78 lines
4.5 KiB
Plaintext
78 lines
4.5 KiB
Plaintext
- name: PRELIM | List users accounts
|
|
command: "awk -F: '{print $1}' /etc/passwd"
|
|
register: users
|
|
|
|
- name: V-38491 High There must be no .rhosts files on the system
|
|
file: state=absent dest=~{{ item }}/.rhosts
|
|
with_items: users.stdout_lines
|
|
|
|
- name: V-38491 High There must be no hosts.equiv file on the system
|
|
file: state=absent dest=/etc/hosts.equiv
|
|
|
|
- name: "V-38504 Medium The /etc/shadow file must have mode 0000\n V-38502 V-38503 Medium The /etc/shadow file must be owned and group-owned by root"
|
|
file: dest=/etc/shadow owner=root group=root mode=0600
|
|
|
|
|
|
# default user and password settings
|
|
- name: V-38475 Medium The system must require passwords to contain a minimum of 14 characters
|
|
lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MIN_LEN' line='PASS_MIN_LEN {{ rhel6stig_pass_min_length }}' backup=yes"
|
|
|
|
- name: V-38477 Medium Users must not be able to change passwords more than once every 24 hours
|
|
lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MIN_DAYS' line='PASS_MIN_DAYS {{ rhel6stig_pass_min_days }}' backup=yes"
|
|
|
|
- name: V-38479 Medium User passwords must be changed at least every 60 days
|
|
lineinfile: "state=present dest=/etc/login.defs regexp='^PASS_MAX_DAYS' line='PASS_MAX_DAYS {{ rhel6stig_pass_max_days }}' backup=yes"
|
|
|
|
- name: V-38576 Medium The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs)
|
|
lineinfile: "state=present backup=yes dest=/etc/login.defs regexp='^ENCRYPT_METHOD' line='ENCRYPT_METHOD SHA512'"
|
|
|
|
- name: V-38577 Medium The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf)
|
|
lineinfile: "state=present backup=yes dest=/etc/libuser.conf regexp='^crypt_style' line='crypt_style = sha512'"
|
|
|
|
|
|
|
|
# sysctl kernel settings
|
|
- name: V-38597 Medium The system must limit the ability of processes to have simultaneous write and execute access to memory
|
|
sysctl: name=kernel.exec-shield value=1 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38596 Medium The system must implement virtual address space randomization
|
|
sysctl: name=kernel.randomize_va_space state=present reload=yes ignoreerrors=yes
|
|
|
|
# sysctl network settings
|
|
- name: V-38511 Medium IP forwarding for IPv4 must not be enabled unless the system is a router
|
|
sysctl: name=net.ipv4.ip_forward value=0 state=present reload=yes ignoreerrors=yes
|
|
when: not rhel6stig_system_is_router
|
|
|
|
- name: V-38523 Medium The system must not accept IPv4 source-routed packets on any interface
|
|
sysctl: name=net.ipv4.conf.all.accept_source_route value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38524 Medium The system must not accept ICMPv4 redirect packets on any interface
|
|
sysctl: name=net.ipv4.conf.all.accept_redirects value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38526 Medium The system must not accept ICMPv4 secure redirect packets on any interface
|
|
sysctl: name=net.ipv4.conf.all.secure_redirects value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38529 Medium The system must not accept IPv4 source-routed packets by default
|
|
sysctl: name=net.ipv4.conf.default.accept_source_route value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38532 Medium The system must not accept ICMPv4 secure redirect packets by default.
|
|
sysctl: name=net.ipv4.conf.default.secure_redirects value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38539 Medium The system must be configured to use TCP syncookies
|
|
sysctl: name=net.ipv4.tcp_syncookies value=1 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38542 Medium The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces
|
|
sysctl: name=net.ipv4.conf.all.rp_filter value=1 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38544 Medium The system must use a reverse-path filter for IPv4 network traffic when possible by default.
|
|
sysctl: name=net.ipv4.conf.default.rp_filter value=1 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38548 Medium The system must ignore ICMPv6 redirects by default
|
|
sysctl: name=net.ipv6.conf.default.accept_redirects value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38600 Medium The system must not send ICMPv4 redirects by default
|
|
sysctl: name=net.ipv4.conf.default.send_redirects value=0 state=present reload=yes ignoreerrors=yes
|
|
|
|
- name: V-38601 Medium The system must not send ICMPv4 redirects from any interface
|
|
sysctl: name=net.ipv4.conf.all.send_redirects value=0 state=present reload=yes ignoreerrors=yes
|