authselect remediation macro removed sudo rights - #15049
Open
nnerdmann wants to merge 1 commit into
Open
Conversation
|
Hi @nnerdmann. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
This datastream diff is auto generated by the check Click here to see the trimmed diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile
@@ -23,10 +23,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_modules_in_authselect_profile
@@ -204,9 +204,10 @@
- restrict_strategy
- name: Ensure Active Authselect Profile Includes PAM Modules - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- '"pam" in ansible_facts.packages'
@@ -223,26 +224,6 @@
- no_reboot_needed
- restrict_strategy
-- name: Ensure Active Authselect Profile Includes PAM Modules - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - '"pam" in ansible_facts.packages'
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
- tags:
- - CCE-90716-2
- - accounts_password_pam_modules_in_authselect_profile
- - low_complexity
- - low_disruption
- - medium_severity
- - no_reboot_needed
- - restrict_strategy
-
- name: Ensure Active Authselect Profile Includes PAM Modules - Ensure authselect
changes are applied
ansible.builtin.command:
@@ -251,7 +232,6 @@
- '"pam" in ansible_facts.packages'
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
tags:
- CCE-90716-2
- accounts_password_pam_modules_in_authselect_profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -38,10 +38,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -75,10 +72,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -140,10 +134,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -191,10 +182,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -256,10 +244,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -267,9 +267,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Ensure PAM Displays Last Logon/Access Notification - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -277,17 +278,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Ensure PAM Displays Last Logon/Access Notification - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect
changes are applied
ansible.builtin.command:
@@ -295,7 +285,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Ensure PAM Displays Last Logon/Access Notification - Change the PAM file
to be edited according to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -67,10 +67,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -322,9 +322,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
- is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -332,24 +333,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Account Lockouts Must Be Logged - Restore the authselect features in
- the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
to the custom authselect profile
@@ -518,9 +507,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
- is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -528,24 +518,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Account Lockouts Must Be Logged - Restore the authselect features in
- the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -44,10 +44,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -126,10 +123,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -175,10 +169,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -273,9 +273,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
- is selected'
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected'
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -283,24 +284,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: password-auth - Restore the authselect features
- in the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
according to the custom authselect profile'
@@ -565,9 +554,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: password-auth - Ensure the authselect custom
- profile is selected'
+ profile and features are selected'
ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -575,17 +565,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: password-auth - Restore the authselect features
- in the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
applied'
ansible.builtin.command:
@@ -593,7 +572,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
according to the custom authselect profile'
@@ -777,9 +755,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile
- is selected'
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected'
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -787,24 +766,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: password-auth - Restore the authselect features
- in the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited
according to the custom authselect profile'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -44,10 +44,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -126,10 +123,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -175,10 +169,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -273,9 +273,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
- is selected'
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected'
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -283,24 +284,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
- the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
according to the custom authselect profile'
@@ -565,9 +554,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: system-auth - Ensure the authselect custom
- profile is selected'
+ profile and features are selected'
ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -575,17 +565,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: system-auth - Restore the authselect features
- in the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
applied'
ansible.builtin.command:
@@ -593,7 +572,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
according to the custom authselect profile'
@@ -776,9 +754,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile
- is selected'
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected'
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -786,24 +765,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: 'Limit Password Reuse: system-auth - Restore the authselect features in
- the custom profile'
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited
according to the custom authselect profile'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok
@@ -14,10 +14,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_use_authtok
@@ -134,9 +134,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Enforce Password History with use_authtok - Ensure the authselect custom
- profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -144,17 +145,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Enforce Password History with use_authtok - Restore the authselect features
- in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Enforce Password History with use_authtok - Ensure authselect changes are
applied
ansible.builtin.command:
@@ -162,7 +152,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
when:
- '"kernel-core" in ansible_facts.packages'
- '"pam" in ansible_facts.packages'
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -45,10 +45,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -127,10 +124,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
@@ -176,10 +170,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -260,9 +260,11 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Ensure the authselect custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ - name: Limit Password Reuse - Ensure the authselect custom profile and features
+ are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -270,23 +272,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Restore the authselect features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Limit Password Reuse - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Limit Password Reuse - Change the PAM file to be edited according to the
custom authselect profile
@@ -543,9 +534,11 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Ensure the authselect custom profile is selected
+ - name: Limit Password Reuse - Ensure the authselect custom profile and features
+ are selected
ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -553,24 +546,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Restore the authselect features in the custom
- profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Limit Password Reuse - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Limit Password Reuse - Change the PAM file to be edited according
to the custom authselect profile
@@ -747,9 +728,11 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Ensure the authselect custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ - name: Limit Password Reuse - Ensure the authselect custom profile and features
+ are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -757,23 +740,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Limit Password Reuse - Restore the authselect features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Limit Password Reuse - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Limit Password Reuse - Change the PAM file to be edited according to the
custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -67,10 +67,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -340,9 +340,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
- is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -350,24 +351,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Account Lockouts Must Be Logged - Restore the authselect features in
- the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
to the custom authselect profile
@@ -536,9 +525,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
- is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -546,24 +536,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Account Lockouts Must Be Logged - Restore the authselect features in
- the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Account Lockouts Must Be Logged - Change the PAM file to be edited according
to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -72,10 +72,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -383,9 +383,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Lock Accounts After Failed Password Attempts - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -393,17 +394,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts After Failed Password Attempts - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
are applied
ansible.builtin.command:
@@ -411,7 +401,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Lock Accounts After Failed Password Attempts - Change the PAM file to
be edited according to the custom authselect profile
@@ -584,9 +573,10 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Lock Accounts After Failed Password Attempts - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -594,17 +584,6 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts After Failed Password Attempts - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
are applied
ansible.builtin.command:
@@ -612,7 +591,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Lock Accounts After Failed Password Attempts - Change the PAM file to
be edited according to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -67,10 +67,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -360,26 +360,16 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Configure the root Account for Failed Password Attempts - Ensure the
- authselect custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ authselect custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
-
- - name: Configure the root Account for Failed Password Attempts - Restore the
- authselect features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
- name: Configure the root Account for Failed Password Attempts - Ensure authselect
changes are applied
@@ -388,7 +378,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Configure the root Account for Failed Password Attempts - Change the
PAM file to be edited according to the custom authselect profile
@@ -561,26 +550,16 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Configure the root Account for Failed Password Attempts - Ensure the
- authselect custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ authselect custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
-
- - name: Configure the root Account for Failed Password Attempts - Restore the
- authselect features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
- name: Configure the root Account for Failed Password Attempts - Ensure authselect
changes are applied
@@ -589,7 +568,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Configure the root Account for Failed Password Attempts - Change the
PAM file to be edited according to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -72,10 +72,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -351,10 +351,11 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts Must Persist - Ensure the authselect custom profile is
- selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ - name: Lock Accounts Must Persist - Ensure the authselect custom profile and
+ features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -362,24 +363,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts Must Persist - Restore the authselect features in the
- custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Lock Accounts Must Persist - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Lock Accounts Must Persist - Change the PAM file to be edited according
to the custom authselect profile
@@ -543,10 +532,11 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts Must Persist - Ensure the authselect custom profile is
- selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ - name: Lock Accounts Must Persist - Ensure the authselect custom profile and
+ features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
@@ -554,24 +544,12 @@
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
- - name: Lock Accounts Must Persist - Restore the authselect features in the
- custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
-
- name: Lock Accounts Must Persist - Ensure authselect changes are applied
ansible.builtin.command:
cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Lock Accounts Must Persist - Change the PAM file to be edited according
to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -67,10 +67,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -336,26 +336,16 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Enforce pam_faillock for Local Accounts Only - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
-
- - name: Enforce pam_faillock for Local Accounts Only - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
- name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes
are applied
@@ -364,7 +354,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Enforce pam_faillock for Local Accounts Only - Change the PAM file to
be edited according to the custom authselect profile
@@ -537,26 +526,16 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Enforce pam_faillock for Local Accounts Only - Ensure the authselect
- custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
-
- - name: Enforce pam_faillock for Local Accounts Only - Restore the authselect
- features in the custom profile
- ansible.builtin.command:
- cmd: authselect enable-feature {{ item }}
- loop: '{{ result_authselect_features.stdout_lines }}'
- register: result_pam_authselect_restore_features
- when:
- - result_authselect_profile is not skipped
- - result_authselect_features is not skipped
- - result_pam_authselect_select_profile is not skipped
- name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes
are applied
@@ -565,7 +544,6 @@
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- - result_pam_authselect_restore_features is not skipped
- name: Enforce pam_faillock for Local Accounts Only - Change the PAM file to
be edited according to the custom authselect profile
bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
@@ -67,10 +67,7 @@
CURRENT_PROFILE="custom/hardening"
authselect apply-changes -b --backup=before-hardening-custom-profile
- authselect select $CURRENT_PROFILE
- for feature in $ENABLED_FEATURES; do
- authselect enable-feature $feature;
- done
+ authselect select $CURRENT_PROFILE $ENABLED_FEATURES
authselect apply-changes -b --backup=after-hardening-custom-profile
fi
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_even_deny_root_or_root_unlock_time
@@ -331,26 +331,16 @@
- authselect_custom_profile is not match(authselect_current_profile)
- name: Ensure Root Account Lockout on Failed Password Attempts - Ensure the
- authselect custom profile is selected
- ansible.builtin.command:
- cmd: authselect select {{ authselect_custom_profile }}
+ authselect custom profile and features are selected
+ ansible.builtin.command:
+ cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines
+ | join(' ') }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
-
- - name: Ensure Root Account Lockout on Failed Password Attempts - Restore the
- authselect features in the custom profile
- ansible.built
... The diff is trimmed here ... |
|
Change in Ansible Please consider using more suitable Ansible module than |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We use Red Hat IdM as our authentication backend and rely on centralised sudo management.
Following the integration of the system with ipa-client-install, the authselect configuration appears as follows:
In the old implementation, configuring the custom profile (custom/hardening) and enabling features was split into several Ansible tasks.
When I run the remediation process using my personal account via sudo, I receive an error message at step 5 because, after activating step 4, authselect/pam loses access to the centralised Red Hat IdM sudo environment.
Fortunately, the authselect command can be used to configure the profile and features in a single command:
The pull request updates the Ansible and bash macros accordingly.