_reboot
reboot: reboot:
pre_reboot_delay: 60 pre_reboot_delay: 60

222
collections/ansible_collections/demo/compliance/roles/rhel8STIG/tasks/main.yml
View File

@@ -88,6 +88,16 @@
when: when:
- rhel8STIG_stigrule_230244_Manage - rhel8STIG_stigrule_230244_Manage
- "'openssh-server' in packages" - "'openssh-server' in packages"
# R-230252 RHEL-08-010291
- name: stigrule_230252__etc_sysconfig_sshd
lineinfile:
path: /etc/sysconfig/sshd
regexp: '^# CRYPTO_POLICY='
line: "{{ rhel8STIG_stigrule_230252__etc_sysconfig_sshd_Line }}"
create: yes
notify: do_reboot
when:
- rhel8STIG_stigrule_230252_Manage
# R-230255 RHEL-08-010294 # R-230255 RHEL-08-010294
- name: stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config - name: stigrule_230255__etc_crypto_policies_back_ends_opensslcnf_config
lineinfile: lineinfile:
@@ -101,7 +111,6 @@
- name: stigrule_230256__etc_crypto_policies_back_ends_gnutls_config - name: stigrule_230256__etc_crypto_policies_back_ends_gnutls_config
lineinfile: lineinfile:
path: /etc/crypto-policies/back-ends/gnutls.config path: /etc/crypto-policies/back-ends/gnutls.config
regexp: '^\+VERS'
line: "{{ rhel8STIG_stigrule_230256__etc_crypto_policies_back_ends_gnutls_config_Line }}" line: "{{ rhel8STIG_stigrule_230256__etc_crypto_policies_back_ends_gnutls_config_Line }}"
create: yes create: yes
when: when:
@@ -413,6 +422,20 @@
when: when:
- rhel8STIG_stigrule_230347_Manage - rhel8STIG_stigrule_230347_Manage
- "'dconf' in packages" - "'dconf' in packages"
# R-230348 RHEL-08-020040
- name: stigrule_230348_ensure_tmux_is_installed
yum:
name: tmux
state: "{{ rhel8STIG_stigrule_230348_ensure_tmux_is_installed_State }}"
when: rhel8STIG_stigrule_230348_Manage
# R-230348 RHEL-08-020040
- name: stigrule_230348__etc_tmux_conf
lineinfile:
path: /etc/tmux.conf
line: "{{ rhel8STIG_stigrule_230348__etc_tmux_conf_Line }}"
create: yes
when:
- rhel8STIG_stigrule_230348_Manage
# R-230352 RHEL-08-020060 # R-230352 RHEL-08-020060
- name: stigrule_230352__etc_dconf_db_local_d_00_screensaver - name: stigrule_230352__etc_dconf_db_local_d_00_screensaver
ini_file: ini_file:
@@ -425,13 +448,20 @@
when: when:
- rhel8STIG_stigrule_230352_Manage - rhel8STIG_stigrule_230352_Manage
- "'dconf' in packages" - "'dconf' in packages"
# R-230353 RHEL-08-020070
- name: stigrule_230353__etc_tmux_conf
lineinfile:
path: /etc/tmux.conf
line: "{{ rhel8STIG_stigrule_230353__etc_tmux_conf_Line }}"
create: yes
when:
- rhel8STIG_stigrule_230353_Manage
# R-230354 RHEL-08-020080 # R-230354 RHEL-08-020080
- name: stigrule_230354__etc_dconf_db_local_d_locks_session - name: stigrule_230354__etc_dconf_db_local_d_locks_session
lineinfile: lineinfile:
path: /etc/dconf/db/local.d/locks/session path: /etc/dconf/db/local.d/locks/session
line: "{{ rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line }}" line: "{{ rhel8STIG_stigrule_230354__etc_dconf_db_local_d_locks_session_Line }}"
create: yes create: yes
notify: dconf_update
when: when:
- rhel8STIG_stigrule_230354_Manage - rhel8STIG_stigrule_230354_Manage
# R-230357 RHEL-08-020110 # R-230357 RHEL-08-020110
@@ -580,7 +610,7 @@
when: when:
- rhel8STIG_stigrule_230383_Manage - rhel8STIG_stigrule_230383_Manage
# R-230386 RHEL-08-030000 # R-230386 RHEL-08-030000
- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b32 - name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -588,7 +618,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230386_Manage when: rhel8STIG_stigrule_230386_Manage
# R-230386 RHEL-08-030000 # R-230386 RHEL-08-030000
- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b64 - name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_euid_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -596,7 +626,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230386_Manage when: rhel8STIG_stigrule_230386_Manage
# R-230386 RHEL-08-030000 # R-230386 RHEL-08-030000
- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b32 - name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -604,7 +634,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230386_Manage when: rhel8STIG_stigrule_230386_Manage
# R-230386 RHEL-08-030000 # R-230386 RHEL-08-030000
- name: stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b64 - name : stigrule_230386__etc_audit_rules_d_audit_rules_execve_egid_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -689,7 +719,7 @@
when: when:
- rhel8STIG_stigrule_230395_Manage - rhel8STIG_stigrule_230395_Manage
# R-230402 RHEL-08-030121 # R-230402 RHEL-08-030121
- name: stigrule_230402__etc_audit_rules_d_audit_rules_e2 - name : stigrule_230402__etc_audit_rules_d_audit_rules_e2
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-e 2$' regexp: '^-e 2$'
@@ -697,7 +727,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230402_Manage when: rhel8STIG_stigrule_230402_Manage
# R-230403 RHEL-08-030122 # R-230403 RHEL-08-030122
- name: stigrule_230403__etc_audit_rules_d_audit_rules_loginuid_immutable - name : stigrule_230403__etc_audit_rules_d_audit_rules_loginuid_immutable
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^--loginuid-immutable$' regexp: '^--loginuid-immutable$'
@@ -705,7 +735,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230403_Manage when: rhel8STIG_stigrule_230403_Manage
# R-230404 RHEL-08-030130 # R-230404 RHEL-08-030130
- name: stigrule_230404__etc_audit_rules_d_audit_rules__etc_shadow - name : stigrule_230404__etc_audit_rules_d_audit_rules__etc_shadow
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/shadow -p wa -k identity$' regexp: '^-w /etc/shadow -p wa -k identity$'
@@ -713,7 +743,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230404_Manage when: rhel8STIG_stigrule_230404_Manage
# R-230405 RHEL-08-030140 # R-230405 RHEL-08-030140
- name: stigrule_230405__etc_audit_rules_d_audit_rules__etc_security_opasswd - name : stigrule_230405__etc_audit_rules_d_audit_rules__etc_security_opasswd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/security/opasswd -p wa -k identity$' regexp: '^-w /etc/security/opasswd -p wa -k identity$'
@@ -721,7 +751,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230405_Manage when: rhel8STIG_stigrule_230405_Manage
# R-230406 RHEL-08-030150 # R-230406 RHEL-08-030150
- name: stigrule_230406__etc_audit_rules_d_audit_rules__etc_passwd - name : stigrule_230406__etc_audit_rules_d_audit_rules__etc_passwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/passwd -p wa -k identity$' regexp: '^-w /etc/passwd -p wa -k identity$'
@@ -729,7 +759,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230406_Manage when: rhel8STIG_stigrule_230406_Manage
# R-230407 RHEL-08-030160 # R-230407 RHEL-08-030160
- name: stigrule_230407__etc_audit_rules_d_audit_rules__etc_gshadow - name : stigrule_230407__etc_audit_rules_d_audit_rules__etc_gshadow
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/gshadow -p wa -k identity$' regexp: '^-w /etc/gshadow -p wa -k identity$'
@@ -737,7 +767,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230407_Manage when: rhel8STIG_stigrule_230407_Manage
# R-230408 RHEL-08-030170 # R-230408 RHEL-08-030170
- name: stigrule_230408__etc_audit_rules_d_audit_rules__etc_group - name : stigrule_230408__etc_audit_rules_d_audit_rules__etc_group
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/group -p wa -k identity$' regexp: '^-w /etc/group -p wa -k identity$'
@@ -745,7 +775,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230408_Manage when: rhel8STIG_stigrule_230408_Manage
# R-230409 RHEL-08-030171 # R-230409 RHEL-08-030171
- name: stigrule_230409__etc_audit_rules_d_audit_rules__etc_sudoers - name : stigrule_230409__etc_audit_rules_d_audit_rules__etc_sudoers
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/sudoers -p wa -k identity$' regexp: '^-w /etc/sudoers -p wa -k identity$'
@@ -753,7 +783,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230409_Manage when: rhel8STIG_stigrule_230409_Manage
# R-230410 RHEL-08-030172 # R-230410 RHEL-08-030172
- name: stigrule_230410__etc_audit_rules_d_audit_rules__etc_sudoers_d_ - name : stigrule_230410__etc_audit_rules_d_audit_rules__etc_sudoers_d_
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/sudoers.d/ -p wa -k identity$' regexp: '^-w /etc/sudoers.d/ -p wa -k identity$'
@@ -767,7 +797,7 @@
state: "{{ rhel8STIG_stigrule_230411_audit_State }}" state: "{{ rhel8STIG_stigrule_230411_audit_State }}"
when: rhel8STIG_stigrule_230411_Manage when: rhel8STIG_stigrule_230411_Manage
# R-230412 RHEL-08-030190 # R-230412 RHEL-08-030190
- name: stigrule_230412__etc_audit_rules_d_audit_rules__usr_bin_su - name : stigrule_230412__etc_audit_rules_d_audit_rules__usr_bin_su
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change$' regexp: '^-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change$'
@@ -775,7 +805,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230412_Manage when: rhel8STIG_stigrule_230412_Manage
# R-230413 RHEL-08-030200 # R-230413 RHEL-08-030200
- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset - name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -783,7 +813,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230413_Manage when: rhel8STIG_stigrule_230413_Manage
# R-230413 RHEL-08-030200 # R-230413 RHEL-08-030200
- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset - name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -791,7 +821,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230413_Manage when: rhel8STIG_stigrule_230413_Manage
# R-230413 RHEL-08-030200 # R-230413 RHEL-08-030200
- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32 - name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -799,7 +829,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230413_Manage when: rhel8STIG_stigrule_230413_Manage
# R-230413 RHEL-08-030200 # R-230413 RHEL-08-030200
- name: stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64 - name : stigrule_230413__etc_audit_rules_d_audit_rules_lremovexattr_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -807,7 +837,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230413_Manage when: rhel8STIG_stigrule_230413_Manage
# R-230418 RHEL-08-030250 # R-230418 RHEL-08-030250
- name: stigrule_230418__etc_audit_rules_d_audit_rules__usr_bin_chage - name : stigrule_230418__etc_audit_rules_d_audit_rules__usr_bin_chage
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage$' regexp: '^-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage$'
@@ -815,7 +845,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230418_Manage when: rhel8STIG_stigrule_230418_Manage
# R-230419 RHEL-08-030260 # R-230419 RHEL-08-030260
- name: stigrule_230419__etc_audit_rules_d_audit_rules__usr_bin_chcon - name : stigrule_230419__etc_audit_rules_d_audit_rules__usr_bin_chcon
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -823,7 +853,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230419_Manage when: rhel8STIG_stigrule_230419_Manage
# R-230421 RHEL-08-030280 # R-230421 RHEL-08-030280
- name: stigrule_230421__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent - name : stigrule_230421__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$' regexp: '^-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -831,7 +861,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230421_Manage when: rhel8STIG_stigrule_230421_Manage
# R-230422 RHEL-08-030290 # R-230422 RHEL-08-030290
- name: stigrule_230422__etc_audit_rules_d_audit_rules__usr_bin_passwd - name : stigrule_230422__etc_audit_rules_d_audit_rules__usr_bin_passwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd$' regexp: '^-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd$'
@@ -839,7 +869,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230422_Manage when: rhel8STIG_stigrule_230422_Manage
# R-230423 RHEL-08-030300 # R-230423 RHEL-08-030300
- name: stigrule_230423__etc_audit_rules_d_audit_rules__usr_bin_mount - name : stigrule_230423__etc_audit_rules_d_audit_rules__usr_bin_mount
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -847,7 +877,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230423_Manage when: rhel8STIG_stigrule_230423_Manage
# R-230424 RHEL-08-030301 # R-230424 RHEL-08-030301
- name: stigrule_230424__etc_audit_rules_d_audit_rules__usr_bin_umount - name : stigrule_230424__etc_audit_rules_d_audit_rules__usr_bin_umount
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -855,7 +885,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230424_Manage when: rhel8STIG_stigrule_230424_Manage
# R-230425 RHEL-08-030302 # R-230425 RHEL-08-030302
- name: stigrule_230425__etc_audit_rules_d_audit_rules_mount_b32 - name : stigrule_230425__etc_audit_rules_d_audit_rules_mount_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -863,7 +893,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230425_Manage when: rhel8STIG_stigrule_230425_Manage
# R-230425 RHEL-08-030302 # R-230425 RHEL-08-030302
- name: stigrule_230425__etc_audit_rules_d_audit_rules_mount_b64 - name : stigrule_230425__etc_audit_rules_d_audit_rules_mount_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -871,7 +901,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230425_Manage when: rhel8STIG_stigrule_230425_Manage
# R-230426 RHEL-08-030310 # R-230426 RHEL-08-030310
- name: stigrule_230426__etc_audit_rules_d_audit_rules__usr_sbin_unix_update - name : stigrule_230426__etc_audit_rules_d_audit_rules__usr_sbin_unix_update
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -879,7 +909,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230426_Manage when: rhel8STIG_stigrule_230426_Manage
# R-230427 RHEL-08-030311 # R-230427 RHEL-08-030311
- name: stigrule_230427__etc_audit_rules_d_audit_rules__usr_sbin_postdrop - name : stigrule_230427__etc_audit_rules_d_audit_rules__usr_sbin_postdrop
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -887,7 +917,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230427_Manage when: rhel8STIG_stigrule_230427_Manage
# R-230428 RHEL-08-030312 # R-230428 RHEL-08-030312
- name: stigrule_230428__etc_audit_rules_d_audit_rules__usr_sbin_postqueue - name : stigrule_230428__etc_audit_rules_d_audit_rules__usr_sbin_postqueue
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -895,7 +925,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230428_Manage when: rhel8STIG_stigrule_230428_Manage
# R-230429 RHEL-08-030313 # R-230429 RHEL-08-030313
- name: stigrule_230429__etc_audit_rules_d_audit_rules__usr_sbin_semanage - name : stigrule_230429__etc_audit_rules_d_audit_rules__usr_sbin_semanage
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -903,7 +933,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230429_Manage when: rhel8STIG_stigrule_230429_Manage
# R-230430 RHEL-08-030314 # R-230430 RHEL-08-030314
- name: stigrule_230430__etc_audit_rules_d_audit_rules__usr_sbin_setfiles - name : stigrule_230430__etc_audit_rules_d_audit_rules__usr_sbin_setfiles
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -911,7 +941,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230430_Manage when: rhel8STIG_stigrule_230430_Manage
# R-230431 RHEL-08-030315 # R-230431 RHEL-08-030315
- name: stigrule_230431__etc_audit_rules_d_audit_rules__usr_sbin_userhelper - name : stigrule_230431__etc_audit_rules_d_audit_rules__usr_sbin_userhelper
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -919,7 +949,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230431_Manage when: rhel8STIG_stigrule_230431_Manage
# R-230432 RHEL-08-030316 # R-230432 RHEL-08-030316
- name: stigrule_230432__etc_audit_rules_d_audit_rules__usr_sbin_setsebool - name : stigrule_230432__etc_audit_rules_d_audit_rules__usr_sbin_setsebool
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -927,7 +957,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230432_Manage when: rhel8STIG_stigrule_230432_Manage
# R-230433 RHEL-08-030317 # R-230433 RHEL-08-030317
- name: stigrule_230433__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd - name : stigrule_230433__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -935,7 +965,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230433_Manage when: rhel8STIG_stigrule_230433_Manage
# R-230434 RHEL-08-030320 # R-230434 RHEL-08-030320
- name: stigrule_230434__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign - name : stigrule_230434__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$' regexp: '^-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -943,7 +973,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230434_Manage when: rhel8STIG_stigrule_230434_Manage
# R-230435 RHEL-08-030330 # R-230435 RHEL-08-030330
- name: stigrule_230435__etc_audit_rules_d_audit_rules__usr_bin_setfacl - name : stigrule_230435__etc_audit_rules_d_audit_rules__usr_bin_setfacl
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -951,7 +981,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230435_Manage when: rhel8STIG_stigrule_230435_Manage
# R-230436 RHEL-08-030340 # R-230436 RHEL-08-030340
- name: stigrule_230436__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check - name : stigrule_230436__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check$' regexp: '^-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check$'
@@ -959,7 +989,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230436_Manage when: rhel8STIG_stigrule_230436_Manage
# R-230437 RHEL-08-030350 # R-230437 RHEL-08-030350
- name: stigrule_230437__etc_audit_rules_d_audit_rules__usr_bin_newgrp - name : stigrule_230437__etc_audit_rules_d_audit_rules__usr_bin_newgrp
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -967,7 +997,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230437_Manage when: rhel8STIG_stigrule_230437_Manage
# R-230438 RHEL-08-030360 # R-230438 RHEL-08-030360
- name: stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32 - name : stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -975,7 +1005,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230438_Manage when: rhel8STIG_stigrule_230438_Manage
# R-230438 RHEL-08-030360 # R-230438 RHEL-08-030360
- name: stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64 - name : stigrule_230438__etc_audit_rules_d_audit_rules_init_module_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -983,23 +1013,23 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230438_Manage when: rhel8STIG_stigrule_230438_Manage
# R-230439 RHEL-08-030361 # R-230439 RHEL-08-030361
- name: stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32 - name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$' regexp: '^-a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line }}" line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b32_Line }}"
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230439_Manage when: rhel8STIG_stigrule_230439_Manage
# R-230439 RHEL-08-030361 # R-230439 RHEL-08-030361
- name: stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64 - name : stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$' regexp: '^-a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=unset -k module_chng$'
line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line }}" line: "{{ rhel8STIG_stigrule_230439__etc_audit_rules_d_audit_rules_rename_b64_Line }}"
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230439_Manage when: rhel8STIG_stigrule_230439_Manage
# R-230444 RHEL-08-030370 # R-230444 RHEL-08-030370
- name: stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd - name : stigrule_230444__etc_audit_rules_d_audit_rules__usr_bin_gpasswd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd$' regexp: '^-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd$'
@@ -1007,7 +1037,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230444_Manage when: rhel8STIG_stigrule_230444_Manage
# R-230446 RHEL-08-030390 # R-230446 RHEL-08-030390
- name: stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b32 - name : stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1015,7 +1045,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230446_Manage when: rhel8STIG_stigrule_230446_Manage
# R-230446 RHEL-08-030390 # R-230446 RHEL-08-030390
- name: stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b64 - name : stigrule_230446__etc_audit_rules_d_audit_rules_delete_module_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -1023,7 +1053,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230446_Manage when: rhel8STIG_stigrule_230446_Manage
# R-230447 RHEL-08-030400 # R-230447 RHEL-08-030400
- name: stigrule_230447__etc_audit_rules_d_audit_rules__usr_bin_crontab - name : stigrule_230447__etc_audit_rules_d_audit_rules__usr_bin_crontab
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab$' regexp: '^-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab$'
@@ -1031,7 +1061,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230447_Manage when: rhel8STIG_stigrule_230447_Manage
# R-230448 RHEL-08-030410 # R-230448 RHEL-08-030410
- name: stigrule_230448__etc_audit_rules_d_audit_rules__usr_bin_chsh - name : stigrule_230448__etc_audit_rules_d_audit_rules__usr_bin_chsh
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -1039,7 +1069,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230448_Manage when: rhel8STIG_stigrule_230448_Manage
# R-230449 RHEL-08-030420 # R-230449 RHEL-08-030420
- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b32 - name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1047,7 +1077,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230449_Manage when: rhel8STIG_stigrule_230449_Manage
# R-230449 RHEL-08-030420 # R-230449 RHEL-08-030420
- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b64 - name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EPERM_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1055,7 +1085,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230449_Manage when: rhel8STIG_stigrule_230449_Manage
# R-230449 RHEL-08-030420 # R-230449 RHEL-08-030420
- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b32 - name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1063,7 +1093,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230449_Manage when: rhel8STIG_stigrule_230449_Manage
# R-230449 RHEL-08-030420 # R-230449 RHEL-08-030420
- name: stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b64 - name : stigrule_230449__etc_audit_rules_d_audit_rules_truncate_EACCES_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -1071,7 +1101,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230449_Manage when: rhel8STIG_stigrule_230449_Manage
# R-230455 RHEL-08-030480 # R-230455 RHEL-08-030480
- name: stigrule_230455__etc_audit_rules_d_audit_rules_chown_b32 - name : stigrule_230455__etc_audit_rules_d_audit_rules_chown_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1079,7 +1109,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230455_Manage when: rhel8STIG_stigrule_230455_Manage
# R-230455 RHEL-08-030480 # R-230455 RHEL-08-030480
- name: stigrule_230455__etc_audit_rules_d_audit_rules_chown_b64 - name : stigrule_230455__etc_audit_rules_d_audit_rules_chown_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1087,7 +1117,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230455_Manage when: rhel8STIG_stigrule_230455_Manage
# R-230456 RHEL-08-030490 # R-230456 RHEL-08-030490
- name: stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b32 - name : stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1095,7 +1125,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230456_Manage when: rhel8STIG_stigrule_230456_Manage
# R-230456 RHEL-08-030490 # R-230456 RHEL-08-030490
- name: stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b64 - name : stigrule_230456__etc_audit_rules_d_audit_rules_chmod_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1103,7 +1133,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230456_Manage when: rhel8STIG_stigrule_230456_Manage
# R-230462 RHEL-08-030550 # R-230462 RHEL-08-030550
- name: stigrule_230462__etc_audit_rules_d_audit_rules__usr_bin_sudo - name : stigrule_230462__etc_audit_rules_d_audit_rules__usr_bin_sudo
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -1111,7 +1141,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230462_Manage when: rhel8STIG_stigrule_230462_Manage
# R-230463 RHEL-08-030560 # R-230463 RHEL-08-030560
- name: stigrule_230463__etc_audit_rules_d_audit_rules__usr_sbin_usermod - name : stigrule_230463__etc_audit_rules_d_audit_rules__usr_sbin_usermod
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod$' regexp: '^-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod$'
@@ -1119,7 +1149,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230463_Manage when: rhel8STIG_stigrule_230463_Manage
# R-230464 RHEL-08-030570 # R-230464 RHEL-08-030570
- name: stigrule_230464__etc_audit_rules_d_audit_rules__usr_bin_chacl - name : stigrule_230464__etc_audit_rules_d_audit_rules__usr_bin_chacl
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -1127,7 +1157,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230464_Manage when: rhel8STIG_stigrule_230464_Manage
# R-230465 RHEL-08-030580 # R-230465 RHEL-08-030580
- name: stigrule_230465__etc_audit_rules_d_audit_rules__usr_bin_kmod - name : stigrule_230465__etc_audit_rules_d_audit_rules__usr_bin_kmod
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules$' regexp: '^-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules$'
@@ -1135,7 +1165,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230465_Manage when: rhel8STIG_stigrule_230465_Manage
# R-230466 RHEL-08-030590 # R-230466 RHEL-08-030590
- name: stigrule_230466__etc_audit_rules_d_audit_rules__var_log_faillock - name : stigrule_230466__etc_audit_rules_d_audit_rules__var_log_faillock
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /var/log/faillock -p wa -k logins$' regexp: '^-w /var/log/faillock -p wa -k logins$'
@@ -1143,7 +1173,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel8STIG_stigrule_230466_Manage when: rhel8STIG_stigrule_230466_Manage
# R-230467 RHEL-08-030600 # R-230467 RHEL-08-030600
- name: stigrule_230467__etc_audit_rules_d_audit_rules__var_log_lastlog - name : stigrule_230467__etc_audit_rules_d_audit_rules__var_log_lastlog
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /var/log/lastlog -p wa -k logins$' regexp: '^-w /var/log/lastlog -p wa -k logins$'
@@ -1266,7 +1296,7 @@
when: rhel8STIG_stigrule_230505_Manage when: rhel8STIG_stigrule_230505_Manage
# R-230506 RHEL-08-040110 # R-230506 RHEL-08-040110
- name: check if wireless network adapters are disabled - name: check if wireless network adapters are disabled
shell: "[[ $(nmcli radio wifi) == 'enabled' ]]" shell: "[[ $(nmcli radio wifi) == 'enabled' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1307,33 +1337,13 @@
- rhel8STIG_stigrule_230527_Manage - rhel8STIG_stigrule_230527_Manage
- "'openssh-server' in packages" - "'openssh-server' in packages"
# R-230529 RHEL-08-040170 # R-230529 RHEL-08-040170
- name: check if ctrl-alt-del.target is installed - name: stigrule_230529_systemctl_mask_ctrl_alt_del_target
shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+" systemd:
changed_when: False
check_mode: no
register: result
failed_when: result.rc > 1
- name: stigrule_230529_ctrl_alt_del_target_disable
systemd_service:
name: ctrl-alt-del.target name: ctrl-alt-del.target
enabled: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_disable_Enabled }}" enabled: no
masked: yes
when: when:
- rhel8STIG_stigrule_230529_Manage - rhel8STIG_stigrule_230529_Manage
- result.rc == 0
# R-230529 RHEL-08-040170
- name: check if ctrl-alt-del.target is installed
shell: ! systemctl list-unit-files | grep "^ctrl-alt-del.target[ \t]\+"
changed_when: False
check_mode: no
register: result
failed_when: result.rc > 1
- name: stigrule_230529_ctrl_alt_del_target_mask
systemd_service:
name: ctrl-alt-del.target
masked: "{{ rhel8STIG_stigrule_230529_ctrl_alt_del_target_mask_Masked }}"
when:
- rhel8STIG_stigrule_230529_Manage
- result.rc == 0
# R-230531 RHEL-08-040172 # R-230531 RHEL-08-040172
- name: stigrule_230531__etc_systemd_system_conf - name: stigrule_230531__etc_systemd_system_conf
ini_file: ini_file:
@@ -1354,7 +1364,7 @@
when: rhel8STIG_stigrule_230533_Manage when: rhel8STIG_stigrule_230533_Manage
# R-230535 RHEL-08-040210 # R-230535 RHEL-08-040210
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1382,7 +1392,7 @@
- rhel8STIG_stigrule_230537_Manage - rhel8STIG_stigrule_230537_Manage
# R-230538 RHEL-08-040240 # R-230538 RHEL-08-040240
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1396,7 +1406,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-230539 RHEL-08-040250 # R-230539 RHEL-08-040250
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1417,7 +1427,7 @@
- rhel8STIG_stigrule_230540_Manage - rhel8STIG_stigrule_230540_Manage
# R-230540 RHEL-08-040260 # R-230540 RHEL-08-040260
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1431,7 +1441,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-230541 RHEL-08-040261 # R-230541 RHEL-08-040261
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1445,7 +1455,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-230542 RHEL-08-040262 # R-230542 RHEL-08-040262
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1466,7 +1476,7 @@
- rhel8STIG_stigrule_230543_Manage - rhel8STIG_stigrule_230543_Manage
# R-230544 RHEL-08-040280 # R-230544 RHEL-08-040280
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1613,16 +1623,6 @@
when: when:
- rhel8STIG_stigrule_244525_Manage - rhel8STIG_stigrule_244525_Manage
- "'openssh-server' in packages" - "'openssh-server' in packages"
# R-244526 RHEL-08-010287
- name: stigrule_244526__etc_sysconfig_sshd
lineinfile:
path: /etc/sysconfig/sshd
regexp: '^# CRYPTO_POLICY='
line: "{{ rhel8STIG_stigrule_244526__etc_sysconfig_sshd_Line }}"
create: yes
notify: do_reboot
when:
- rhel8STIG_stigrule_244526_Manage
# R-244527 RHEL-08-010472 # R-244527 RHEL-08-010472
- name: stigrule_244527_rng_tools - name: stigrule_244527_rng_tools
yum: yum:
@@ -1663,13 +1663,18 @@
when: when:
- rhel8STIG_stigrule_244536_Manage - rhel8STIG_stigrule_244536_Manage
- "'dconf' in packages" - "'dconf' in packages"
# R-244537 RHEL-08-020039
- name: stigrule_244537_tmux
yum:
name: tmux
state: "{{ rhel8STIG_stigrule_244537_tmux_State }}"
when: rhel8STIG_stigrule_244537_Manage
# R-244538 RHEL-08-020081 # R-244538 RHEL-08-020081
- name: stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay - name: stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay
lineinfile: lineinfile:
path: /etc/dconf/db/local.d/locks/session path: /etc/dconf/db/local.d/locks/session
line: "{{ rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line }}" line: "{{ rhel8STIG_stigrule_244538__etc_dconf_db_local_d_locks_session_idle_delay_Line }}"
create: yes create: yes
notify: dconf_update
when: when:
- rhel8STIG_stigrule_244538_Manage - rhel8STIG_stigrule_244538_Manage
# R-244539 RHEL-08-020082 # R-244539 RHEL-08-020082
@@ -1678,7 +1683,6 @@
path: /etc/dconf/db/local.d/locks/session path: /etc/dconf/db/local.d/locks/session
line: "{{ rhel8STIG_stigrule_244539__etc_dconf_db_local_d_locks_session_lock_enabled_Line }}" line: "{{ rhel8STIG_stigrule_244539__etc_dconf_db_local_d_locks_session_lock_enabled_Line }}"
create: yes create: yes
notify: dconf_update
when: when:
- rhel8STIG_stigrule_244539_Manage - rhel8STIG_stigrule_244539_Manage
# R-244542 RHEL-08-030181 # R-244542 RHEL-08-030181

45
collections/ansible_collections/demo/compliance/roles/rhel9STIG/defaults/main.yml
View File

@@ -159,7 +159,7 @@ rhel9STIG_stigrule_257834_Manage: True
rhel9STIG_stigrule_257834_tuned_State: removed rhel9STIG_stigrule_257834_tuned_State: removed
# R-257835 RHEL-09-215060 # R-257835 RHEL-09-215060
rhel9STIG_stigrule_257835_Manage: True rhel9STIG_stigrule_257835_Manage: True
rhel9STIG_stigrule_257835_tftp_server_State: removed rhel9STIG_stigrule_257835_tftp_State: removed
# R-257836 RHEL-09-215065 # R-257836 RHEL-09-215065
rhel9STIG_stigrule_257836_Manage: True rhel9STIG_stigrule_257836_Manage: True
rhel9STIG_stigrule_257836_quagga_State: removed rhel9STIG_stigrule_257836_quagga_State: removed
@@ -302,6 +302,10 @@ rhel9STIG_stigrule_257916__var_log_messages_owner_Owner: root
rhel9STIG_stigrule_257917_Manage: True rhel9STIG_stigrule_257917_Manage: True
rhel9STIG_stigrule_257917__var_log_messages_group_owner_Dest: /var/log/messages rhel9STIG_stigrule_257917__var_log_messages_group_owner_Dest: /var/log/messages
rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group: root rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group: root
# R-257933 RHEL-09-232265
rhel9STIG_stigrule_257933_Manage: True
rhel9STIG_stigrule_257933__etc_crontab_mode_Dest: /etc/crontab
rhel9STIG_stigrule_257933__etc_crontab_mode_Mode: '0600'
# R-257934 RHEL-09-232270 # R-257934 RHEL-09-232270
rhel9STIG_stigrule_257934_Manage: True rhel9STIG_stigrule_257934_Manage: True
rhel9STIG_stigrule_257934__etc_shadow_mode_Dest: /etc/shadow rhel9STIG_stigrule_257934__etc_shadow_mode_Dest: /etc/shadow
@@ -451,6 +455,9 @@ rhel9STIG_stigrule_257985_PermitRootLogin_Line: PermitRootLogin no
# R-257986 RHEL-09-255050 # R-257986 RHEL-09-255050
rhel9STIG_stigrule_257986_Manage: True rhel9STIG_stigrule_257986_Manage: True
rhel9STIG_stigrule_257986_UsePAM_Line: UsePAM yes rhel9STIG_stigrule_257986_UsePAM_Line: UsePAM yes
# R-257989 RHEL-09-255065
rhel9STIG_stigrule_257989_Manage: True
rhel9STIG_stigrule_257989__etc_crypto_policies_back_ends_openssh_config_Line: 'Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr'
# R-257992 RHEL-09-255080 # R-257992 RHEL-09-255080
rhel9STIG_stigrule_257992_Manage: True rhel9STIG_stigrule_257992_Manage: True
rhel9STIG_stigrule_257992_HostbasedAuthentication_Line: HostbasedAuthentication no rhel9STIG_stigrule_257992_HostbasedAuthentication_Line: HostbasedAuthentication no
@@ -502,6 +509,9 @@ rhel9STIG_stigrule_258008_StrictModes_Line: StrictModes yes
# R-258009 RHEL-09-255165 # R-258009 RHEL-09-255165
rhel9STIG_stigrule_258009_Manage: True rhel9STIG_stigrule_258009_Manage: True
rhel9STIG_stigrule_258009_PrintLastLog_Line: PrintLastLog yes rhel9STIG_stigrule_258009_PrintLastLog_Line: PrintLastLog yes
# R-258010 RHEL-09-255170
rhel9STIG_stigrule_258010_Manage: True
rhel9STIG_stigrule_258010_UsePrivilegeSeparation_Line: UsePrivilegeSeparation sandbox
# R-258011 RHEL-09-255175 # R-258011 RHEL-09-255175
rhel9STIG_stigrule_258011_Manage: True rhel9STIG_stigrule_258011_Manage: True
rhel9STIG_stigrule_258011_X11UseLocalhost_Line: X11UseLocalhost yes rhel9STIG_stigrule_258011_X11UseLocalhost_Line: X11UseLocalhost yes
@@ -550,9 +560,10 @@ rhel9STIG_stigrule_258026__etc_dconf_db_local_d_locks_session_lock_delay_Line: '
# R-258027 RHEL-09-271085 # R-258027 RHEL-09-271085
rhel9STIG_stigrule_258027_Manage: True rhel9STIG_stigrule_258027_Manage: True
rhel9STIG_stigrule_258027__etc_dconf_db_local_d_00_security_settings_Value: "''" rhel9STIG_stigrule_258027__etc_dconf_db_local_d_00_security_settings_Value: "''"
# R-258027 RHEL-09-271085
rhel9STIG_stigrule_258027_Manage: True
rhel9STIG_stigrule_258027__etc_dconf_db_local_d_locks_00_security_settings_lock_picture_uri_Line: '/org/gnome/desktop/screensaver/picture-uri' rhel9STIG_stigrule_258027__etc_dconf_db_local_d_locks_00_security_settings_lock_picture_uri_Line: '/org/gnome/desktop/screensaver/picture-uri'
# R-258029 RHEL-09-271095
rhel9STIG_stigrule_258029_Manage: True
rhel9STIG_stigrule_258029__etc_dconf_db_local_d_00_security_settings_Value: "'true'"
# R-258030 RHEL-09-271100 # R-258030 RHEL-09-271100
rhel9STIG_stigrule_258030_Manage: True rhel9STIG_stigrule_258030_Manage: True
rhel9STIG_stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons_Line: '/org/gnome/login-screen/disable-restart-buttons' rhel9STIG_stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons_Line: '/org/gnome/login-screen/disable-restart-buttons'
@@ -572,8 +583,6 @@ rhel9STIG_stigrule_258034__etc_modprobe_d_usb_storage_conf_blacklist_usb_storage
# R-258035 RHEL-09-291015 # R-258035 RHEL-09-291015
rhel9STIG_stigrule_258035_Manage: True rhel9STIG_stigrule_258035_Manage: True
rhel9STIG_stigrule_258035_usbguard_State: installed rhel9STIG_stigrule_258035_usbguard_State: installed
rhel9STIG_stigrule_258035_usbguard_enable_Enabled: yes
rhel9STIG_stigrule_258035_usbguard_start_State: started
# R-258036 RHEL-09-291020 # R-258036 RHEL-09-291020
rhel9STIG_stigrule_258036_Manage: True rhel9STIG_stigrule_258036_Manage: True
rhel9STIG_stigrule_258036_usbguard_enable_Enabled: yes rhel9STIG_stigrule_258036_usbguard_enable_Enabled: yes
@@ -612,6 +621,12 @@ rhel9STIG_stigrule_258057__etc_security_faillock_conf_Line: 'unlock_time = 0'
# R-258060 RHEL-09-411105 # R-258060 RHEL-09-411105
rhel9STIG_stigrule_258060_Manage: True rhel9STIG_stigrule_258060_Manage: True
rhel9STIG_stigrule_258060__etc_security_faillock_conf_Line: 'dir = /var/log/faillock' rhel9STIG_stigrule_258060__etc_security_faillock_conf_Line: 'dir = /var/log/faillock'
# R-258063 RHEL-09-412010
rhel9STIG_stigrule_258063_Manage: True
rhel9STIG_stigrule_258063_tmux_State: installed
# R-258066 RHEL-09-412025
rhel9STIG_stigrule_258066_Manage: True
rhel9STIG_stigrule_258066__etc_tmux_conf_Line: 'set -g lock-after-time 900'
# R-258069 RHEL-09-412040 # R-258069 RHEL-09-412040
rhel9STIG_stigrule_258069_Manage: True rhel9STIG_stigrule_258069_Manage: True
rhel9STIG_stigrule_258069__etc_security_limits_conf_Line: '* hard maxlogins 10' rhel9STIG_stigrule_258069__etc_security_limits_conf_Line: '* hard maxlogins 10'
@@ -673,6 +688,9 @@ rhel9STIG_stigrule_258104__etc_login_defs_Line: 'PASS_MIN_DAYS 1'
# R-258107 RHEL-09-611090 # R-258107 RHEL-09-611090
rhel9STIG_stigrule_258107_Manage: True rhel9STIG_stigrule_258107_Manage: True
rhel9STIG_stigrule_258107__etc_security_pwquality_conf_Line: 'minlen = 15' rhel9STIG_stigrule_258107__etc_security_pwquality_conf_Line: 'minlen = 15'
# R-258108 RHEL-09-611095
rhel9STIG_stigrule_258108_Manage: True
rhel9STIG_stigrule_258108__etc_login_defs_Line: 'PASS_MIN_LEN 15'
# R-258109 RHEL-09-611100 # R-258109 RHEL-09-611100
rhel9STIG_stigrule_258109_Manage: True rhel9STIG_stigrule_258109_Manage: True
rhel9STIG_stigrule_258109__etc_security_pwquality_conf_Line: 'ocredit = -1' rhel9STIG_stigrule_258109__etc_security_pwquality_conf_Line: 'ocredit = -1'
@@ -700,6 +718,9 @@ rhel9STIG_stigrule_258116__etc_libuser_conf_Value: 'sha512'
# R-258117 RHEL-09-611140 # R-258117 RHEL-09-611140
rhel9STIG_stigrule_258117_Manage: True rhel9STIG_stigrule_258117_Manage: True
rhel9STIG_stigrule_258117__etc_login_defs_Line: 'ENCRYPT_METHOD SHA512' rhel9STIG_stigrule_258117__etc_login_defs_Line: 'ENCRYPT_METHOD SHA512'
# R-258119 RHEL-09-611150
rhel9STIG_stigrule_258119_Manage: True
rhel9STIG_stigrule_258119__etc_login_defs_Line: 'SHA_CRYPT_MIN_ROUNDS 5000'
# R-258121 RHEL-09-611160 # R-258121 RHEL-09-611160
rhel9STIG_stigrule_258121_Manage: True rhel9STIG_stigrule_258121_Manage: True
rhel9STIG_stigrule_258121__etc_opensc_conf_Line: 'card_drivers = cac;' rhel9STIG_stigrule_258121__etc_opensc_conf_Line: 'card_drivers = cac;'
@@ -738,6 +759,9 @@ rhel9STIG_stigrule_258142_rsyslog_start_State: started
# R-258144 RHEL-09-652030 # R-258144 RHEL-09-652030
rhel9STIG_stigrule_258144_Manage: True rhel9STIG_stigrule_258144_Manage: True
rhel9STIG_stigrule_258144__etc_rsyslog_conf_Line: 'auth.*;authpriv.*;daemon.* /var/log/secure' rhel9STIG_stigrule_258144__etc_rsyslog_conf_Line: 'auth.*;authpriv.*;daemon.* /var/log/secure'
# R-258145 RHEL-09-652035
rhel9STIG_stigrule_258145_Manage: True
rhel9STIG_stigrule_258145__etc_audit_plugins_d_syslog_conf_Line: 'active = yes'
# R-258146 RHEL-09-652040 # R-258146 RHEL-09-652040
rhel9STIG_stigrule_258146_Manage: True rhel9STIG_stigrule_258146_Manage: True
rhel9STIG_stigrule_258146__etc_rsyslog_conf_Line: '$ActionSendStreamDriverAuthMode x509/name' rhel9STIG_stigrule_258146__etc_rsyslog_conf_Line: '$ActionSendStreamDriverAuthMode x509/name'
@@ -976,9 +1000,12 @@ rhel9STIG_stigrule_258228__etc_audit_rules_d_audit_rules_loginuid_immutable_Line
# R-258229 RHEL-09-654275 # R-258229 RHEL-09-654275
rhel9STIG_stigrule_258229_Manage: True rhel9STIG_stigrule_258229_Manage: True
rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line: '-e 2' rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line: '-e 2'
# R-258234 RHEL-09-215100 # R-258234 RHEL-09-672010
rhel9STIG_stigrule_258234_Manage: True rhel9STIG_stigrule_258234_Manage: True
rhel9STIG_stigrule_258234_crypto_policies_State: installed rhel9STIG_stigrule_258234_crypto_policies_State: installed
# R-272488 RHEL-09-215101 # R-258239 RHEL-09-672035
rhel9STIG_stigrule_272488_Manage: True rhel9STIG_stigrule_258239_Manage: True
rhel9STIG_stigrule_272488_postfix_State: installed rhel9STIG_stigrule_258239__etc_pki_tls_openssl_cnf_Line: '.include = /etc/crypto-policies/back-ends/opensslcnf.config'
# R-258240 RHEL-09-672040
rhel9STIG_stigrule_258240_Manage: True
rhel9STIG_stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config_Line: 'TLS.MinProtocol = TLSv1.2'

3772
collections/ansible_collections/demo/compliance/roles/rhel9STIG/files/U_RHEL_9_STIG_V2R4_Manual-xccdf.xml → collections/ansible_collections/demo/compliance/roles/rhel9STIG/files/U_RHEL_9_STIG_V1R2_Manual-xccdf.xml
View File

File diff suppressed because one or more lines are too long

299
collections/ansible_collections/demo/compliance/roles/rhel9STIG/tasks/main.yml
View File

@@ -56,7 +56,7 @@
- name: stigrule_257785_ctrl_alt_del_target_disable - name: stigrule_257785_ctrl_alt_del_target_disable
systemd_service: systemd_service:
name: ctrl-alt-del.target name: ctrl-alt-del.target
enabled: "{{ rhel9STIG_stigrule_257785_ctrl_alt_del_target_disable_Enabled }}" enabled : "{{ rhel9STIG_stigrule_257785_ctrl_alt_del_target_disable_Enabled }}"
when: when:
- rhel9STIG_stigrule_257785_Manage - rhel9STIG_stigrule_257785_Manage
- result.rc == 0 - result.rc == 0
@@ -84,7 +84,7 @@
- name: stigrule_257786_debug_shell_service_disable - name: stigrule_257786_debug_shell_service_disable
systemd_service: systemd_service:
name: debug-shell.service name: debug-shell.service
enabled: "{{ rhel9STIG_stigrule_257786_debug_shell_service_disable_Enabled }}" enabled : "{{ rhel9STIG_stigrule_257786_debug_shell_service_disable_Enabled }}"
when: when:
- rhel9STIG_stigrule_257786_Manage - rhel9STIG_stigrule_257786_Manage
- result.rc == 0 - result.rc == 0
@@ -333,7 +333,7 @@
- name: stigrule_257815_systemd_coredump_socket_disable - name: stigrule_257815_systemd_coredump_socket_disable
systemd_service: systemd_service:
name: systemd-coredump.socket name: systemd-coredump.socket
enabled: "{{ rhel9STIG_stigrule_257815_systemd_coredump_socket_disable_Enabled }}" enabled : "{{ rhel9STIG_stigrule_257815_systemd_coredump_socket_disable_Enabled }}"
when: when:
- rhel9STIG_stigrule_257815_Manage - rhel9STIG_stigrule_257815_Manage
- result.rc == 0 - result.rc == 0
@@ -371,7 +371,7 @@
- name: stigrule_257818_kdump_disable - name: stigrule_257818_kdump_disable
systemd_service: systemd_service:
name: kdump.service name: kdump.service
enabled: "{{ rhel9STIG_stigrule_257818_kdump_disable_Enabled }}" enabled : "{{ rhel9STIG_stigrule_257818_kdump_disable_Enabled }}"
when: when:
- rhel9STIG_stigrule_257818_Manage - rhel9STIG_stigrule_257818_Manage
- result.rc == 0 - result.rc == 0
@@ -474,10 +474,10 @@
state: "{{ rhel9STIG_stigrule_257834_tuned_State }}" state: "{{ rhel9STIG_stigrule_257834_tuned_State }}"
when: rhel9STIG_stigrule_257834_Manage when: rhel9STIG_stigrule_257834_Manage
# R-257835 RHEL-09-215060 # R-257835 RHEL-09-215060
- name: stigrule_257835_tftp_server - name: stigrule_257835_tftp
yum: yum:
name: tftp-server name: tftp
state: "{{ rhel9STIG_stigrule_257835_tftp_server_State }}" state: "{{ rhel9STIG_stigrule_257835_tftp_State }}"
when: rhel9STIG_stigrule_257835_Manage when: rhel9STIG_stigrule_257835_Manage
# R-257836 RHEL-09-215065 # R-257836 RHEL-09-215065
- name: stigrule_257836_quagga - name: stigrule_257836_quagga
@@ -525,7 +525,7 @@
- name: stigrule_257849_autofs_service_disable - name: stigrule_257849_autofs_service_disable
systemd_service: systemd_service:
name: autofs.service name: autofs.service
enabled: "{{ rhel9STIG_stigrule_257849_autofs_service_disable_Enabled }}" enabled : "{{ rhel9STIG_stigrule_257849_autofs_service_disable_Enabled }}"
when: when:
- rhel9STIG_stigrule_257849_Manage - rhel9STIG_stigrule_257849_Manage
- result.rc == 0 - result.rc == 0
@@ -764,6 +764,13 @@
group: "{{ rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group }}" group: "{{ rhel9STIG_stigrule_257917__var_log_messages_group_owner_Group }}"
when: when:
- rhel9STIG_stigrule_257917_Manage - rhel9STIG_stigrule_257917_Manage
# R-257933 RHEL-09-232265
- name: stigrule_257933__etc_crontab_mode
file:
dest: "{{ rhel9STIG_stigrule_257933__etc_crontab_mode_Dest }}"
mode: "{{ rhel9STIG_stigrule_257933__etc_crontab_mode_Mode }}"
when:
- rhel9STIG_stigrule_257933_Manage
# R-257934 RHEL-09-232270 # R-257934 RHEL-09-232270
- name: stigrule_257934__etc_shadow_mode - name: stigrule_257934__etc_shadow_mode
file: file:
@@ -1020,7 +1027,7 @@
- rhel9STIG_stigrule_257970_Manage - rhel9STIG_stigrule_257970_Manage
# R-257971 RHEL-09-254010 # R-257971 RHEL-09-254010
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1036,7 +1043,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257972 RHEL-09-254015 # R-257972 RHEL-09-254015
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1052,7 +1059,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257973 RHEL-09-254020 # R-257973 RHEL-09-254020
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1068,7 +1075,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257974 RHEL-09-254025 # R-257974 RHEL-09-254025
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1084,7 +1091,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257975 RHEL-09-254030 # R-257975 RHEL-09-254030
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1100,7 +1107,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257976 RHEL-09-254035 # R-257976 RHEL-09-254035
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1116,7 +1123,7 @@
- cmd_result.rc == 0 - cmd_result.rc == 0
# R-257977 RHEL-09-254040 # R-257977 RHEL-09-254040
- name: check if ipv6 is enabled - name: check if ipv6 is enabled
shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]" shell: "[[ $(cat /sys/module/ipv6/parameters/disable) == '0' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1230,6 +1237,16 @@
when: when:
- rhel9STIG_stigrule_257986_Manage - rhel9STIG_stigrule_257986_Manage
- "'openssh-server' in packages" - "'openssh-server' in packages"
# R-257989 RHEL-09-255065
- name: stigrule_257989__etc_crypto_policies_back_ends_openssh_config
lineinfile:
path: /etc/crypto-policies/back-ends/openssh.config
regexp: '^\s*Ciphers\s+\S+\s*$'
line: "{{ rhel9STIG_stigrule_257989__etc_crypto_policies_back_ends_openssh_config_Line }}"
create: yes
notify: do_reboot
when:
- rhel9STIG_stigrule_257989_Manage
# R-257992 RHEL-09-255080 # R-257992 RHEL-09-255080
- name: stigrule_257992_HostbasedAuthentication - name: stigrule_257992_HostbasedAuthentication
lineinfile: lineinfile:
@@ -1381,6 +1398,16 @@
when: when:
- rhel9STIG_stigrule_258009_Manage - rhel9STIG_stigrule_258009_Manage
- "'openssh-server' in packages" - "'openssh-server' in packages"
# R-258010 RHEL-09-255170
- name: stigrule_258010_UsePrivilegeSeparation
lineinfile:
path: /etc/ssh/sshd_config
regexp: '(?i)^\s*UsePrivilegeSeparation\s+'
line: "{{ rhel9STIG_stigrule_258010_UsePrivilegeSeparation_Line }}"
notify: ssh_restart
when:
- rhel9STIG_stigrule_258010_Manage
- "'openssh-server' in packages"
# R-258011 RHEL-09-255175 # R-258011 RHEL-09-255175
- name: stigrule_258011_X11UseLocalhost - name: stigrule_258011_X11UseLocalhost
lineinfile: lineinfile:
@@ -1567,6 +1594,18 @@
when: when:
- rhel9STIG_stigrule_258027_Manage - rhel9STIG_stigrule_258027_Manage
- "'dconf' in packages" - "'dconf' in packages"
# R-258029 RHEL-09-271095
- name: stigrule_258029__etc_dconf_db_local_d_00_security_settings
ini_file:
path: /etc/dconf/db/local.d/00-security-settings
section: org/gnome/login-screen
option: disable-restart-buttons
value: "{{ rhel9STIG_stigrule_258029__etc_dconf_db_local_d_00_security_settings_Value }}"
no_extra_spaces: yes
notify: dconf_update
when:
- rhel9STIG_stigrule_258029_Manage
- "'dconf' in packages"
# R-258030 RHEL-09-271100 # R-258030 RHEL-09-271100
- name: stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons - name: stigrule_258030__etc_dconf_db_local_d_locks_session_disable_restart_buttons
lineinfile: lineinfile:
@@ -1635,34 +1674,6 @@
name: usbguard name: usbguard
state: "{{ rhel9STIG_stigrule_258035_usbguard_State }}" state: "{{ rhel9STIG_stigrule_258035_usbguard_State }}"
when: rhel9STIG_stigrule_258035_Manage when: rhel9STIG_stigrule_258035_Manage
# R-258035 RHEL-09-291015
- name: check if usbguard.service is installed
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
changed_when: False
check_mode: no
register: result
failed_when: result.rc > 1
- name: stigrule_258035_usbguard_enable
service:
name: usbguard.service
enabled: "{{ rhel9STIG_stigrule_258035_usbguard_enable_Enabled }}"
when:
- rhel9STIG_stigrule_258035_Manage
- result.rc == 0
# R-258035 RHEL-09-291015
- name: check if usbguard.service is installed
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
changed_when: False
check_mode: no
register: result
failed_when: result.rc > 1
- name: stigrule_258035_usbguard_start
service:
name: usbguard.service
state: "{{ rhel9STIG_stigrule_258035_usbguard_start_State }}"
when:
- rhel9STIG_stigrule_258035_Manage
- result.rc == 0
# R-258036 RHEL-09-291020 # R-258036 RHEL-09-291020
- name: check if usbguard.service is installed - name: check if usbguard.service is installed
shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+" shell: ! systemctl list-unit-files | grep "^usbguard.service[ \t]\+"
@@ -1720,7 +1731,7 @@
- rhel9STIG_stigrule_258039_Manage - rhel9STIG_stigrule_258039_Manage
# R-258040 RHEL-09-291040 # R-258040 RHEL-09-291040
- name: check if wireless network adapters are disabled - name: check if wireless network adapters are disabled
shell: "[[ $(nmcli radio wifi) == 'enabled' ]]" shell: "[[ $(nmcli radio wifi) == 'enabled' ]]"
changed_when: False changed_when: False
check_mode: no check_mode: no
register: cmd_result register: cmd_result
@@ -1810,6 +1821,20 @@
notify: with_faillock_enable notify: with_faillock_enable
when: when:
- rhel9STIG_stigrule_258060_Manage - rhel9STIG_stigrule_258060_Manage
# R-258063 RHEL-09-412010
- name: stigrule_258063_tmux
yum:
name: tmux
state: "{{ rhel9STIG_stigrule_258063_tmux_State }}"
when: rhel9STIG_stigrule_258063_Manage
# R-258066 RHEL-09-412025
- name: stigrule_258066__etc_tmux_conf
lineinfile:
path: /etc/tmux.conf
line: "{{ rhel9STIG_stigrule_258066__etc_tmux_conf_Line }}"
create: yes
when:
- rhel9STIG_stigrule_258066_Manage
# R-258069 RHEL-09-412040 # R-258069 RHEL-09-412040
- name: stigrule_258069__etc_security_limits_conf - name: stigrule_258069__etc_security_limits_conf
lineinfile: lineinfile:
@@ -2000,6 +2025,15 @@
create: yes create: yes
when: when:
- rhel9STIG_stigrule_258107_Manage - rhel9STIG_stigrule_258107_Manage
# R-258108 RHEL-09-611095
- name: stigrule_258108__etc_login_defs
lineinfile:
path: /etc/login.defs
regexp: '^PASS_MIN_LEN'
line: "{{ rhel9STIG_stigrule_258108__etc_login_defs_Line }}"
create: yes
when:
- rhel9STIG_stigrule_258108_Manage
# R-258109 RHEL-09-611100 # R-258109 RHEL-09-611100
- name: stigrule_258109__etc_security_pwquality_conf - name: stigrule_258109__etc_security_pwquality_conf
lineinfile: lineinfile:
@@ -2082,6 +2116,15 @@
create: yes create: yes
when: when:
- rhel9STIG_stigrule_258117_Manage - rhel9STIG_stigrule_258117_Manage
# R-258119 RHEL-09-611150
- name: stigrule_258119__etc_login_defs
lineinfile:
path: /etc/login.defs
regexp: '^SHA_CRYPT_MIN_ROUNDS'
line: "{{ rhel9STIG_stigrule_258119__etc_login_defs_Line }}"
create: yes
when:
- rhel9STIG_stigrule_258119_Manage
# R-258121 RHEL-09-611160 # R-258121 RHEL-09-611160
- name: stigrule_258121__etc_opensc_conf - name: stigrule_258121__etc_opensc_conf
lineinfile: lineinfile:
@@ -2221,6 +2264,16 @@
notify: rsyslog_restart notify: rsyslog_restart
when: when:
- rhel9STIG_stigrule_258144_Manage - rhel9STIG_stigrule_258144_Manage
# R-258145 RHEL-09-652035
- name: stigrule_258145__etc_audit_plugins_d_syslog_conf
lineinfile:
path: /etc/audit/plugins.d/syslog.conf
regexp: '^\s*active\s*='
line: "{{ rhel9STIG_stigrule_258145__etc_audit_plugins_d_syslog_conf_Line }}"
create: yes
notify: auditd_restart
when:
- rhel9STIG_stigrule_258145_Manage
# R-258146 RHEL-09-652040 # R-258146 RHEL-09-652040
- name: stigrule_258146__etc_rsyslog_conf - name: stigrule_258146__etc_rsyslog_conf
lineinfile: lineinfile:
@@ -2449,7 +2502,7 @@
state: "{{ rhel9STIG_stigrule_258175_audispd_plugins_State }}" state: "{{ rhel9STIG_stigrule_258175_audispd_plugins_State }}"
when: rhel9STIG_stigrule_258175_Manage when: rhel9STIG_stigrule_258175_Manage
# R-258176 RHEL-09-654010 # R-258176 RHEL-09-654010
- name: stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b32 - name : stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -2457,7 +2510,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258176_Manage when: rhel9STIG_stigrule_258176_Manage
# R-258176 RHEL-09-654010 # R-258176 RHEL-09-654010
- name: stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b64 - name : stigrule_258176__etc_audit_rules_d_audit_rules_execve_euid_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv$'
@@ -2465,7 +2518,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258176_Manage when: rhel9STIG_stigrule_258176_Manage
# R-258176 RHEL-09-654010 # R-258176 RHEL-09-654010
- name: stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b32 - name : stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -2473,7 +2526,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258176_Manage when: rhel9STIG_stigrule_258176_Manage
# R-258176 RHEL-09-654010 # R-258176 RHEL-09-654010
- name: stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b64 - name : stigrule_258176__etc_audit_rules_d_audit_rules_execve_egid_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv$' regexp: '^-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv$'
@@ -2481,7 +2534,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258176_Manage when: rhel9STIG_stigrule_258176_Manage
# R-258177 RHEL-09-654015 # R-258177 RHEL-09-654015
- name: stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b32 - name : stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2489,7 +2542,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258177_Manage when: rhel9STIG_stigrule_258177_Manage
# R-258177 RHEL-09-654015 # R-258177 RHEL-09-654015
- name: stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b64 - name : stigrule_258177__etc_audit_rules_d_audit_rules_chmod_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2497,7 +2550,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258177_Manage when: rhel9STIG_stigrule_258177_Manage
# R-258178 RHEL-09-654020 # R-258178 RHEL-09-654020
- name: stigrule_258178__etc_audit_rules_d_audit_rules_chown_b32 - name : stigrule_258178__etc_audit_rules_d_audit_rules_chown_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2505,7 +2558,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258178_Manage when: rhel9STIG_stigrule_258178_Manage
# R-258178 RHEL-09-654020 # R-258178 RHEL-09-654020
- name: stigrule_258178__etc_audit_rules_d_audit_rules_chown_b64 - name : stigrule_258178__etc_audit_rules_d_audit_rules_chown_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2513,7 +2566,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258178_Manage when: rhel9STIG_stigrule_258178_Manage
# R-258179 RHEL-09-654025 # R-258179 RHEL-09-654025
- name: stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset - name : stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32_unset
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2521,7 +2574,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258179_Manage when: rhel9STIG_stigrule_258179_Manage
# R-258179 RHEL-09-654025 # R-258179 RHEL-09-654025
- name: stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset - name : stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64_unset
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2529,7 +2582,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258179_Manage when: rhel9STIG_stigrule_258179_Manage
# R-258179 RHEL-09-654025 # R-258179 RHEL-09-654025
- name: stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32 - name : stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$' regexp: '^-a always,exit -F arch=b32 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -2537,7 +2590,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258179_Manage when: rhel9STIG_stigrule_258179_Manage
# R-258179 RHEL-09-654025 # R-258179 RHEL-09-654025
- name: stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64 - name : stigrule_258179__etc_audit_rules_d_audit_rules_lremovexattr_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$' regexp: '^-a always,exit -F arch=b64 -S setxattr,fsetxattr,lsetxattr,removexattr,fremovexattr,lremovexattr -F auid=0 -k perm_mod$'
@@ -2545,7 +2598,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258179_Manage when: rhel9STIG_stigrule_258179_Manage
# R-258180 RHEL-09-654030 # R-258180 RHEL-09-654030
- name: stigrule_258180__etc_audit_rules_d_audit_rules__usr_bin_umount - name : stigrule_258180__etc_audit_rules_d_audit_rules__usr_bin_umount
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F path=/usr/bin/umount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -2553,7 +2606,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258180_Manage when: rhel9STIG_stigrule_258180_Manage
# R-258181 RHEL-09-654035 # R-258181 RHEL-09-654035
- name: stigrule_258181__etc_audit_rules_d_audit_rules__usr_bin_chacl - name : stigrule_258181__etc_audit_rules_d_audit_rules__usr_bin_chacl
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2561,7 +2614,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258181_Manage when: rhel9STIG_stigrule_258181_Manage
# R-258182 RHEL-09-654040 # R-258182 RHEL-09-654040
- name: stigrule_258182__etc_audit_rules_d_audit_rules__usr_bin_setfacl - name : stigrule_258182__etc_audit_rules_d_audit_rules__usr_bin_setfacl
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2569,7 +2622,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258182_Manage when: rhel9STIG_stigrule_258182_Manage
# R-258183 RHEL-09-654045 # R-258183 RHEL-09-654045
- name: stigrule_258183__etc_audit_rules_d_audit_rules__usr_bin_chcon - name : stigrule_258183__etc_audit_rules_d_audit_rules__usr_bin_chcon
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$' regexp: '^-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -k perm_mod$'
@@ -2577,7 +2630,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258183_Manage when: rhel9STIG_stigrule_258183_Manage
# R-258184 RHEL-09-654050 # R-258184 RHEL-09-654050
- name: stigrule_258184__etc_audit_rules_d_audit_rules__usr_sbin_semanage - name : stigrule_258184__etc_audit_rules_d_audit_rules__usr_sbin_semanage
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2585,7 +2638,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258184_Manage when: rhel9STIG_stigrule_258184_Manage
# R-258185 RHEL-09-654055 # R-258185 RHEL-09-654055
- name: stigrule_258185__etc_audit_rules_d_audit_rules__usr_sbin_setfiles - name : stigrule_258185__etc_audit_rules_d_audit_rules__usr_sbin_setfiles
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2593,7 +2646,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258185_Manage when: rhel9STIG_stigrule_258185_Manage
# R-258186 RHEL-09-654060 # R-258186 RHEL-09-654060
- name: stigrule_258186__etc_audit_rules_d_audit_rules__usr_sbin_setsebool - name : stigrule_258186__etc_audit_rules_d_audit_rules__usr_sbin_setsebool
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged$' regexp: '^-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged$'
@@ -2601,7 +2654,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258186_Manage when: rhel9STIG_stigrule_258186_Manage
# R-258187 RHEL-09-654065 # R-258187 RHEL-09-654065
- name: stigrule_258187__etc_audit_rules_d_audit_rules_rename_b32 - name : stigrule_258187__etc_audit_rules_d_audit_rules_rename_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$' regexp: '^-a always,exit -F arch=b32 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
@@ -2609,7 +2662,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258187_Manage when: rhel9STIG_stigrule_258187_Manage
# R-258187 RHEL-09-654065 # R-258187 RHEL-09-654065
- name: stigrule_258187__etc_audit_rules_d_audit_rules_rename_b64 - name : stigrule_258187__etc_audit_rules_d_audit_rules_rename_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$' regexp: '^-a always,exit -F arch=b64 -S rename,unlink,rmdir,renameat,unlinkat -F auid>=1000 -F auid!=unset -k delete$'
@@ -2617,7 +2670,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258187_Manage when: rhel9STIG_stigrule_258187_Manage
# R-258188 RHEL-09-654070 # R-258188 RHEL-09-654070
- name: stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b32 - name : stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -2625,7 +2678,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258188_Manage when: rhel9STIG_stigrule_258188_Manage
# R-258188 RHEL-09-654070 # R-258188 RHEL-09-654070
- name: stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b64 - name : stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EPERM_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -2633,7 +2686,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258188_Manage when: rhel9STIG_stigrule_258188_Manage
# R-258188 RHEL-09-654070 # R-258188 RHEL-09-654070
- name: stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b32 - name : stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b32 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -2641,7 +2694,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258188_Manage when: rhel9STIG_stigrule_258188_Manage
# R-258188 RHEL-09-654070 # R-258188 RHEL-09-654070
- name: stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b64 - name : stigrule_258188__etc_audit_rules_d_audit_rules_truncate_EACCES_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$' regexp: '^-a always,exit -F arch=b64 -S truncate,ftruncate,creat,open,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -k perm_access$'
@@ -2649,7 +2702,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258188_Manage when: rhel9STIG_stigrule_258188_Manage
# R-258189 RHEL-09-654075 # R-258189 RHEL-09-654075
- name: stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b32 - name : stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b32 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -2657,7 +2710,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258189_Manage when: rhel9STIG_stigrule_258189_Manage
# R-258189 RHEL-09-654075 # R-258189 RHEL-09-654075
- name: stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b64 - name : stigrule_258189__etc_audit_rules_d_audit_rules_delete_module_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b64 -S delete_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -2665,7 +2718,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258189_Manage when: rhel9STIG_stigrule_258189_Manage
# R-258190 RHEL-09-654080 # R-258190 RHEL-09-654080
- name: stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b32 - name : stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b32
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b32 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -2673,7 +2726,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258190_Manage when: rhel9STIG_stigrule_258190_Manage
# R-258190 RHEL-09-654080 # R-258190 RHEL-09-654080
- name: stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b64 - name : stigrule_258190__etc_audit_rules_d_audit_rules_init_module_b64
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$' regexp: '^-a always,exit -F arch=b64 -S init_module,finit_module -F auid>=1000 -F auid!=unset -k module_chng$'
@@ -2681,7 +2734,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258190_Manage when: rhel9STIG_stigrule_258190_Manage
# R-258191 RHEL-09-654085 # R-258191 RHEL-09-654085
- name: stigrule_258191__etc_audit_rules_d_audit_rules__usr_bin_chage - name : stigrule_258191__etc_audit_rules_d_audit_rules__usr_bin_chage
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage$' regexp: '^-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=unset -k privileged-chage$'
@@ -2689,7 +2742,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258191_Manage when: rhel9STIG_stigrule_258191_Manage
# R-258192 RHEL-09-654090 # R-258192 RHEL-09-654090
- name: stigrule_258192__etc_audit_rules_d_audit_rules__usr_bin_chsh - name : stigrule_258192__etc_audit_rules_d_audit_rules__usr_bin_chsh
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -2697,7 +2750,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258192_Manage when: rhel9STIG_stigrule_258192_Manage
# R-258193 RHEL-09-654095 # R-258193 RHEL-09-654095
- name: stigrule_258193__etc_audit_rules_d_audit_rules__usr_bin_crontab - name : stigrule_258193__etc_audit_rules_d_audit_rules__usr_bin_crontab
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab$' regexp: '^-a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=1000 -F auid!=unset -k privileged-crontab$'
@@ -2705,7 +2758,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258193_Manage when: rhel9STIG_stigrule_258193_Manage
# R-258194 RHEL-09-654100 # R-258194 RHEL-09-654100
- name: stigrule_258194__etc_audit_rules_d_audit_rules__usr_bin_gpasswd - name : stigrule_258194__etc_audit_rules_d_audit_rules__usr_bin_gpasswd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd$' regexp: '^-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-gpasswd$'
@@ -2713,7 +2766,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258194_Manage when: rhel9STIG_stigrule_258194_Manage
# R-258195 RHEL-09-654105 # R-258195 RHEL-09-654105
- name: stigrule_258195__etc_audit_rules_d_audit_rules__usr_bin_kmod - name : stigrule_258195__etc_audit_rules_d_audit_rules__usr_bin_kmod
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules$' regexp: '^-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -k modules$'
@@ -2721,7 +2774,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258195_Manage when: rhel9STIG_stigrule_258195_Manage
# R-258196 RHEL-09-654110 # R-258196 RHEL-09-654110
- name: stigrule_258196__etc_audit_rules_d_audit_rules__usr_bin_newgrp - name : stigrule_258196__etc_audit_rules_d_audit_rules__usr_bin_newgrp
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -2729,7 +2782,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258196_Manage when: rhel9STIG_stigrule_258196_Manage
# R-258197 RHEL-09-654115 # R-258197 RHEL-09-654115
- name: stigrule_258197__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check - name : stigrule_258197__etc_audit_rules_d_audit_rules__usr_sbin_pam_timestamp_check
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check$' regexp: '^-a always,exit -F path=/usr/sbin/pam_timestamp_check -F perm=x -F auid>=1000 -F auid!=unset -k privileged-pam_timestamp_check$'
@@ -2737,7 +2790,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258197_Manage when: rhel9STIG_stigrule_258197_Manage
# R-258198 RHEL-09-654120 # R-258198 RHEL-09-654120
- name: stigrule_258198__etc_audit_rules_d_audit_rules__usr_bin_passwd - name : stigrule_258198__etc_audit_rules_d_audit_rules__usr_bin_passwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd$' regexp: '^-a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-passwd$'
@@ -2745,7 +2798,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258198_Manage when: rhel9STIG_stigrule_258198_Manage
# R-258199 RHEL-09-654125 # R-258199 RHEL-09-654125
- name: stigrule_258199__etc_audit_rules_d_audit_rules__usr_sbin_postdrop - name : stigrule_258199__etc_audit_rules_d_audit_rules__usr_sbin_postdrop
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2753,7 +2806,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258199_Manage when: rhel9STIG_stigrule_258199_Manage
# R-258200 RHEL-09-654130 # R-258200 RHEL-09-654130
- name: stigrule_258200__etc_audit_rules_d_audit_rules__usr_sbin_postqueue - name : stigrule_258200__etc_audit_rules_d_audit_rules__usr_sbin_postqueue
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2761,7 +2814,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258200_Manage when: rhel9STIG_stigrule_258200_Manage
# R-258201 RHEL-09-654135 # R-258201 RHEL-09-654135
- name: stigrule_258201__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent - name : stigrule_258201__etc_audit_rules_d_audit_rules__usr_bin_ssh_agent
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$' regexp: '^-a always,exit -F path=/usr/bin/ssh-agent -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -2769,7 +2822,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258201_Manage when: rhel9STIG_stigrule_258201_Manage
# R-258202 RHEL-09-654140 # R-258202 RHEL-09-654140
- name: stigrule_258202__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign - name : stigrule_258202__etc_audit_rules_d_audit_rules__usr_libexec_openssh_ssh_keysign
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$' regexp: '^-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -k privileged-ssh$'
@@ -2777,7 +2830,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258202_Manage when: rhel9STIG_stigrule_258202_Manage
# R-258203 RHEL-09-654145 # R-258203 RHEL-09-654145
- name: stigrule_258203__etc_audit_rules_d_audit_rules__usr_bin_su - name : stigrule_258203__etc_audit_rules_d_audit_rules__usr_bin_su
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change$' regexp: '^-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=unset -k privileged-priv_change$'
@@ -2785,7 +2838,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258203_Manage when: rhel9STIG_stigrule_258203_Manage
# R-258204 RHEL-09-654150 # R-258204 RHEL-09-654150
- name: stigrule_258204__etc_audit_rules_d_audit_rules__usr_bin_sudo - name : stigrule_258204__etc_audit_rules_d_audit_rules__usr_bin_sudo
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -2793,7 +2846,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258204_Manage when: rhel9STIG_stigrule_258204_Manage
# R-258205 RHEL-09-654155 # R-258205 RHEL-09-654155
- name: stigrule_258205__etc_audit_rules_d_audit_rules__usr_bin_sudoedit - name : stigrule_258205__etc_audit_rules_d_audit_rules__usr_bin_sudoedit
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$' regexp: '^-a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=1000 -F auid!=unset -k priv_cmd$'
@@ -2801,7 +2854,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258205_Manage when: rhel9STIG_stigrule_258205_Manage
# R-258206 RHEL-09-654160 # R-258206 RHEL-09-654160
- name: stigrule_258206__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd - name : stigrule_258206__etc_audit_rules_d_audit_rules__usr_sbin_unix_chkpwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2809,7 +2862,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258206_Manage when: rhel9STIG_stigrule_258206_Manage
# R-258207 RHEL-09-654165 # R-258207 RHEL-09-654165
- name: stigrule_258207__etc_audit_rules_d_audit_rules__usr_sbin_unix_update - name : stigrule_258207__etc_audit_rules_d_audit_rules__usr_sbin_unix_update
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2817,7 +2870,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258207_Manage when: rhel9STIG_stigrule_258207_Manage
# R-258208 RHEL-09-654170 # R-258208 RHEL-09-654170
- name: stigrule_258208__etc_audit_rules_d_audit_rules__usr_sbin_userhelper - name : stigrule_258208__etc_audit_rules_d_audit_rules__usr_sbin_userhelper
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$' regexp: '^-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update$'
@@ -2825,7 +2878,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258208_Manage when: rhel9STIG_stigrule_258208_Manage
# R-258209 RHEL-09-654175 # R-258209 RHEL-09-654175
- name: stigrule_258209__etc_audit_rules_d_audit_rules__usr_sbin_usermod - name : stigrule_258209__etc_audit_rules_d_audit_rules__usr_sbin_usermod
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod$' regexp: '^-a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=1000 -F auid!=unset -k privileged-usermod$'
@@ -2833,7 +2886,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258209_Manage when: rhel9STIG_stigrule_258209_Manage
# R-258210 RHEL-09-654180 # R-258210 RHEL-09-654180
- name: stigrule_258210__etc_audit_rules_d_audit_rules__usr_bin_mount - name : stigrule_258210__etc_audit_rules_d_audit_rules__usr_bin_mount
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$' regexp: '^-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -k privileged-mount$'
@@ -2841,7 +2894,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258210_Manage when: rhel9STIG_stigrule_258210_Manage
# R-258211 RHEL-09-654185 # R-258211 RHEL-09-654185
- name: stigrule_258211__etc_audit_rules_d_audit_rules__usr_sbin_init - name : stigrule_258211__etc_audit_rules_d_audit_rules__usr_sbin_init
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init$' regexp: '^-a always,exit -F path=/usr/sbin/init -F perm=x -F auid>=1000 -F auid!=unset -k privileged-init$'
@@ -2849,7 +2902,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258211_Manage when: rhel9STIG_stigrule_258211_Manage
# R-258212 RHEL-09-654190 # R-258212 RHEL-09-654190
- name: stigrule_258212__etc_audit_rules_d_audit_rules__usr_sbin_poweroff - name : stigrule_258212__etc_audit_rules_d_audit_rules__usr_sbin_poweroff
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff$' regexp: '^-a always,exit -F path=/usr/sbin/poweroff -F perm=x -F auid>=1000 -F auid!=unset -k privileged-poweroff$'
@@ -2857,7 +2910,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258212_Manage when: rhel9STIG_stigrule_258212_Manage
# R-258213 RHEL-09-654195 # R-258213 RHEL-09-654195
- name: stigrule_258213__etc_audit_rules_d_audit_rules__usr_sbin_reboot - name : stigrule_258213__etc_audit_rules_d_audit_rules__usr_sbin_reboot
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot$' regexp: '^-a always,exit -F path=/usr/sbin/reboot -F perm=x -F auid>=1000 -F auid!=unset -k privileged-reboot$'
@@ -2865,7 +2918,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258213_Manage when: rhel9STIG_stigrule_258213_Manage
# R-258214 RHEL-09-654200 # R-258214 RHEL-09-654200
- name: stigrule_258214__etc_audit_rules_d_audit_rules__usr_sbin_shutdown - name : stigrule_258214__etc_audit_rules_d_audit_rules__usr_sbin_shutdown
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown$' regexp: '^-a always,exit -F path=/usr/sbin/shutdown -F perm=x -F auid>=1000 -F auid!=unset -k privileged-shutdown$'
@@ -2873,7 +2926,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258214_Manage when: rhel9STIG_stigrule_258214_Manage
# R-258217 RHEL-09-654215 # R-258217 RHEL-09-654215
- name: stigrule_258217__etc_audit_rules_d_audit_rules__etc_sudoers - name : stigrule_258217__etc_audit_rules_d_audit_rules__etc_sudoers
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/sudoers -p wa -k identity$' regexp: '^-w /etc/sudoers -p wa -k identity$'
@@ -2881,7 +2934,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258217_Manage when: rhel9STIG_stigrule_258217_Manage
# R-258218 RHEL-09-654220 # R-258218 RHEL-09-654220
- name: stigrule_258218__etc_audit_rules_d_audit_rules__etc_sudoers_d_ - name : stigrule_258218__etc_audit_rules_d_audit_rules__etc_sudoers_d_
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/sudoers.d/ -p wa -k identity$' regexp: '^-w /etc/sudoers.d/ -p wa -k identity$'
@@ -2889,7 +2942,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258218_Manage when: rhel9STIG_stigrule_258218_Manage
# R-258219 RHEL-09-654225 # R-258219 RHEL-09-654225
- name: stigrule_258219__etc_audit_rules_d_audit_rules__etc_group - name : stigrule_258219__etc_audit_rules_d_audit_rules__etc_group
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/group -p wa -k identity$' regexp: '^-w /etc/group -p wa -k identity$'
@@ -2897,7 +2950,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258219_Manage when: rhel9STIG_stigrule_258219_Manage
# R-258220 RHEL-09-654230 # R-258220 RHEL-09-654230
- name: stigrule_258220__etc_audit_rules_d_audit_rules__etc_gshadow - name : stigrule_258220__etc_audit_rules_d_audit_rules__etc_gshadow
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/gshadow -p wa -k identity$' regexp: '^-w /etc/gshadow -p wa -k identity$'
@@ -2905,7 +2958,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258220_Manage when: rhel9STIG_stigrule_258220_Manage
# R-258221 RHEL-09-654235 # R-258221 RHEL-09-654235
- name: stigrule_258221__etc_audit_rules_d_audit_rules__etc_security_opasswd - name : stigrule_258221__etc_audit_rules_d_audit_rules__etc_security_opasswd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/security/opasswd -p wa -k identity$' regexp: '^-w /etc/security/opasswd -p wa -k identity$'
@@ -2913,7 +2966,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258221_Manage when: rhel9STIG_stigrule_258221_Manage
# R-258222 RHEL-09-654240 # R-258222 RHEL-09-654240
- name: stigrule_258222__etc_audit_rules_d_audit_rules__etc_passwd - name : stigrule_258222__etc_audit_rules_d_audit_rules__etc_passwd
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/passwd -p wa -k identity$' regexp: '^-w /etc/passwd -p wa -k identity$'
@@ -2921,7 +2974,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258222_Manage when: rhel9STIG_stigrule_258222_Manage
# R-258223 RHEL-09-654245 # R-258223 RHEL-09-654245
- name: stigrule_258223__etc_audit_rules_d_audit_rules__etc_shadow - name : stigrule_258223__etc_audit_rules_d_audit_rules__etc_shadow
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /etc/shadow -p wa -k identity$' regexp: '^-w /etc/shadow -p wa -k identity$'
@@ -2929,7 +2982,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258223_Manage when: rhel9STIG_stigrule_258223_Manage
# R-258224 RHEL-09-654250 # R-258224 RHEL-09-654250
- name: stigrule_258224__etc_audit_rules_d_audit_rules__var_log_faillock - name : stigrule_258224__etc_audit_rules_d_audit_rules__var_log_faillock
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /var/log/faillock -p wa -k logins$' regexp: '^-w /var/log/faillock -p wa -k logins$'
@@ -2937,7 +2990,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258224_Manage when: rhel9STIG_stigrule_258224_Manage
# R-258225 RHEL-09-654255 # R-258225 RHEL-09-654255
- name: stigrule_258225__etc_audit_rules_d_audit_rules__var_log_lastlog - name : stigrule_258225__etc_audit_rules_d_audit_rules__var_log_lastlog
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /var/log/lastlog -p wa -k logins$' regexp: '^-w /var/log/lastlog -p wa -k logins$'
@@ -2945,7 +2998,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258225_Manage when: rhel9STIG_stigrule_258225_Manage
# R-258226 RHEL-09-654260 # R-258226 RHEL-09-654260
- name: stigrule_258226__etc_audit_rules_d_audit_rules__var_log_tallylog - name : stigrule_258226__etc_audit_rules_d_audit_rules__var_log_tallylog
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-w /var/log/tallylog -p wa -k logins$' regexp: '^-w /var/log/tallylog -p wa -k logins$'
@@ -2953,7 +3006,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258226_Manage when: rhel9STIG_stigrule_258226_Manage
# R-258227 RHEL-09-654265 # R-258227 RHEL-09-654265
- name: stigrule_258227__etc_audit_rules_d_audit_rules_f2 - name : stigrule_258227__etc_audit_rules_d_audit_rules_f2
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-f 2$' regexp: '^-f 2$'
@@ -2961,7 +3014,7 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258227_Manage when: rhel9STIG_stigrule_258227_Manage
# R-258228 RHEL-09-654270 # R-258228 RHEL-09-654270
- name: stigrule_258228__etc_audit_rules_d_audit_rules_loginuid_immutable - name : stigrule_258228__etc_audit_rules_d_audit_rules_loginuid_immutable
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^--loginuid-immutable$' regexp: '^--loginuid-immutable$'
@@ -2969,22 +3022,34 @@
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258228_Manage when: rhel9STIG_stigrule_258228_Manage
# R-258229 RHEL-09-654275 # R-258229 RHEL-09-654275
- name: stigrule_258229__etc_audit_rules_d_audit_rules_e2 - name : stigrule_258229__etc_audit_rules_d_audit_rules_e2
lineinfile: lineinfile:
path: /etc/audit/rules.d/audit.rules path: /etc/audit/rules.d/audit.rules
regexp: '^-e 2$' regexp: '^-e 2$'
line: "{{ rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line }}" line: "{{ rhel9STIG_stigrule_258229__etc_audit_rules_d_audit_rules_e2_Line }}"
notify: auditd_restart notify: auditd_restart
when: rhel9STIG_stigrule_258229_Manage when: rhel9STIG_stigrule_258229_Manage
# R-258234 RHEL-09-215100 # R-258234 RHEL-09-672010
- name: stigrule_258234_crypto_policies - name: stigrule_258234_crypto_policies
yum: yum:
name: crypto-policies name: crypto-policies
state: "{{ rhel9STIG_stigrule_258234_crypto_policies_State }}" state: "{{ rhel9STIG_stigrule_258234_crypto_policies_State }}"
when: rhel9STIG_stigrule_258234_Manage when: rhel9STIG_stigrule_258234_Manage
# R-272488 RHEL-09-215101 # R-258239 RHEL-09-672035
- name: stigrule_272488_postfix - name: stigrule_258239__etc_pki_tls_openssl_cnf
yum: lineinfile:
name: postfix path: /etc/pki/tls/openssl.cnf
state: "{{ rhel9STIG_stigrule_272488_postfix_State }}" line: "{{ rhel9STIG_stigrule_258239__etc_pki_tls_openssl_cnf_Line }}"
when: rhel9STIG_stigrule_272488_Manage create: yes
when:
- rhel9STIG_stigrule_258239_Manage
# R-258240 RHEL-09-672040
- name: stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config
lineinfile:
path: /etc/crypto-policies/back-ends/opensslcnf.config
regexp: '^\s*TLS.MinProtocol\s*='
line: "{{ rhel9STIG_stigrule_258240__etc_crypto_policies_back_ends_opensslcnf_config_Line }}"
create: yes
notify: do_reboot
when:
- rhel9STIG_stigrule_258240_Manage

4
collections/ansible_collections/demo/patching/roles/report_linux/tasks/main.yml
View File

@@ -31,7 +31,3 @@
- name: Display link to inventory report - name: Display link to inventory report
ansible.builtin.debug: ansible.builtin.debug:
msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html" msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"
- name: Display link with a new path
ansible.builtin.debug:
msg: "Please go to http://{{ hostvars[report_server]['ansible_host'] }}/reports/linux.html"

43
common/setup.yml
View File

@@ -60,8 +60,7 @@ controller_inventory_sources:
prefix: purpose prefix: purpose
- key: tags.deployment - key: tags.deployment
prefix: deployment prefix: deployment
- key: tags.Compliance
separator: ''
controller_groups: controller_groups:
- name: cloud_aws - name: cloud_aws
inventory: Demo Inventory inventory: Demo Inventory
@@ -72,8 +71,6 @@ controller_groups:
variables: variables:
ansible_connection: winrm ansible_connection: winrm
ansible_winrm_transport: credssp ansible_winrm_transport: credssp
ansible_winrm_server_cert_validation: ignore
ansible_port: 5986
controller_templates: controller_templates:
- name: SUBMIT FEEDBACK - name: SUBMIT FEEDBACK
@@ -277,44 +274,6 @@ controller_templates:
variable: _hosts variable: _hosts
required: true required: true
- name: Cloud / AWS / Resize EC2
job_type: run
organization: Default
credentials:
- AWS
- Controller Credential
project: Ansible Product Demos
playbook: cloud/resize_ec2.yml
inventory: Demo Inventory
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry
survey_enabled: true
survey:
name: ''
description: ''
spec:
- question_name: AWS Region
type: multiplechoice
variable: aws_region
required: true
default: us-east-1
choices:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- question_name: Specify target hosts
type: text
variable: _hosts
required: true
- question_name: Specify target instance type
type: text
variable: instance_type
default: t3a.medium
required: true
controller_notifications: controller_notifications:
- name: Telemetry - name: Telemetry
organization: Default organization: Default

5
execution_environments/README.md
View File

@@ -7,11 +7,8 @@ Currently these execution environment images are created manually using the `bui
## Building the execution environment images ## Building the execution environment images
1. `podman login registry.redhat.io` in order to pull the base EE images 1. `podman login registry.redhat.io` in order to pull the base EE images
2. `export ANSIBLE_GALAXY_SERVER_CERTIFIED_TOKEN="<token>"` obtained from [Automation Hub](https://console.redhat.com/ansible/automation-hub/token) 2. `./build.sh` to build the EE images and add them to your local podman image cache
3. `export ANSIBLE_GALAXY_SERVER_VALIDATED_TOKEN="<token>"` (same as above)
4. `./build.sh` to build the EE images and add them to your local podman image cache
The `build.sh` script creates multiple EE images, each based on the ee-minimal image that comes with a different minor version of AAP. These images are created in the "quay.io/ansible-product-demos" namespace. Currently the script builds the following images: The `build.sh` script creates multiple EE images, each based on the ee-minimal image that comes with a different minor version of AAP. These images are created in the "quay.io/ansible-product-demos" namespace. Currently the script builds the following images:
* quay.io/ansible-product-demos/apd-ee-24 * quay.io/ansible-product-demos/apd-ee-24
* quay.io/ansible-product-demos/apd-ee-25

5
execution_environments/apd-ee-25.yml
View File

@@ -3,12 +3,9 @@ version: 3
images: images:
base_image: base_image:
name: registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9:latest name: registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9:latest
dependencies: dependencies:
galaxy: requirements-25.yml galaxy: requirements-25.yml
system:
- python3.11-devel [platform:rpm]
python:
- pywinrm>=0.4.3
python_interpreter: python_interpreter:
python_path: /usr/bin/python3.11 python_path: /usr/bin/python3.11

4
execution_environments/requirements-25.yml
View File

@@ -27,8 +27,6 @@ collections:
- name: redhat.rhel_system_roles - name: redhat.rhel_system_roles
version: ">=1.23.0" version: ">=1.23.0"
# windows demos # windows demos
- name: microsoft.ad
version: "1.9"
- name: ansible.windows - name: ansible.windows
version: ">=2.3.0" version: ">=2.3.0"
- name: chocolatey.chocolatey - name: chocolatey.chocolatey
@@ -50,8 +48,6 @@ collections:
version: ">=8.0.0" version: ">=8.0.0"
- name: cisco.nxos - name: cisco.nxos
version: ">=7.0.0" version: ">=7.0.0"
- name: network.backup
version: ">=3.0.0"
# TODO on 2.5 ee-minimal-rhel9 this tries to build and install # TODO on 2.5 ee-minimal-rhel9 this tries to build and install
# a different version of python netifaces, which fails # a different version of python netifaces, which fails
# - name: infoblox.nios_modules # - name: infoblox.nios_modules

2
execution_environments/requirements.yml
View File

@@ -20,8 +20,6 @@ collections:
- name: redhat.rhel_system_roles - name: redhat.rhel_system_roles
version: ">=1.23.0" version: ">=1.23.0"
# windows # windows
- name: microsoft.ad
version: "1.9"
- name: ansible.windows - name: ansible.windows
version: ">=2.3.0" version: ">=2.3.0"
- name: chocolatey.chocolatey - name: chocolatey.chocolatey

1
linux/multi_profile_compliance.yml → linux/compliance-enforce.yml
View File

@@ -13,3 +13,4 @@
- name: Run Compliance Profile - name: Run Compliance Profile
ansible.builtin.include_role: ansible.builtin.include_role:
name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}" name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}"
...

27
linux/multi_profile_compliance_report.yml → linux/compliance-report.yml
View File

@@ -9,17 +9,9 @@
- openscap-utils - openscap-utils
- scap-security-guide - scap-security-guide
compliance_profile: ospp compliance_profile: ospp
# install httpd and use it to host compliance report
use_httpd: true use_httpd: true
tasks: tasks:
- name: Assert memory meets minimum requirements
ansible.builtin.assert:
that:
- ansible_memfree_mb >= 1000
- ansible_memtotal_mb >= 2000
fail_msg: "OpenSCAP is a memory intensive operation, the specified enepoint does not meet minimum requirements. See https://access.redhat.com/articles/6999111 for details."
- name: Get our facts straight - name: Get our facts straight
ansible.builtin.set_fact: ansible.builtin.set_fact:
_profile: '{{ compliance_profile | replace("pci_dss", "pci-dss") }}' _profile: '{{ compliance_profile | replace("pci_dss", "pci-dss") }}'
@@ -88,28 +80,11 @@
group: root group: root
mode: 0644 mode: 0644
- name: Debug output for report
ansible.builtin.debug:
msg: "http://{{ ansible_host }}/oscap-reports/{{ _profile }}/report-{{ ansible_date_time.iso8601 }}.html"
when: use_httpd | bool
- name: Tag instance as {{ compliance_profile | upper }}_OUT_OF_COMPLIANCE # noqa name[template]
delegate_to: localhost
amazon.aws.ec2_tag:
region: "{{ placement.region }}"
resource: "{{ instance_id }}"
state: present
tags:
Compliance: "{{ compliance_profile | upper }}_OUT_OF_COMPLIANCE"
when:
- _oscap.rc == 2
- instance_id is defined
become: false
handlers: handlers:
- name: Restart httpd - name: Restart httpd
ansible.builtin.service: ansible.builtin.service:
name: httpd name: httpd
state: restarted state: restarted
enabled: true enabled: true
... ...

0
linux/disa_stig.yml → linux/compliance.yml
View File

1
linux/patching.yml
View File

@@ -11,7 +11,6 @@
ansible.builtin.yum: ansible.builtin.yum:
name: yum-utils name: yum-utils
state: installed state: installed
check_mode: false
- name: Include patching role - name: Include patching role
ansible.builtin.include_role: ansible.builtin.include_role:

13
linux/remediate_out_of_compliance.yml
View File

@@ -1,13 +0,0 @@
---
- name: Apply compliance profile as part of workflow.
hosts: "{{ compliance_profile | default('stig') | upper }}_OUT_OF_COMPLIANCE"
become: true
tasks:
- name: Check os type
ansible.builtin.assert:
that: "ansible_os_family == 'RedHat'"
- name: Run Compliance Profile
ansible.builtin.include_role:
name: "redhatofficial.rhel{{ ansible_distribution_major_version }}-{{ compliance_profile }}"
...

78
linux/setup.yml
View File

@@ -334,33 +334,11 @@ controller_templates:
- full - full
required: true required: true
- name: "LINUX / Compliance Enforce"
job_type: run
inventory: "Demo Inventory"
project: "Ansible Product Demos"
playbook: "linux/remediate_out_of_compliance.yml"
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry
credentials:
- "Demo Credential"
extra_vars:
sudo_remove_nopasswd: false
survey_enabled: true
survey:
name: ''
description: ''
spec:
- question_name: Server Name or Pattern
type: text
variable: _hosts
required: true
- name: "LINUX / DISA STIG" - name: "LINUX / DISA STIG"
job_type: run job_type: run
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "linux/disa_stig.yml" playbook: "linux/compliance.yml"
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
@@ -382,13 +360,12 @@ controller_templates:
job_type: run job_type: run
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "linux/multi_profile_compliance.yml" playbook: "linux/compliance-enforce.yml"
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
credentials: credentials:
- "Demo Credential" - "Demo Credential"
- "AWS"
extra_vars: extra_vars:
# used by CIS profile role # used by CIS profile role
sudo_require_authentication: false sudo_require_authentication: false
@@ -429,13 +406,12 @@ controller_templates:
job_type: run job_type: run
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "linux/multi_profile_compliance_report.yml" playbook: "linux/compliance-report.yml"
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
credentials: credentials:
- "Demo Credential" - "Demo Credential"
- "AWS"
survey_enabled: true survey_enabled: true
survey: survey:
name: '' name: ''
@@ -516,52 +492,4 @@ controller_templates:
variable: application variable: application
required: true required: true
controller_workflows:
- name: "Linux / Compliance Workflow"
description: A workflow to generate a SCAP report and run enforce on findings
organization: Default
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry
survey_enabled: true
survey:
name: ''
description: ''
spec:
- question_name: Server Name or Pattern
type: text
default: aws_rhel*
variable: _hosts
required: true
- question_name: Compliance Profile
type: multiplechoice
variable: compliance_profile
required: true
choices:
- cis
- cjis
- cui
- hipaa
- ospp
- pci_dss
- stig
- question_name: Use httpd on the target host(s) to access reports locally?
type: multiplechoice
variable: use_httpd
required: true
choices:
- "true"
- "false"
default: "true"
simplified_workflow_nodes:
- identifier: Compliance Report
unified_job_template: "LINUX / Multi-profile Compliance Report"
success_nodes:
- Update Inventory
- identifier: Update Inventory
unified_job_template: AWS Inventory
success_nodes:
- Compliance Enforce
- identifier: Compliance Enforce
unified_job_template: "LINUX / Compliance Enforce"
... ...

12
network/README.md
View File

@@ -12,8 +12,6 @@
This category of demos shows examples of network operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos. This category of demos shows examples of network operations and management with Ansible Automation Platform. The list of demos can be found below. See the [Suggested Usage](#suggested-usage) section of this document for recommendations on how to best use these demos.
- [**NETWORK / Configuration**](https://github.com/nleiva/ansible-net-modules/blob/main/main.yml) - Deploy golden configurations for different resources to Cisco IOS, IOSXR, and NXOS. - [**NETWORK / Configuration**](https://github.com/nleiva/ansible-net-modules/blob/main/main.yml) - Deploy golden configurations for different resources to Cisco IOS, IOSXR, and NXOS.
To run the demos, deploy them using Infrastructure as Code, run either the "Product Demos | Multi-demo setup" or the "Product Demos | Single demo setup" and select 'Network' in the "Product Demos" deployment, or utilize the steps in the repo level README.
### Project ### Project
These demos leverage playbooks from a [git repo](https://github.com/nleiva/ansible-net-modules) that is added as the **`Network Golden Configs`** Project in your Ansible Controller. Review this repo for the playbooks to configure different resources and network config templates that will be configured. These demos leverage playbooks from a [git repo](https://github.com/nleiva/ansible-net-modules) that is added as the **`Network Golden Configs`** Project in your Ansible Controller. Review this repo for the playbooks to configure different resources and network config templates that will be configured.
@@ -27,7 +25,7 @@ A **`Demo Inventory`** is created when setting up these demos and a dynamic sour
## Suggested Usage ## Suggested Usage
**NETWORK / Report** - Use this job to gather facts from Cisco Network devices and create a report with information about the device such as code version, along with configuration information about layers 1, 2, and 3. This shows how Ansible can be used to gather facts and build reports. Generating html pages is just one potential output. This information can be used in a number of ways, such as integration with different network management tools. **NETWORK / Report** - Use this job to gather facts from Cisco Network devices and create a report with information about the device such as code version, along with configuration information about layers 1, 2, and 3. This shows how Ansible can be used to gather facts and build reports. Generating html pages is just one potential output. This information can be used in a number of ways, such as integration with different network management tools.
- to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server. If using a demo.redhat.com Product Demos instance you should use the public key provided in the demo page in the Bastion Host Credentials section. If you are using a different environment, you may need to update the "Demo Credential". - to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server. This will ask you for an SSH public key. After running this playbook, you will need to add the SSH private key to the **`Demo Credential`** before you can run the report, so it can connect to the report server.
**NETWORK / Configuration** - Use this job to execute different [Ansible Network Resource Modules](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html) to deploy golden configs. Below is a list of the different resources the can be configured with a link to their golden config. **NETWORK / Configuration** - Use this job to execute different [Ansible Network Resource Modules](https://docs.ansible.com/ansible/latest/network/user_guide/network_resource_modules.html) to deploy golden configs. Below is a list of the different resources the can be configured with a link to their golden config.
- [acls](https://github.com/nleiva/ansible-net-modules/blob/main/acls.cfg) - [acls](https://github.com/nleiva/ansible-net-modules/blob/main/acls.cfg)
@@ -79,11 +77,3 @@ A **`Demo Inventory`** is created when setting up these demos and a dynamic sour
}, },
"_ansible_no_log": false "_ansible_no_log": false
} }
**NETWORK / BACKUP** - Use this job to show how Ansible can be used to backup network devices using Red Hat validated content. Job Template will create a backup file on the reports server where they can be viewed as a webpage. This is just an example - backups can also be sent to other repositories such as a Git repo (Github, Gitlab, etc).
To run this demo, you will need to complete a couple of prerequisites:
- to run this you will first need to run the **`Deploy Cloud Stack in AWS`** job template to deploy the report server.
- If using a demo.redhat.com Product Demos instance you should use the public key provided in the demo page in the 'Bastion Host Credentials' section. If you are using a different environment, you may need to update the "Demo Credential".
- This works with Product Demos for AAP v2.5; which includes the "Product Demos EE" includes the \
network.backup collection.

63
network/backup.yml
View File

@@ -1,63 +0,0 @@
---
- name: Create network reports server
hosts: reports
become: true
tasks:
- name: Build report server
ansible.builtin.include_role:
name: "{{ item }}"
loop:
- demo.patching.report_server
- name: Create a backup directory if it does not exist
run_once: true
ansible.builtin.file:
path: "/var/www/html/backups"
state: directory
owner: ec2-user
group: ec2-user
mode: '0755'
- name: Play to Backup Cisco Always-On Network Devices
hosts: routers
gather_facts: false
vars:
report_server: reports
backup_dir: "/tmp/network_backups"
tasks:
- name: Network Backup and Resource Manager
ansible.builtin.include_role:
name: network.backup.run
vars: # noqa var-naming[no-role-prefix]
operation: backup
type: full
data_store:
local: "{{ backup_dir }}"
# This task removes the Current configuration... from the top of IOS routers show run
- name: Remove non config lines - regexp
delegate_to: localhost
ansible.builtin.lineinfile:
path: "{{ backup_dir }}/{{ inventory_hostname }}.txt"
line: "Building configuration..."
state: absent
- name: Copy backup file
delegate_to: "{{ report_server }}"
ansible.builtin.copy:
src: "{{ backup_dir }}/{{ inventory_hostname }}.txt"
dest: "/var/www/html/backups/{{ inventory_hostname }}.cfg"
backup: true
owner: ec2-user
group: ec2-user
mode: '0644'
- name: Review backup on report server
delegate_to: "{{ report_server }}"
run_once: true
ansible.builtin.debug:
msg: "To review backed up configurations, go to http://{{ ansible_host }}/backups/"
...

42
network/hosts
View File

@@ -1,42 +0,0 @@
[ios]
sandbox-iosxe-latest-1.cisco.com
[ios:vars]
ansible_network_os=cisco.ios.ios
ansible_password=C1sco12345
ansible_ssh_password=C1sco12345
ansible_port=22
ansible_user=admin
[iosxr]
sandbox-iosxr-1.cisco.com
[iosxr:vars]
ansible_network_os=cisco.iosxr.iosxr
ansible_password=C1sco12345
ansible_ssh_pass=C1sco12345
ansible_port=22
ansible_user=admin
[nxos]
sbx-nxos-mgmt.cisco.com
sandbox-nxos-1.cisco.com
[nxos:vars]
ansible_network_os=cisco.nxos.nxos
ansible_password=Admin_1234!
ansible_ssh_pass=Admin_1234!
ansible_port=22
ansible_user=admin
[routers]
sbx-nxos-mgmt.cisco.com
sandbox-nxos-1.cisco.com
sandbox-iosxr-1.cisco.com
sandbox-iosxe-latest-1.cisco.com
[routers:vars]
ansible_connection=ansible.netcommon.network_cli
[webservers]
reports ansible_host=ec2-18-118-189-162.us-east-2.compute.amazonaws.com ansible_user=ec2-user

24
network/setup.yml
View File

@@ -11,9 +11,7 @@ controller_projects:
scm_type: git scm_type: git
scm_url: https://github.com/nleiva/ansible-net-modules scm_url: https://github.com/nleiva/ansible-net-modules
update_project: true update_project: true
wait: false wait: true
controller_request_timeout: 20
controller_configuration_async_retries: 40
default_environment: Networking Execution Environment default_environment: Networking Execution Environment
controller_inventories: controller_inventories:
@@ -25,8 +23,8 @@ controller_inventory_sources:
source: scm source: scm
inventory: Demo Inventory inventory: Demo Inventory
overwrite: true overwrite: true
source_project: Ansible Product Demos source_project: Network Golden Configs
source_path: network/hosts source_path: hosts
controller_templates: controller_templates:
- name: NETWORK / Configuration - name: NETWORK / Configuration
@@ -35,8 +33,6 @@ controller_templates:
survey_enabled: true survey_enabled: true
project: Network Golden Configs project: Network Golden Configs
playbook: main.yml playbook: main.yml
credentials:
- "Demo Credential"
execution_environment: Networking Execution Environment execution_environment: Networking Execution Environment
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
@@ -99,23 +95,9 @@ controller_templates:
inventory: Demo Inventory inventory: Demo Inventory
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "network/compliance.yml" playbook: "network/compliance.yml"
credentials:
- "Demo Credential"
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
use_fact_cache: true use_fact_cache: true
ask_job_type_on_launch: true ask_job_type_on_launch: true
survey_enabled: true survey_enabled: true
- name: "NETWORK / Backup"
job_type: run
organization: Default
inventory: Demo Inventory
project: "Ansible Product Demos"
playbook: "network/backup.yml"
credentials:
- "Demo Credential"
notification_templates_started: Telemetry
notification_templates_success: Telemetry
notification_templates_error: Telemetry

32
openshift/gitlab.yml
View File

@@ -101,21 +101,6 @@
retries: 10 retries: 10
delay: 30 delay: 30
- name: Get available charts from gitlab operator repo
register: gitlab_chart_versions
ansible.builtin.uri:
url: https://gitlab.com/gitlab-org/cloud-native/gitlab-operator/-/raw/master/CHART_VERSIONS?ref_type=heads
method: GET
return_content: true
- name: Debug gitlab_chart_versions
ansible.builtin.debug:
var: gitlab_chart_versions.content | from_yaml
- name: Get latest chart from available_chart_versions
ansible.builtin.set_fact:
gitlab_chart_version: "{{ (gitlab_chart_versions.content | split())[0] }}"
- name: Grab url for Gitlab spec - name: Grab url for Gitlab spec
ansible.builtin.set_fact: ansible.builtin.set_fact:
cluster_domain: "apps{{ lookup('ansible.builtin.env', 'K8S_AUTH_HOST') | regex_search('\\.[^:]*') }}" cluster_domain: "apps{{ lookup('ansible.builtin.env', 'K8S_AUTH_HOST') | regex_search('\\.[^:]*') }}"
@@ -148,20 +133,3 @@
route.openshift.io/termination: "edge" route.openshift.io/termination: "edge"
certmanager-issuer: certmanager-issuer:
email: "{{ cert_email | default('nobody@nowhere.nosite') }}" email: "{{ cert_email | default('nobody@nowhere.nosite') }}"
- name: Print out warning and initial details about deployment
vars:
msg: |
If not immediately successful be aware that the Gitlab instance can take
a couple minutes to come up, so be patient.
URL for Gitlab instance:
https://gitlab.{{ cluster_domain }}
The initial login user is 'root', and the password can be found by logging
into the OpenShift cluster portal, and on the left hand side of the administrator
portal, under workloads, select Secrets and look for 'gitlab-gitlab-initial-root-password'
ansible.builtin.debug:
msg: "{{ msg.split('\n') }}"
...

2
tests/requirements.yml
View File

@@ -1 +1 @@
../execution_environments/requirements-25.yml ../execution_environments/requirements.yml

9
windows/create_ad_domain.yml
View File

@@ -12,17 +12,14 @@
- name: Update the hostname - name: Update the hostname
ansible.windows.win_hostname: ansible.windows.win_hostname:
name: "{{ inventory_hostname.split('.')[0] }}" name: "{{ inventory_hostname.split('.')[0] }}"
register: r_rename_hostname
- name: Reboot to apply new hostname - name: Reboot to apply new hostname
# noqa no-handler
when: r_rename_hostname is changed
ansible.windows.win_reboot: ansible.windows.win_reboot:
reboot_timeout: 3600 reboot_timeout: 3600
- name: Create new domain in a new forest on the target host - name: Create new domain in a new forest on the target host
register: r_create_domain register: r_create_domain
microsoft.ad.domain: ansible.windows.win_domain:
dns_domain_name: ansible.local dns_domain_name: ansible.local
safe_mode_password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}" safe_mode_password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}"
@@ -33,7 +30,7 @@
file: tasks/domain_services_check.yml file: tasks/domain_services_check.yml
- name: Create some groups - name: Create some groups
microsoft.ad.group: community.windows.win_domain_group:
name: "{{ item.name }}" name: "{{ item.name }}"
scope: global scope: global
loop: loop:
@@ -44,7 +41,7 @@
delay: 10 delay: 10
- name: Create some users - name: Create some users
microsoft.ad.user: community.windows.win_domain_user:
name: "{{ item.name }}" name: "{{ item.name }}"
groups: "{{ item.groups }}" groups: "{{ item.groups }}"
password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}" password: "{{ lookup('community.general.random_string', min_lower=1, min_upper=1, min_special=1, min_numeric=1) }}"

5
windows/group_vars/os_windows.yml Normal file
View File

@@ -0,0 +1,5 @@
---
ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore
ansible_port: 5986

6
windows/patching.yml
View File

@@ -5,12 +5,6 @@
report_server: aws_win1 report_server: aws_win1
tasks: tasks:
- name: Assert that host is in webservers group
ansible.builtin.assert:
that: "'{{ report_server }}' in groups.os_windows"
msg: "Please run the 'Deploy Cloud Stack in AWS' Workflow Job Template first"
- name: Patch windows server - name: Patch windows server
ansible.builtin.include_role: ansible.builtin.include_role:
name: demo.patching.patch_windows name: demo.patching.patch_windows

11
windows/setup.yml
View File

@@ -40,6 +40,7 @@ controller_templates:
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "windows/patching.yml" playbook: "windows/patching.yml"
execution_environment: Default execution environment
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
@@ -85,6 +86,7 @@ controller_templates:
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "windows/rollback.yml" playbook: "windows/rollback.yml"
execution_environment: Default execution environment
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
@@ -109,6 +111,7 @@ controller_templates:
inventory: "Demo Inventory" inventory: "Demo Inventory"
project: "Ansible Product Demos" project: "Ansible Product Demos"
playbook: "windows/connect.yml" playbook: "windows/connect.yml"
execution_environment: Default execution environment
notification_templates_started: Telemetry notification_templates_started: Telemetry
notification_templates_success: Telemetry notification_templates_success: Telemetry
notification_templates_error: Telemetry notification_templates_error: Telemetry
@@ -417,7 +420,7 @@ controller_workflows:
unified_job_template: Cloud / AWS / Create VM unified_job_template: Cloud / AWS / Create VM
job_type: run job_type: run
extra_data: extra_data:
create_vm_vm_name: dc01 create_vm_vm_name: dc01.ansible.local
create_vm_vm_purpose: domain_controller create_vm_vm_purpose: domain_controller
create_vm_vm_deployment: domain_ansible_local create_vm_vm_deployment: domain_ansible_local
vm_blueprint: windows_full vm_blueprint: windows_full
@@ -427,7 +430,7 @@ controller_workflows:
unified_job_template: Cloud / AWS / Create VM unified_job_template: Cloud / AWS / Create VM
job_type: run job_type: run
extra_data: extra_data:
create_vm_vm_name: winston create_vm_vm_name: winston.ansible.local
create_vm_vm_purpose: domain_computer create_vm_vm_purpose: domain_computer
create_vm_vm_deployment: domain_ansible_local create_vm_vm_deployment: domain_ansible_local
vm_blueprint: windows_core vm_blueprint: windows_core
@@ -437,7 +440,7 @@ controller_workflows:
unified_job_template: Cloud / AWS / Create VM unified_job_template: Cloud / AWS / Create VM
job_type: run job_type: run
extra_data: extra_data:
create_vm_vm_name: winthrop create_vm_vm_name: winthrop.ansible.local
create_vm_vm_purpose: domain_computer create_vm_vm_purpose: domain_computer
create_vm_vm_deployment: domain_ansible_local create_vm_vm_deployment: domain_ansible_local
vm_blueprint: windows_core vm_blueprint: windows_core
@@ -471,7 +474,7 @@ controller_workflows:
job_type: run job_type: run
extra_data: extra_data:
_hosts: purpose_domain_computer _hosts: purpose_domain_computer
domain_controller: dc01 domain_controller: dc01.ansible.local
failure_nodes: failure_nodes:
- Cleanup Resources - Cleanup Resources
success_nodes: success_nodes: