- name: PRELIM | List users accounts
  command: "awk -F: '{print $1}' /etc/passwd"
  register: users

- name: V-38491 High  There must be no .rhosts files on the system
  file: state=absent dest=~{{ item }}/.rhosts
  with_items: users.stdout_lines

- name: V-38491 High  There must be no hosts.equiv file on the system
  file: state=absent dest=/etc/hosts.equiv

- name: "V-38504 Medium  The /etc/shadow file must have mode 0000\n    V-38502 V-38503 Medium  The /etc/shadow file must be owned and group-owned by root"
  file: dest=/etc/shadow owner=root group=root mode=0600


  # default user and password settings
- name: V-38475 Medium  The system must require passwords to contain a minimum of 14 characters
  lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MIN_LEN' line='PASS_MIN_LEN    {{ rhel6stig_pass_min_length }}' backup=yes"

- name: V-38477 Medium  Users must not be able to change passwords more than once every 24 hours
  lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MIN_DAYS' line='PASS_MIN_DAYS   {{ rhel6stig_pass_min_days }}' backup=yes"

- name: V-38479 Medium  User passwords must be changed at least every 60 days
  lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MAX_DAYS' line='PASS_MAX_DAYS   {{ rhel6stig_pass_max_days }}' backup=yes"

- name: V-38576 Medium  The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs)
  lineinfile: "state=present backup=yes dest=/etc/login.defs regexp='^ENCRYPT_METHOD' line='ENCRYPT_METHOD SHA512'"

- name: V-38577 Medium  The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf)
  lineinfile: "state=present backup=yes dest=/etc/libuser.conf regexp='^crypt_style' line='crypt_style = sha512'"



  # sysctl kernel settings
- name: V-38597 Medium  The system must limit the ability of processes to have simultaneous write and execute access to memory
  sysctl: name=kernel.exec-shield value=1 state=present reload=yes ignoreerrors=yes

- name: V-38596 Medium  The system must implement virtual address space randomization
  sysctl: name=kernel.randomize_va_space state=present reload=yes ignoreerrors=yes

# sysctl network settings
- name: V-38511 Medium  IP forwarding for IPv4 must not be enabled unless the system is a router
  sysctl: name=net.ipv4.ip_forward value=0 state=present reload=yes ignoreerrors=yes
  when: not rhel6stig_system_is_router

- name: V-38523 Medium  The system must not accept IPv4 source-routed packets on any interface
  sysctl: name=net.ipv4.conf.all.accept_source_route value=0 state=present reload=yes ignoreerrors=yes

- name: V-38524 Medium  The system must not accept ICMPv4 redirect packets on any interface
  sysctl: name=net.ipv4.conf.all.accept_redirects value=0 state=present reload=yes ignoreerrors=yes

- name: V-38526 Medium  The system must not accept ICMPv4 secure redirect packets on any interface
  sysctl: name=net.ipv4.conf.all.secure_redirects value=0 state=present reload=yes ignoreerrors=yes

- name: V-38529 Medium  The system must not accept IPv4 source-routed packets by default
  sysctl: name=net.ipv4.conf.default.accept_source_route value=0 state=present reload=yes ignoreerrors=yes

- name: V-38532 Medium  The system must not accept ICMPv4 secure redirect packets by default.
  sysctl: name=net.ipv4.conf.default.secure_redirects value=0 state=present reload=yes ignoreerrors=yes

- name: V-38539 Medium  The system must be configured to use TCP syncookies
  sysctl: name=net.ipv4.tcp_syncookies value=1 state=present reload=yes ignoreerrors=yes

- name: V-38542 Medium  The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces
  sysctl: name=net.ipv4.conf.all.rp_filter value=1 state=present reload=yes ignoreerrors=yes

- name: V-38544 Medium  The system must use a reverse-path filter for IPv4 network traffic when possible by default.
  sysctl: name=net.ipv4.conf.default.rp_filter value=1 state=present reload=yes ignoreerrors=yes

- name: V-38548 Medium  The system must ignore ICMPv6 redirects by default
  sysctl: name=net.ipv6.conf.default.accept_redirects value=0 state=present reload=yes ignoreerrors=yes

- name: V-38600 Medium  The system must not send ICMPv4 redirects by default
  sysctl: name=net.ipv4.conf.default.send_redirects value=0 state=present reload=yes ignoreerrors=yes

- name: V-38601 Medium  The system must not send ICMPv4 redirects from any interface
  sysctl: name=net.ipv4.conf.all.send_redirects value=0 state=present reload=yes ignoreerrors=yes