Sebastian Gumprich
bb588bd777
* linting Signed-off-by: Sebastian Gumprich <[email protected]> * more linting Signed-off-by: Sebastian Gumprich <[email protected]> * change line length issues Signed-off-by: Sebastian Gumprich <[email protected]> * replace yes with true in tasks Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * add exception for task Signed-off-by: Sebastian Gumprich <[email protected]> * remove trailing whitespace * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back tasks Signed-off-by: Sebastian Gumprich <[email protected]>
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
---
|
|
- name: Gather package facts
|
|
ansible.builtin.package_facts:
|
|
manager: auto
|
|
when:
|
|
- ansible_facts.os_family != 'Suse'
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
|
|
# the reason for this is so a user cannot connect to a server,
|
|
# that isn't connected to an LDAP server anymore.
|
|
# normally caching credentials shouldn't be necessary for most machines.
|
|
# removing it provides some more security while not removing usability.
|
|
- name: Remove pam ccreds to disable password caching
|
|
ansible.builtin.package:
|
|
name: "{{ os_packages_pam_ccreds }}"
|
|
state: absent
|
|
when:
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
|
|
- name: Import tasks for Debian PAM
|
|
ansible.builtin.import_tasks: pam_debian.yml
|
|
when:
|
|
- ansible_facts.os_family == 'Debian'
|
|
|
|
- name: Import tasks for RedHat PAM
|
|
ansible.builtin.import_tasks: pam_rhel.yml
|
|
when:
|
|
- ansible_facts.os_family == 'RedHat'
|
|
|
|
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
|
ansible.builtin.template:
|
|
src: etc/libuser.conf.j2
|
|
dest: /etc/libuser.conf
|
|
mode: "0640"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- ansible_facts.os_family != 'Suse'
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
- "'libuser' in ansible_facts.packages"
|