Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nov24 logic updates #436

Merged
merged 2 commits into from
Dec 3, 2024
Merged

Nov24 logic updates #436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6d2693e
Tidy up and improve conditionals #433
uk-bolly Nov 28, 2024
ca8dd72
removed changed_when #434
uk-bolly Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion tasks/post.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
- name: POST | Perform DNF package cleanup
ansible.builtin.dnf:
autoremove: true
changed_when: false

- name: POST | flush handlers
ansible.builtin.meta: flush_handlers
Expand Down
52 changes: 29 additions & 23 deletions tasks/prelim.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,30 +193,10 @@
check_mode: false
register: prelim_sudoers_files

- name: "PRELIM | AUDIT | Check authselect package versions"
tags:
- always
- authselect
vars:
warn_control_id: 'authselect_pkg_version_too_low'
authselect_pkg_version: 1.2.6
block:
- name: "PRELIM | AUDIT | Check authselect package versions | set fact"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '>=')
ansible.builtin.set_fact:
authselect_version: OK

- name: "PRELIM | WARNING | Check authselect package versions | Warning"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '<')
ansible.builtin.debug:
msg: "Warning!! Authselect controls won't run as authselect pkg version too low"

- name: "PRELIM | WARNING | Check authselect package versions | Warning"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '<')
ansible.builtin.import_tasks:
file: warning_facts.yml

- name: "PRELIM | AUDIT | Check pam package versions"
when:
- "'pam' in ansible_facts.packages"
- rhel8cis_rule_4_4_1_1
tags:
- always
vars:
Expand Down Expand Up @@ -245,6 +225,32 @@
ansible.builtin.import_tasks:
file: warning_facts.yml

- name: "PRELIM | AUDIT | Check authselect package versions"
when:
- "'authselect' in ansible_facts.packages"
- rhel8cis_rule_4_4_1_2
tags:
- always
- authselect
vars:
warn_control_id: 'authselect_pkg_version_too_low'
authselect_pkg_version: 1.2.6
block:
- name: "PRELIM | AUDIT | Check authselect package versions | set fact"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '>=')
ansible.builtin.set_fact:
authselect_version: OK

- name: "PRELIM | WARNING | Check authselect package versions | Warning"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '<')
ansible.builtin.debug:
msg: "Warning!! Authselect controls won't run as authselect pkg version too low"

- name: "PRELIM | WARNING | Check authselect package versions | Warning"
when: ansible_facts.packages.authselect[0].version is version(authselect_pkg_version, '<')
ansible.builtin.import_tasks:
file: warning_facts.yml

- name: "PRELIM | AUDIT | Interactive User accounts home directories"
tags:
- always
Expand Down
2 changes: 2 additions & 0 deletions tasks/section_4/cis_4.4.1.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
- name: "4.4.1.1 | PATCH | Ensure latest version of pam is installed"
when:
- rhel8cis_rule_4_4_1_1
- pam_version is not defined or pam_version != 'OK'
tags:
- level1-server
- level1-workstation
Expand All @@ -18,6 +19,7 @@
when:
- rhel8cis_rule_4_4_1_2
- rhel8cis_authselect_pkg_update
- authselect_version is not defined or authselect__version != 'OK'
tags:
- level1-server
- level1-workstation
Expand Down