ansible-hardening/tasks/rhel7stig/auth.yml

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: Get a list of users on the system to use throughout the auth tasks
  action: get_users
  register: user_list
  check_mode: no
  tags:
    - always

- name: Check if /etc/security/pwquality.conf exists
  stat:
    path: /etc/security/pwquality.conf
  check_mode: no
  register: pwquality_config_check
  tags:
    - always

- name: Set password quality requirements
  blockinfile:
    dest: /etc/security/pwquality.conf
    backup: yes
    insertbefore: EOF
    marker: "# {mark} Added by openstack-ansible-security role"
    state: present
    block: "{{ lookup('template', 'pwquality.conf.j2') }}"
  when:
    - pwquality_config_check.stat.exists
  tags:
    - auth
    - medium
    - RHEL-07-010090
    - RHEL-07-010100
    - RHEL-07-010110
    - RHEL-07-010120
    - RHEL-07-010130
    - RHEL-07-010140
    - RHEL-07-010150
    - RHEL-07-010160

- name: RHEL-07-010180 - The shadow file must be configured to store only encrypted representations of passwords.
  lineinfile:
    dest: /etc/login.defs
    regexp: "^ENCRYPT_METHOD"
    line: "ENCRYPT_METHOD SHA512"
    state: present
  when:
    - security_require_sha512_password_storage | bool
  tags:
    - auth
    - medium
    - RHEL-07-010180

- name: RHEL-07-010190 - User and group account administration utilities must be configured to store only encrypted representations of passwords.
  ini_file:
    dest: /etc/libuser.conf
    section: defaults
    option: crypt_style
    value: sha512
    backup: yes
  when:
    - security_libuser_crypt_style_sha512 | bool
    - ansible_os_family | lower == 'redhat'
  tags:
    - auth
    - medium
    - RHEL-07-010190

- name: Get all user accounts with a password lifetime limit under 24 hours
  shell: "awk -F: '$4 < 1 {print $1}' /etc/shadow"
  check_mode: no
  changed_when: False
  register: password_lifetime_check
  tags:
    - auth
    - medium
    - RHEL-07-010210
    - skip_ansible_lint

- name: RHEL-07-010210 - Passwords must be restricted to a 24 hours/1 day minimum lifetime.
  debug:
    msg: |
      Accounts were found with a minimum password lifetime limit under 24 hours:
      {{ password_lifetime_check.stdout_lines | join(', ') }}      
  when:
    - password_lifetime_check.stdout_lines is defined
  tags:
    - auth
    - medium
    - RHEL-07-010210

- name: RHEL-07-010220 - Passwords for new users must be restricted to a 60-day maximum lifetime.
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MAX_DAYS"
    line: "PASS_MAX_DAYS {{ security_password_max_lifetime_days }}"
  when:
    - security_password_max_lifetime_days is defined
  tags:
    - auth
    - medium
    - RHEL-07-010220

- name: RHEL-07-010260 - The system must not have accounts configured with blank or null passwords
  lineinfile:
    dest: "{{ pam_auth_file }}"
    state: present
    regexp: "^(.*)nullok_secure(.*)$"
    line: '\1\2'
    backup: yes
    backrefs: yes
  when:
    - ansible_os_family == 'Debian'
    - security_disallow_blank_password_login | bool
  tags:
    - auth
    - high
    - RHEL-07-010260

- name: RHEL-07-010260 - The system must not have accounts configured with blank or null passwords
  lineinfile:
    dest: "{{ pam_auth_file }}"
    state: present
    regexp: "^({{ item }}.*sufficient.*)nullok(.*)$"
    line: '\1\2'
    backup: yes
    backrefs: yes
  with_items:
    - auth
    - password
  when:
    - ansible_os_family == 'RedHat'
    - security_disallow_blank_password_login | bool
  tags:
    - auth
    - high
    - RHEL-07-010260

- name: Get all accounts with UID 0
  shell: "awk -F: '$3 == 0 {print $1}' /etc/passwd"
  changed_when: False
  check_mode: no
  register: root_user_check
  tags:
    - auth
    - high
    - RHEL-07-020310
    - skip_ansible_lint

- name: RHEL-07-020310 - The root account must be the only account having unrestricted access to the system
  fail:
    msg: |
      Only the 'root' user should have UID 0. Other users were found:
      {{ root_user_check.stdout_lines | join(', ') }}"      
  when:
    - root_user_check.stdout != 'root'
  tags:
    - auth
    - high
    - RHEL-07-020310

- name: RHEL-07-020620 - All local interactive users must have a home directory assigned in the /etc/passwd file.
  debug:
    msg: |
      The following users do not have a home directory assigned:
      {{ user_list.users | selectattr('dir', 'equalto', '') | map(attribute='name') | join(', ') }}      
  when:
    - user_list is defined
    - user_list.users | selectattr('dir', 'equalto', '') | map(attribute='name') | list | length > 0
  tags:
    - auth
    - medium
    - RHEL-07-020620