andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add more conditionals

Browse Source
This commit is contained in:
Sebastian Gumprich committed 2015-08-17 17:08:16 +00:00
1 parent 9560f33329
commit b17bd65870
1 file changed
+4 -4
Download Patch File Download Diff File Expand all files Collapse all files
roles/ansible-ssh-hardening/tasks/main.yml
+4 -4
View File
@@ -39,19 +39,19 @@
- name: Distributing custom selinux policies
copy: src='ssh_password' dest='{{ custom_selinux_dir }}'
register: custom_policies_output
when: not ssh_use_pam and sestatus.stdout != 'Disabled'
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and selinux_installed.rc == 0
- name: check and compile policy
shell: checkmodule -M -m -o {{ custom_selinux_dir }}/ssh_password.mod {{ custom_selinux_dir }}/ssh_password
when: not ssh_use_pam and sestatus.stdout != 'Disabled'
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and selinux_installed.rc == 0
- name: create selinux policy module package
shell: semodule_package -o {{ custom_selinux_dir }}/ssh_password.pp -m {{ custom_selinux_dir }}/ssh_password.mod
when: not ssh_use_pam and sestatus.stdout != 'Disabled'
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and selinux_installed.rc == 0
- name: install selinux policy
shell: semodule -i {{ custom_selinux_dir }}/ssh_password.pp
when: not ssh_use_pam and sestatus.stdout != 'Disabled'
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and selinux_installed.rc == 0
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk (http://danwalsh.livejournal.com/12333.html)
shell: semodule -r ssh_password