---
# Red Hat Insights has recommended one or more actions for you, a system administrator, to review and if you
# deem appropriate, deploy on your systems running Red Hat software. Based on the analysis, we have automatically
# generated an Ansible Playbook for you. Please review and test the recommended actions and the Playbook as
# they may contain configuration changes, updates, reboots and/or other changes to your systems. Red Hat is not
# responsible for any adverse outcomes related to these recommendations or Playbooks.
#
# jaudet-rhel8
# https://console.redhat.com/insights/remediations/86bf2496-51fe-45d8-b4ff-ec02f8b23c47
# Generated by Red Hat Insights on Fri, 21 Mar 2025 17:10:13 GMT
# Created by insights-qa

# Set Account Expiration Following Inactivity
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Account Expiration Following Inactivity
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_account_disable_post_pw_expiration: '30'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      eHVVVkF2TUZGdWJqZFFSalZzYURoTE1WRkZabUptVEhCSlkzVUtSVFZaVDJOVVNXczNWVk0wY0Zw
      VmExTktlVVI2YzFRM1RYQjVUbTl3TjIxdk9ITjZUVlZNTjAxd1ZHcFJVR3h5VGs5UWVWVk5PV0U1
      ZDB3MmJuWm9Ld3BTYUV0dWRrdERVMVJNWVU1WVVtTTNZa3g1VVdodFl5c3lTU3RIVkROTFFVZE9R
      MjU1UTBSV01XZzFVMnhYVkRaaldTdHFXWEY2VGxacVpHUXpXRXczQ2xSVVpETnBja1ZHT1hSc1pI
      VlJiM2xpWlRKNVRXMWFMMUJUZVRCbWF6WkxMek5uVG1oRGRFVlhNME1yYkU5RldFNUlRMVpZU0RN
      clFsSnVPSFpMWkVnS2IwVXhSV1pVVkZWdlVXWlVOR0ptVjFaMlZscFRVV3NyY1VKSVF6SXlkM0kx
      V1hOTFdGZHJSMElyTVVNNE1XRm5VakJIT1hGTGRERkdjRWhKUzNZdlp3b3diMm95YlhJNEwwZHJk
      VTl4ZFZCT1YyaHZkbE5PUkZWclZIQmhhbFZsU0c1WFFtUTRUa0ZMU1hVemIwbFhWRXMyVFZNd1Qx
      cFRiVkV2YVhKeVRHaGFDazVLU0VoUk16UnliMGgwTWpZNEwydHNlWFZxTTBSTE9YQmhiVTVSVUdK
      dFFXOXZUM1V2UkVsSE9IRkJkR1ZPUjNCbEwyOTFVMmMzVW5aT1JGUm9lamdLZUdnMFZVWnpSR1Zw
      WWtsbFVHWXlNMHd6UVVacVNsWTJWa3hYTTAweWIzZEliVnBqY0c1MWVsaGpXR3RyVlVKVE1WaDZi
      R1p4UVRSRGVHSjJaM0JYY3dwRVV6WkhOMmhoYkRsYWRHMUtVMXBoT0VwcmNISnVPV2RXU0RkRFRq
      Vm1kVzVLVG1sMWVWSllkSGszV0VaMFRtWTJlakJOV1VOUlFWcFBWR1ZaWjJ4dENrd3dPVE5JWjB4
      MFIzcFpjR00xT1U0ekt6ZE9Sazl0Y1VWc1JEWjBRV1EwUXpZM2VHTldLMWRsVDNGMFpsUXZlbk5O
      TkZScVJsQndUMjVIYUhkRWNUQUtXVTR6WmxKSFptaERaa3hqWW5WdWEyVkxSSGx2Tm5kVE9FNDFj
      M2d2VG01SlVrUm9aRWhWYWpWM1RFWnJWbGhLV0VKQ04ycFFiRE01VDFKUWVESXZUUW9yZWxCblVF
      RnNUbTB3V1Roa2QydHZSVGRITkFvOWNqZHVkZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80954-1
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020260
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.6
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Account Expiration Following Inactivity
      lineinfile:
        create: true
        dest: /etc/default/useradd
        regexp: ^INACTIVE
        line: INACTIVE={{ var_account_disable_post_pw_expiration }}
      when: '"shadow-utils" in ansible_facts.packages'


# Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86931-3
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      OUJPRkF2TTNGVWMxbFZNVXhFTlhCSVFUVnBRM295UzJZelFrc0tjWFJrVVhVelNVVndkWEZwVGxK
      VE1uYzFWSE5EZW5JNWJrMVhTME5MYTBKcU1sRlBSbGwyZGtkRWFFMWFkVFZXVGpFdlNqZExOa2hw
      Ym5oVEswbDJUUXB1YVVka1NHbHVXSFp6VVdob1J6bFZNSG9yU21GWVpUWlVObUo2Y21kcU0zZEli
      VGx5YkdWRFdFRm9TVVJGTkZCVU0weFZVMVV3UmtaQ1QyTTFPWHBHQ2xWTk4ydFpXbWRTTUcxcWVr
      UmhWa05hV0daVU9HbHJaVEpzTkZNeVZrMVNibkZVVW5CNVoxbFpZbEJwUm1aQ2FWWlJlRk5MY1M5
      SmFVZEZXWGhqV0U4S1pDdGFkMDVKWVVwalJVNHZOSFZpUjNobmJtRndXWFpwV1hsd1kwSkdZV2hJ
      Y1RGNGNWcFFLMEpUYjJGSmMwYzRRM2t6ZFdNeVNsVndkWGx6VjJaVUt3b3JaVEZtU2taS1NHZE9a
      emhuZW14NFYwVlZhMVZpVEhSTGQxcElVVGcwYkUwclUwSldXVTE1U2xoc00wMUxWRTVzY0VOVVRs
      WnhXQzlPVkM5SVlrbEVDa2RGV1U0eFVVNHlRWE5hTkVReEszZFhSMjVoWW1kS1MxRnJRbXhyTVZk
      UlJGUXJjVkUyVkU1ck9ETmthMDlyTTJzcmFYSkNVMVZsYUZGUkx6SmxlallLV2t3NWVEUlVjaTlN
      VldGNmMwUXpabVV3YlUxYWRGcFVaazkxVXpOaldrVjVkbWxsYlRRd1ZFdGxSSFV3ZEZaS2FqTm9W
      VklyY2xGWmJHSk9UMjVvV2dwUk1qWklRVVZvT1hWUE1WZE5RalpLYVUwNGVXWjNia1o1VGpZNGEw
      RXlhMnQ2ZVZoTVdHRTFRVXQxWTNVMlZtSkNZblpTYzA1TU9UWlhRa3h6VkVOTENraFhNWFZVVm1S
      dVoyVXhUbVJIY201SVFqUnNielZaVkZScVYwWkJkRXMwVm5OeWVtZDRPWFJ2UTNFcmNsWTVXVmxM
      VTI1c2VtRXphRGRWZEU5a1NpOEtUa3d5VDNseE5VbGtNR3QzZWtwT1ZGRk1WR0pZTUhKRlNEUlNO
      alJ6U1VsWU1raDNjMUF2ZVRseWMwWlVZUzgzU1dOTFkzaDNkWFl5SzBSTWNURnJLd3BFUm5KbFdu
      aGxVa1JSU0dGaVZXZDNUMU5PUmdvOVQzRlpVUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Remediation where authselect tool is present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when: result_authselect_present.stat.exists

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Remediation where authselect tool is not present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when: not result_authselect_present.stat.exists


# Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86916-4
    - DISA-STIG-RHEL-08-020025
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_system_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      SkhXVkF2TTJsbVZtbGFURUptWXpCUWJuRjNXV3BMTVdSdk9FRUtVbU4xWTAxMFJqWndMM1ZRUVhK
      VGIyTkpSM0poUVVSMWRrcHFOVzl2YldjMmRUSjZjbWRLVG5vMGEyaFpXbFF4V1RVd1EwaERialZv
      Tkc1a1NFdERTQXBQTVdadmFEaE9RWEJrYVhwM1owWjBaWEZCTVhwVVRXbHJNazF0U1ZsWFREQkNh
      R3B6Y1RVclRHd3dWbVYyY2sxWlJVWk9ZbVEyUzFKVlRuRjNNWEZ4Q2xSNVpHTnBhM0ZhU2s5ek1q
      WndWMlJ4UkhKM1p6Rk9NR0ZhTUV4bVdFUnlRU3RuWlRSUWFVVXJkREJ1Wm05cVJITXhaVmxrU0dG
      emRrbFBWRXRJUkRRS1YxRTVTa2hWZFdORlEwNUdWV2hPUzBsTE5tSmFWV2R6UmxCck5VcGFWbGxu
      YlRZM2FsQmtabkZhUkhOSGJqVTNORU5zU1RkWUsydEpOSEZIZUZKcmVBcDFSMFpwVGtGWU5FVXJi
      bEZSVW1KMlIzaHNVVUV2UW5CS05reERVVk5SZGpSTlJtMVNRelJsYjJOU1MxbFpabmxIVG5KRVdX
      cG5ORGQ2VUVSNVVqRjZDakpOUVUxaWJrVk9jM2xUY1hwd2MxUTNiMjE0U2paUGJWSnpOWGg0UlRW
      cmRIWXpiak5OZHk5WFEyTmlMMHd3WkhkR1ZuUlVhbTF1U1hCNGJXeFpaMmNLYkhWVk0zVlVWRmxH
      TmtSNWNUVjNibmw0V1Zsb01EQXZjVlF6U1VOTVlsZExTVVoxUmtOT1VERklZMGQxYzNSc1VuUlBj
      amxEV1V4M2RHcDFUbEU0WlFwb0swWlNkSEJ1ZDNOblNsTlplbEF6YjJoSk4wZ3hSa2RzYnpsNlF6
      bHBVa1JWWkVWMWIzaDFWMG80ZGxWdFpFWkNkSE5GZVZkR2VWSXdTa1o0Vm1SdUNrRjNja0pqVG5k
      SGFXNVBZbWRhU1RFd05HeFJNbVJUTDFveE9HcHJXVU4xUWl0WFEyUlNZalpWYkhGeFZuUndibnB0
      VWpsa2VsTlZPV0ptUm5KSFZFVUtjM04yYTA4M1FtazJOR2h0VTBWVk5uTnFVMnd4VDBWT1dESkZW
      R2hWVURjM05rTjVTMnBZVlRWWlJIUnBjSGhyYTJRNGN5OHJVeTg1VldSVlJUTkNXQXBzUXpoeWNF
      eERZemhyUkhWNEwweFVSakZST1FvOVpEUjNjUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Remediation where authselect tool is present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when: result_authselect_present.stat.exists

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Remediation where authselect tool is not present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when: not result_authselect_present.stat.exists


# Set Password Maximum Age
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_debian
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Password Maximum Age
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_maximum_age_login_defs: '365'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3pRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      cEhRVkZCU21sUkwzZHdURTFZTjJKNllqZFhRMnRYY0cxR1QyRUtVekpxTTBKcVlqbFFTRGhhUmpK
      TWRFbGxiRVFySzJGb05HZEdVbWxwTm1WMFdETklNVkphVVdGeFpWQXlNM1V4VTBkc1UxQmpVVE5I
      VURkekwwSmhWZ3BvTkVGb1dIUmxRamRhUzNoRGFsWnFUa2hEUjBOTmQxcEVSa3dyYWtFeGJGcHFT
      RTFyY1ZsSWEySjVWMEp5VW14WU9YcFBhM2xpVDNWVFowc3dhMlkzQ21OSmQwVjFUalpVU2tOS1VX
      dG1abEpLWkhReVVXSjFVVGdyT1dZMVZFOVFNM0ZhUjFKWFRYSmpaMk4zTTJJNWFEazVWV0ZEVDB0
      WlVHMUJUbE5vTVc0S01HVndaWGszYWxWaE5UaDBhamQ0TmtGdE9YTXhlV2czYW5WUkwyUmpZUzlR
      YTBWWWRYUk1aV1ZPYzJWck5URXdiMDVEZFdsNU1VcEtTVmhzT1ZOU2N3cGtZM0JWY2tOWVdIcFNk
      V3RSWkhSelJXOVVRWEJWWTI4clFVMVJSMGx3T0Vwc2NUWndkbk0xUkRGeWVHZDZNMFZCU1hkS1ps
      VlBUekZqVkdkaVZsY3lDbXhXY1RaU1NFeENibkpIVkVsNVkycEVNR3dyY0hVME5ESnZSelp4WVda
      elFTdFpSbmhVTDNadWRHOHpVV2xIYUROWmVWUjFSRlpqZFZOWGFtNUJhRkFLY1RkVEwzSktPR0Z1
      UjJGeE1rSXJRME5FYlRjNGNXMHhlVWhYV1hSd2JVbElka3Q2VTNKVFJ6VmpUa3R3WmxJeE5IVlZO
      bkp1YzBkcGRHNVdXV2RPZUFwM1kzVnNkVUpxVDJveU0yTkxjbmsxWjAxcWNrOWhlbk5STlRsbmNF
      eFphRk5MVEVwSldUWlVRMmg1VkVkSFJESTJUMFl4T0VaRWRYTmFUWFp5VkVkcENsSXhZbWRLT1Vs
      MVdUZE9ORVo0ZVhaVlVXMVBkMUZvVjJaSGJUVkZNR2RWTDA1VFJXUndNMmQ1V1ZocGVURkVOSHBw
      TlhOVk16TnFWbkZxZGtjd1RsVUtOemxWU0hSMlpraElUMVZRY1M5WEwyUkVkR1YxUkZCdmJuVnJT
      SE5sZEV0dVVUaFJMM0kzYWxkQ05uRmtPWEoyUzBaeGFISTRUMEpMVld0TFNXRlpMd3BUU0hKbVZH
      bHhia2x3ZUZGSFlYYzRORlpDTHdvOWVISlVlZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80647-1
    - CJIS-5.6.2.1
    - DISA-STIG-RHEL-08-020200
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.9
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Password Maximum Age
      lineinfile:
        create: true
        dest: /etc/login.defs
        regexp: ^#?PASS_MAX_DAYS
        line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
      when: '"shadow-utils" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_dictcheck: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3pRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      STBRVkF2YWxKeE9HUXZSQzloYlZwRldIQjRVREJJUlU0MVpWZ0tTa3RXWW0xNVRHdFlhakZWVFdw
      NmFuRkRTSGx4UTBZM055OTVOblZtUlRRMmVrOWxPSFl5ZW5oWU5qTXljekp4YTJWWlRXdzNTR2RJ
      YURGNlNWbFdhQW81T1VORFQydGtZMlZPYURCWlpYVkxaMkZwYkUxR0syVnZhMFZLTlhkc2RIbzBi
      MHRDUlhCU1dsRkxWV2hrSzJsa2NVMXRTMWRxYzBrNWVIRmFReTlMQ2xaWWJHdGlTVzVIZGpZemNr
      bFZSbXRUUkhSelpXZFBiM0lyT1c1d1lYUnRNbFZRVkV4Q0sxQnJOVWRSUzFSMFNHRlJaMnBCWTJk
      T2VGRmlOek00WW1rS1NrTjRkQzlOZFVGUVRFTm9jRzloTW5ocVdqVlZSM2haZURWak9UTnlRMDFM
      T0hGalRuQmlkVVppVEhKeWRHRktVMHcwZUc1UmIzb3JXWFZPZDBNemNBcFNSMlZhTlZOa1NXOUZh
      Mlp6UW1SMVRYVmhaVlF4YnpsaWVXUXpVekJCZGxadmMwUllSbWgwZGtkblZFeHpURlZ5YkhrMFQx
      RjJVemxRWVhGVGFEbDBDazFoY201dUwzQnRWbGQwUzB4R05XaExRM0pWWm5BMWIwcFlWazVYUmtK
      SlZFbFRVbWxJV1VSVFUwSTVNVUp5VkVoemQycDBTV3RsTDJ0Q0swOXZVa0VLVlZORFRsQklUV0p1
      Y1hFdlJtb3JSelZZY1ZsSFFucDFRbkJMVERsc1lrcEpWME5PVlUxeVFqbFVRMnR6VEZvdlFVOWpV
      RmgxYVZka1RqaHdTSEJvTUFwSmVWcDJZbTVYZFROWWVub3lkelJ0VGxKMVEyRTVLMDVVWmxCamNG
      cHNVMjVqZWxOaFpuaFhiMVJ2ZEVOeWNuTlJSVVV4VUc5Q1YzY3lZV1Z3V2s5UkNuZDZUblJ0VUhS
      bFprdExkRVpVYkU5c1ZXaDFiemd4U0V4RlpYbzRkbmhzYjNOMmJTdHdjVzFHTjBOb1V6bG1UbkpY
      UkhWaVl6RXJUV3hNU2xWMVltWUtWRkl2VFRscVNsQkNLMWxtZDFaa2FsTXdhVkpXUTBKMVRISXhZ
      blJXWTBGQ2RXWjBORTVWVFNzeGIyb3hhMUpaU25aV1FtNHlaMU5YUjBSMFNuWktTQW8xTmxRNFQy
      UktWQzkxTmt4NmNVbzNTekIwZWdvOU5FdE9Ld290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86233-4
    - DISA-STIG-RHEL-08-020300
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_dictcheck
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words - Ensure PAM variable dictcheck is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*dictcheck
        line: dictcheck = {{ var_password_pam_dictcheck }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Different Characters
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_difok,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_difok: '2'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      OUlXVkF2TVhsTmMxUm9ORzVqUkVsblVHRlJkRXhaWTFWM1JIVUtSVE5IV25OcWJXSm9kMFZtVUV0
      S1UweE1NQ3MzZWtwalUwOVVMMFozT1V0R1dHRTVRbVpvYVVOVUwxRnpNV2MzVTJSTlRGTTBWbWhE
      TDI1a1ZFdGtiZ3AwTmxKR01YQk9UR2hWVEVwT1owdFlkVGR5VFc1dFRFcExRMWh6UnpaQ1lsaE5O
      SHBEVkhocE4xbDZRMlpxY2pBNFJXTXZTbFZhVFRKcUwwcENjSGwyQ21Sa1pIcGpiVk5QWmtkVk56
      STFXVXc1YjBWclRsSlVUVE5ITkZGelQyZDFhVEZOVkRWVlVEWlRRbnB2VERSUlpEUXhRM1pzWkM4
      eFMwZHJNa1pXYVhBS1R6VndNREJPYVVrNVRsSTVOMjFyWkVabFVITktkbFZrY25aTFYxSnRWelY0
      ZWpsNEsxTjRXVmwzUVhsVUsyUlJSWE55UVV0Rk1YSkxlbXhFVDJRM0t3cEpObTFGV0ZjME1tSmhi
      bWR1WTJKR1lXbDRNR1ZrT0RONk1scE5abEpHVVRremVURmFaa3hFVkUxQmJYUldaM0JXT0hOblVX
      bEhNR3Q2ZG5KaVVVWjZDbWhEYmtoM2EzVkVVMVJFVlhWbFNGbFNZMWhMTDJkNlNVYzRiVTR3ZW05
      elIwbHBWblFyZERJcmEzVkdSSEp2V1Rsa2MxQm5ZMmg0TVVWM2ExQndiV1FLVTAxb1NVMHdlVWh0
      YlV0b1l6ZDZlVU5WZWsweVRTOW9UVkZzZG5SVWVrbFBiVTlTUjNSMVZsZENNMWd4YlM5UlVXTXJV
      MG8zUnl0dE9FRnNNVmhUZFFwSU9GZzFWMUp3V0c4MlVIbzBVVUY0WTJ0RWMxWktSR1ozV1dKRVIw
      RmxaMjR4WjNkQ2NFVTJLM0p1WnpNek9UTnBNbEIzU0hWUGFGTTJkMmxPZVhSdUNrSk5UekZOY0Rk
      cVVsWnFOSEZsWjNoa1lYbDJSbU5UVFVORGFFZHJiR01yU1hBelQwcEdia3BNVVhNclUxbG1PRlZx
      YWtwc2VuSm1Oa2ROYUhsUFMwc0tkMVJaVlhaNldubGtlSFJRY0VGRGJ6azJVM0owWmtkYWExTXZk
      VVZwZFU1NVptWnJiVWx3YVhsek9YZ3ZlbWhwYzA5bFNuTnhjRnBRZVZKbVRVNXJlUW8zUjNKb1Vt
      b3pWRTluWm5aV1N6UkJkbTVQZFFvOWJHVXZSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80654-7
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020170
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters - Ensure PAM variable difok is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*difok
        line: difok = {{ var_password_pam_difok }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Enforce for root User
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Enforce for root User
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83377-2
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      aDFORkF2TTJGSWJrdEhhUzgxWjBGMmMzRlBORzR5VWtaNVIxUUtVSFZPVVdOd1RHMHhaREpyU1VG
      RFFsTlJjREZNYlVoS0wyWklSMGxKYTA5NlQybFFlVFEyWkdkSlNrbFpTMGtyU1RZM2VWUnRZMnRs
      SzNkUVJYRjBhd3AyY1dkRlJIRjBNMEpIZEVNMVNuaDFaMk5GWlhrNFpWaFBVMjUyTldzMmFsSTBk
      RzlGU1dKVWJuWnJhQ3RxZWs1NVNGTTBaVzlRV0dFMmRFVXJkbTVtQ214alFrWnNRWFZaT1VsdGRr
      RTBhRzFKWW1aYWJTOVFRM2w0VUV3eGNIQTFkekUwU21kb1RIVlNTVU5ZZWs1MFNHVlhNMmhMZGts
      RFFrZDVTVmRSWm1RS0wxQTNRM053VGtSd1prMXhhbmR6UjNwVU9XaE1UMVZ1WkUxb1ZuVmpRekZT
      VXpkRFJGTkpUM0YzTkN0cFQwbFRRa1UzTm1kd0wwRXZVV2hJVGtwMFJncHdNVFY1Y1c1SE0wOXlO
      SFpxYlcxRGQwb3JXSEJhY0hJM1dYY3ZXR3hOYkVaT1dHbExlalJ3ZDNabFkyeHRhVlUxUzJScGRT
      dGxNRVZ5VXpONlZHY3lDa2cyTW5relVXeGtNMGhUWkVVd2NsQmhaaXR3UTFFdmRXVlJhbVpsUjJO
      dFNYZE5SRFUzV0VwclFXZFNiMHh2Y25obVowUXphRUpaTVV4d1FVVnpSRWNLYUhwd1owUTRlbU5a
      Um0xcWNqUnZkbnB2SzBjdmMwTmlTWGh4T1V4V2JITTVSVXRFZDFwWFIxZDVlV3BxTTNNcldrMVFa
      azR6UmxSd2JHTnZTVVU0UndwMVlUWkNVbUppTkdadU1Hd3JTMnh1Y21oQ2NuUXlRVm8zTlRkcllu
      aEdlWEF6V0VSWk5WSXlaMFpCUjBwVlVFTldSVVJLUjNoWVFUQlBkVkV5T1RkWUNrbDNjVlJQT1ZO
      UVdtZFJaemgxZUdaNEswaG5kSEZVTURCSVdFVTNVVUpEV0hWQ055OHhORkJsTjA5RmMyNXZUMGRI
      TDAxUGNXeEZVWFJyVm5jdlNrRUtRWFpKVFhrNVRuVmllWEp6ZDFkR2RtNU9kR3hITURneFdrSnFi
      M0Z6YTNWSGVrMHZMM2t6TDBabldGWm9hRmd3YzFkTGRsRnBhalJaUXpJcldHaDFXZ3B3WWtsT2RI
      RkRVemR2WTBwalpIQjVUazVsVHdvOVRFOXhLd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Enforce for root User
      lineinfile:
        path: /etc/security/pwquality.conf
        create: true
        regexp: ''
        line: enforce_for_root
        state: present
      when: '"pam" in ansible_facts.packages'


# Set Password Maximum Consecutive Repeating Characters
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Password Maximum Consecutive Repeating Characters
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_maxrepeat: '3'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      OVBkMUZCU1c1MlVFWkpibkp5VVhrM1NWVm1iMUJJYlZwRFdrWUtVelpaZWtwSGNVZEhUMDVYWjNw
      VE4xVk9lV0psTDJKME5rTkhOSGd5VldRMGRGSkRVbmhJZUZZeE4yUmxUSE41TVZKbVRWSlZNR2RR
      V1hKYWIyaDZlQXB6VmpOMVRWaFRPV1JpV1N0ak1EUTBTVVoxWTFGbVdGZHpaVmhXY3psRGVFcG9N
      R1JtTTJoSk4xUm9XRnBuVVhwaldtVXJkMjFTYm1Ob2VrTnhZVFF2Q2pSUWFGY3hOelowVml0QlZ6
      ZEdiVVppTnpkd1pUQTNPV0UzVGtOaWVFaEpVa1J2Y2tSdWFsVXJkbWRxWVZkTVUyMWtTVmRKVmpS
      dVNVTm9NWHBFSzJrS01taFRiVWwwVEV4V1MwSkxTMEpuUzJsSmRIVjFLMUJ0YmpWYVUwcHRkUzlr
      VFV0RlNGQTNkeXMwYkVGSVZXWktMMkZrU2pnM2FXa3hOV1JGTTFkMkx3cHZaRFIzUlVwbFRGUXlL
      MWtyUlVKdWRXRnFlbmQxTm1SNlFtSXdVMFJ3VUVSYVFraDVURlpQYjJoeFVTOVpOVXh1UWpjd2JF
      TlBhVFpuVldsaU9EUkVDbEIzVkhwUWNsZHllbmd5TkRaeFJGY3lXREpNYkcxdFdYcFRZVlZpUVhO
      R1FXMVJRek50Y20xRVNrd3lPVzh3WWk4NFNXOUpTR1ZUT1RKdE0xYzFUVTRLVURSYWJVbFpUM1ZO
      VlRoVlJuTklSRWRpWW1wd1RGcFNXRFJyT1hCdE0wNUJOVkJCZUc4ckswRkxXbVF5V2toU1kxWTVS
      MEpJT0hkRlkxaENObWRHZEFwdWVsZG9PRVJDYUdSa05VOXllblJsYTJWSk9IbFZXVmxLUlVjeFky
      RXlhbWhTUkdWMVVtUTBZbG8xZW5kbldGbGljMjV2UmtrMFYwWjNSRGh5T1hSR0NsRnVWV2d6ZVcx
      TWMwdDFjVTVwYlRjMlpsb3JSV2hwUnpWVGNIY3dSVzgxYVM5NksyOU9NV05wWWpabFpHbHpja3RY
      V0hsQ2JtcDJZMDVtZVRSSGJFUUtkR1ZyUTJscmJWWnlOMFk0TkZCd1p5OUhhM0U1WTFCVFdYUkxh
      bkI2U0UxR1JYRTBVVmh5WVhaT1RuZFdNVU5CYjJKQ1RteFNkREZ2Ym1wclppOXlVd28xTVZsbVox
      bGxSblJWTnpnNE0wcEtWRGh3VkFvOVdFMXBLd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-82066-2
    - DISA-STIG-RHEL-08-020150
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Password Maximum Consecutive Repeating Characters - Ensure PAM variable maxrepeat is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*maxrepeat
        line: maxrepeat = {{ var_password_pam_maxrepeat }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Different Categories
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_minclass: '4'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      UTRPRkF2YVVwa1ZYRTNiM1JuZW5kWFVERlNlV1IzZFZGclJHa0tWalkySzB0SWVqTkRhMmxUTW5R
      cmVrOXBjRXAzVmxsR2VrTm1OREZ2UWxaeWRGQkVjVTQwUkZvelVVUkRkbEJrVkhNd2JrdHZWRWh6
      VDFwc05qUkRLd281Y21OdmRuTlBORGxNUjI1RVlYQnhNMjlyYW5aemQyVXhUV3hwY1hZclJVeHdk
      MWQ0Tkdkc1dUVnNUM0o1UkZoWldGSlZaazlxVDFZMVVHZFFhSE5RQ2lzd2VIaFRjbkJCVVdwclRF
      TllObk55YmpWV1VHTXdhRkpKTlZRNWEyOTZVWEJRTjIxb2MzQjBhMElyVFhkbE1rTjVaRGRXUjBW
      a2RHOTVhVlV3T1ZVS2VIZFFka1VyUVdVelVIVmhOMlZ6TkN0RlREWnFXbUowZUhSa1dVeDNSalpX
      YmtsMFptSlFPR3hOVWs1M1kzUmhUa2RGVWxodVJVNTNXblp0Ukc5VU9BcHdkRFkxYlRaeGJtRjJh
      VE4xYnpBd2FXeG9abFZEZGxWcWFuVmpUalZwZWpoU1VFVmlObXR5Um01NU56aHBkMDB5TmtaNFIy
      a3hOWEJWZFhGeFFURkVDazlhVW5WdE1ESm9hakZsV2tOclducGxPREJKYkZBelVrNWFUV3RYT1M5
      QlNXZzRUV3RQWTBodWR6UlFVWFJaVGt4MVEzcGpVbVEwWVU5ME5sTmpOWElLWm1kaWFsazJLelJz
      UWxsQk1qQXlhMFZzVEZSeWNHaFBSM0ZtVld3ek1XUklRM0JDV2pKb1UyOUNSMU5aUW10SWIyVTVR
      aTlhWkdkcFRqbHJNMk5zTndwc2IzTTJZV2RWVUhSc2FVb3llRTl2WW0wdlZEWTViMEpOU2pGeFlu
      RkpZWEZIZW5CSWNXeERZVTVTWTNNMFNVVjJjMUUzTmtrMGEyVjFObTluYXpWMkNsbDVWRkZ5VmtZ
      eFVXMVJhRTgwTWpkd04wUldUU3R5YkdwTGJrbHdVVUprV2prM1lsTXZRWEl2YkRjd01pc3piV2ho
      VEdobldtUjVTR1JSVUZoblEwVUtSbTgwZWxvMGIzUkljRGxRWlRaaVpsb3dlV2RNTm5WVVFrZG9i
      R3haWVZSNk0xY3lMMkYzUldaTFVtZGlkWFpJVVVsbFlYcEhjbmgwYXpWUFlXcHZNd3BoTDNWeVdV
      dHlkblJaYzNreFpUaHVjbU5vWWdvOUszcEJiZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-82046-4
    - DISA-STIG-RHEL-08-020160
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories - Ensure PAM variable minclass is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*minclass
        line: minclass = {{ var_password_pam_minclass }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Length
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Length
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_minlen: '14'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      MVFkMUF2YVdzMFdYVlRaa2RGYzBadlR6SXZMMWx6VHpKU2JUa0tjbXhwUjFKR2FFSXJUVTByZVdW
      aGMycEpXa3hFZWl0WWJtb3dUWEo0WldWdE4wcDFOR3RYUzBOb2JIRkZhRXcwTkhoVE1rSktOVmxL
      Y2xSRU4wNWxWQXBCUlhGckx5OVBXU3RIVkhNNVRtcHFkekJsUmxNNE4yYzVXQ3RIT0VaU05rZ3pP
      Rk13Wkc1Vk1HMTVTa0l6YjFWUGRuQTRNSHAyVWl0T1lXbHliazlNQ25nMFYwVlBSVkpKT1haS2JY
      TnRlR1ZuYkVSaFNrZ3hMMG93V0ZOMmVqWm9hME5PVFhoM0wxWlBhME4xZDBRMU0za3pTMVZqWlZO
      aWNUZG1ZVmxEWjFNS1ZGZG5Rbk56YVZWNWN6ZEdVVkIwZUU1eVExVklOaXR0VlZSSFNXWnRPVmRY
      VjJOSlMzSnJVa3BVUXpWSVdXTjJLM2hxVmxkMGJFcDVSamNyUmxCMmJBbzFNM2RMYVhSVU5WQmxk
      R2dyVTJGM2JUVm5VbE51ZGl0S2IwWmpUMDhyTm5JMFoxVkxTVkZsWVhWQ05rTlFPRWx1ZW1OQ05u
      TkRjWHBWZVU5eVRrZEVDamhrTjFocGVWWktSREozUWtSa2FXdHNkbnBUZERGMlRIUnlNMlZrYmxr
      eU5uSlRNbG9yVURWU2FGSm1RVVk0WVVZd2VtSXpTWFJ3Tm5Gc2NDdEJNVEFLWlc1S1psTjBjRVZa
      VUd4TksyMVROell2ZVhRNFVqWmlNWHBpVkZFM1ltNDBlQzlqTUVzMVJESk1ZVU4xY2xKUFNYZDZi
      VVF3UkZwVFZsSjFNV2RrY3dwM1drVkVXRmMyTkVoVGN6Sm1WRXBuYVcwdllqUnlOVW94Wm5FelRU
      SmtkR2czUTBsR2N6RXpaWGhaVUN0MFIwaEhNamhRWVZOUGRtWkJTSE5rVFZkWENtYzFVbVJ5ZFVF
      eVpFZGxlRUZOYTFCSk56WndhalZOTjBWQlFYaGpWVVoxYTJSSVFuUnBOa3BoUjJ4ck9WWmFUa2hL
      TDJkMVMyUmlXa2hJZVVveGQxWUtaMGgyWVRRMWVtMXZXV0oxYWtOSGQzWmlkemxHUTBOUk0wdDZi
      M1pNVTJoUFNXbFljakZvYTA5TGNsb3diRFl5U0RkYVN6WkVhMmgwY0dOTGQzVnlVZ3BzU0doWlVF
      ZzVRVFZPVUhkc1ZXWkdkSE42V2dvOWIzYzFSd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80656-2
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020230
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.6
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable minlen is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*minlen
        line: minlen = {{ var_password_pam_minlen }}
      when: '"pam" in ansible_facts.packages'


# Limit Password Reuse: password-auth
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: 'Limit Password Reuse: password-auth'
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_remember: '24'
    var_password_pam_remember_control_flag: requisite,required
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ODNNRkF2YVhvME9ITlNTbEJrYm1sSGNGSkJhMmxpT1dWblpYRUtNa2xaZFRSTWR6UnNSRFpUYUdr
      d1dGUk1XV2RtVlhoRmNIaEZlbmt5TUM5Q2JuUnFUM0JtVURkVUswTmpZUzk2T1M4eU9FcFFiRkJZ
      Vlc1c1JHaDJkQXBSZEdZd1ZVaFlkR2t4Ym1GQ1oxTmFOMmxCU2tKck1ESmxaVlV2V0RjNGMydHRj
      bkZsYkM5d09WTnBNR055Tm5OcGFraDJlRUpOYm5WTFMxaHlSMDlaQ21veGFWZE1Tell3Y1dSSWJG
      aGllVmxDU2pKRk5URnFaRTFTWlVKRE4yRklUVWxqTkVJNE5qbEJOVnB5VFVkeFpUUnBhMnB2WkVG
      Sk1HNVdORFpSWjJzS2NuRjFkV1F2WkhSMWRVcHpRMUJFVkhFMVdVTkhNVFkzWWxWaWVUWnpiMlp2
      TUhKRmExTnZVVlYzWW5SWlVtZHVkbmgwVkdWMVRqRXdOalV6Y0RNeVJRcFVjekF3UTFaME1WWXdV
      RXBHV2pWTmJHY3dla0oyWkN0dWNUWmhUM1JHUW1WdVIxSmhjalU0Y2tkRFZIWk1iRmRGU0hOTFV5
      dFNMMXBPT1hJdmNuZEJDbWM1TTFoNVpqZHJja3h2WWtOMlJuUlpVSE5vTmpRck5HbGhRazF3Ym5v
      ck5VNXpibnBCVkU0MGJGUTBZelZDYmxJMVFXaEdZemRLT1VWM1UzWnZkQzhLTnpkalZuaDFORWRF
      YTA0eGVUa3diMUJyVVdoVVEzbE1Wemx3WWl0NE9XOVdkbmMyTjFjMVRqWlpaVUZuYkhCR1RWRlpO
      aTkzUlRObVJtWnJhR1F2VmdveE1HcGlPWFZ1ZW0xalNITlNTbFJPVmxWb1YySnRkbEk0VjJwUFZE
      ZDBjRmxRVkUwNUswMXJRV1kyVUhWbU5rMW5jbWxWVW1WeU9VUXhlakpFUkcxWENrUlFPWEppVGsx
      d1pYY3dUak14WWxkNGF6bFhaV2xvVHpoTWFYbHFSbmwwV1dOYVZHRnpOMXB4VkZkbk1YQlhaekJV
      UmpSTVNHNVpZV3hxZG1OcVJWa0tTM1ZvYzFsM1FWcGlNU3R5YkhKSGIySXpZaXRyTms1TlkzQmFZ
      bE5IVEhoSVl6aHNZMlF3Y1hKalExVmpVMmhDT0dGclpsRlZOVUZ5TTJGTWFqVmlVd28zY2paSmNs
      cERhMVZFTUZvMllpOU9ja3RWYndvOWJrVllOQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83478-8
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020220
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.7
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: password-auth - Collect the available authselect features'
      ansible.builtin.command:
        cmd: authselect list-features sssd
      register: result_authselect_available_features
      changed_when: false
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so using authselect feature'
      block:

        - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: 'Limit Password Reuse: password-auth - Get authselect current features'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: password-auth - Ensure "with-pwhistory" feature is enabled using authselect tool'
          ansible.builtin.command:
            cmd: authselect enable-feature with-pwhistory
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-pwhistory")

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists
        - result_authselect_available_features.stdout is search("with-pwhistory")

    - name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so in appropriate PAM files'
      block:

        - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/password-auth

        - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0] }}'

        - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: password-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: password-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                insertafter: ^password.*requisite.*pam_pwquality\.so
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - |
          (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined

    - name: 'Limit Password Reuse: password-auth - Check the presence of /etc/security/pwhistory.conf file'
      ansible.builtin.stat:
        path: /etc/security/pwhistory.conf
      register: result_pwhistory_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured in /etc/security/pwhistory.conf file'
      block:

        - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember parameter in /etc/security/pwhistory.conf'
          ansible.builtin.lineinfile:
            path: /etc/security/pwhistory.conf
            regexp: ^\s*remember\s*=
            line: remember = {{ var_password_pam_remember }}
            state: present

        - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember parameter is removed from PAM files'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if /etc/pam.d/password-auth file is present'
              ansible.builtin.stat:
                path: /etc/pam.d/password-auth
              register: result_pam_file_present

            - name: 'Limit Password Reuse: password-auth - Check the proper remediation for the system'
              block:

                - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/pam.d/password-auth

                - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
                  ansible.builtin.stat:
                    path: /usr/bin/authselect
                  register: result_authselect_present

                - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
                  block:

                    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
                      ansible.builtin.command:
                        cmd: authselect check
                      register: result_authselect_check_cmd
                      changed_when: false
                      failed_when: false

                    - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
                      ansible.builtin.assert:
                        that:
                          - result_authselect_check_cmd.rc == 0
                        fail_msg:
                          - authselect integrity check failed. Remediation aborted!
                          - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                          - It is not recommended to manually edit the PAM files when authselect tool is available.
                          - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                        success_msg:
                          - authselect integrity check passed

                    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
                      ansible.builtin.shell:
                        cmd: authselect current -r | awk '{ print $1 }'
                      register: result_authselect_profile
                      changed_when: false
                      when:
                        - result_authselect_check_cmd is success

                    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: custom/hardening
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
                      ansible.builtin.shell:
                        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                      register: result_authselect_features
                      changed_when: false
                      when:
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
                      ansible.builtin.stat:
                        path: /etc/authselect/{{ authselect_custom_profile }}
                      register: result_authselect_custom_profile_present
                      changed_when: false
                      when:
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
                      ansible.builtin.command:
                        cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                      when:
                        - result_authselect_check_cmd is success
                        - authselect_current_profile is not match("custom/")
                        - not result_authselect_custom_profile_present.stat.exists

                    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
                      ansible.builtin.command:
                        cmd: authselect select {{ authselect_custom_profile }}
                      register: result_pam_authselect_select_profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
                      ansible.builtin.command:
                        cmd: authselect enable-feature {{ item }}
                      loop: '{{ result_authselect_features.stdout_lines }}'
                      register: result_pam_authselect_restore_features
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_features is not skipped
                        - result_pam_authselect_select_profile is not skipped

                    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - result_pam_authselect_restore_features is not skipped

                    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
                      ansible.builtin.set_fact:
                        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
                  when:
                    - result_authselect_present.stat.exists

                - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
                  ansible.builtin.set_fact:
                    pam_module_control: ''

                - name: 'Limit Password Reuse: password-auth - Ensure the "remember" option from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
                  ansible.builtin.replace:
                    dest: '{{ pam_file_path }}'
                    regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
                    replace: \1\2
                  register: result_pam_option_removal

                - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b
                  when:
                    - result_authselect_present.stat.exists
                    - result_pam_option_removal is changed
              when:
                - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_pwhistory_conf_check.stat.exists

    - name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured in PAM files'
      block:

        - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/password-auth

        - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: password-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: password-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: password-auth - Check if the required PAM module option is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present

        - name: 'Limit Password Reuse: password-auth - Ensure the "remember" PAM option for "pam_pwhistory.so" is included in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
            line: \1 remember={{ var_password_pam_remember }}
            state: present
          register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_add
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found == 0

        - name: 'Limit Password Reuse: password-auth - Ensure the required value for "remember" PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
            line: \1\2={{ var_password_pam_remember }} \3
          register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_edit
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found > 0

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_present.stat.exists
            - (result_pam_remember_add is defined and result_pam_remember_add.changed) or (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
      when:
        - '"pam" in ansible_facts.packages'
        - not result_pwhistory_conf_check.stat.exists


# Limit Password Reuse: system-auth
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: 'Limit Password Reuse: system-auth'
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_remember: '24'
    var_password_pam_remember_control_flag: requisite,required
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NVpRVkZCU2pWYVdHeGtZbFJWWTI4clRtdDBjbUZ4Vkc1NlNsVUtWVmgzY0U5UFYyODVNbEJGVjBw
      bFVqVnNWRWRFWVVwNFNGQmxSMEY2TW5oVGVVZDZVbGhWTkhkR2VXSmtia1l3UkUxTFQwSXlVako0
      UVhCbVdVczFkZ3AxZW5kNFZFOTJTR0prTVcxcFoyMUhTVzlqWW1SbmFEZFROREZxUTB0UGVWUTRi
      R0puUlVKSmJIRnRTWEJVT1VSR1FVOUdRekpuVVhWb2EyaFdNbmMxQ25Od01IVlpaRWhJTUdFNGRG
      SmhTRE5NZGxCRlZXTXdjVTlvVW05MUwyOVZOemxQWTFKVWFtcElSbUZDTVdSNFZWQnZXRkZTV1hs
      VEszbEhZVGRpTUZnS1ZtdEVTMUZoYWtGUmNubFRSemd4ZGxsQ1UwUlFaekJXYTNNMlZIQnhhMkY1
      TjFSWmJuWTJkamt5ZEZkU05XVkpRa0ZIYUVsQlpWcG5SV05JVlVGRldncEdNRm94VDFsNU1UbHFU
      SEZ4TjJwSGRHcERUekJ5YlZKSlEwZG1NV0kyVVVFMVREaHJMMUozUVVobVpYRktNVlJOUkZKMVlt
      NUpVMGRJYUZoT1NXUm1DblpwTVdaTlprWjNkbk5pVlhKNVJHOVZURlJITDBKYVF6ZDJWa0ZMTkRW
      YU5pOVBkM1J6UTFkak1rOXNSREZ4Y2xJeFIzWmlUMGhvYTFKaGRuZEVZM01LZFZoeGRqTlhXRVpx
      V0RWa1dEYzNZbEJqZVdkdWJHRm5USFZTT1dGMlJ6TnRkMGhCZUVseGJ6VXpURmhuWlZoU2MyRlZl
      bUk0Unk5VGFFRjRSakpLYmdwWU0wTnNOM1J1VW5veU1sTkRRblk1UkZGbGFtOVZPRFpMYlRsYVNs
      QkljRVE0T1VOWWFtNWFUWEZVTXpseVdEbDNhSGRXYVVjd1FUbFpMMGROZVZsakNrVXJMM2h2VDNC
      elpWRmpSbkZZZHl0RmRHeHZSa3Q0UlVKM2IzSnFMM2R6V0hZeGIwcEZUVlV5ZERNMlNqUm9iM0Ez
      YXpKdk1WZDFkMFI1VkVwbWVrVUtNMEZZWWpsdmFHeG9TblV3VDJKVVdEVXJjRzF6U1dKTlZWZG5a
      MkpGY2xjemF6SXdlbk5OYkZJd1luRm5RVE5YWkd4MVZGTm5lRk5DTURoV1NtdElSUXBrU0dOQlVX
      bGpTakZOYVZrelVIWlllWFJwVWdvOVZVRlJWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83480-4
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020221
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.7
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: system-auth - Collect the available authselect features'
      ansible.builtin.command:
        cmd: authselect list-features sssd
      register: result_authselect_available_features
      changed_when: false
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so using authselect feature'
      block:

        - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: 'Limit Password Reuse: system-auth - Get authselect current features'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: system-auth - Ensure "with-pwhistory" feature is enabled using authselect tool'
          ansible.builtin.command:
            cmd: authselect enable-feature with-pwhistory
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-pwhistory")

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists
        - result_authselect_available_features.stdout is search("with-pwhistory")

    - name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so in appropriate PAM files'
      block:

        - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/system-auth

        - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0] }}'

        - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                insertafter: ^password.*requisite.*pam_pwquality\.so
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - |
          (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined

    - name: 'Limit Password Reuse: system-auth - Check the presence of /etc/security/pwhistory.conf file'
      ansible.builtin.stat:
        path: /etc/security/pwhistory.conf
      register: result_pwhistory_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured in /etc/security/pwhistory.conf file'
      block:

        - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember parameter in /etc/security/pwhistory.conf'
          ansible.builtin.lineinfile:
            path: /etc/security/pwhistory.conf
            regexp: ^\s*remember\s*=
            line: remember = {{ var_password_pam_remember }}
            state: present

        - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember parameter is removed from PAM files'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if /etc/pam.d/system-auth file is present'
              ansible.builtin.stat:
                path: /etc/pam.d/system-auth
              register: result_pam_file_present

            - name: 'Limit Password Reuse: system-auth - Check the proper remediation for the system'
              block:

                - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/pam.d/system-auth

                - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
                  ansible.builtin.stat:
                    path: /usr/bin/authselect
                  register: result_authselect_present

                - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
                  block:

                    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
                      ansible.builtin.command:
                        cmd: authselect check
                      register: result_authselect_check_cmd
                      changed_when: false
                      failed_when: false

                    - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
                      ansible.builtin.assert:
                        that:
                          - result_authselect_check_cmd.rc == 0
                        fail_msg:
                          - authselect integrity check failed. Remediation aborted!
                          - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                          - It is not recommended to manually edit the PAM files when authselect tool is available.
                          - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                        success_msg:
                          - authselect integrity check passed

                    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
                      ansible.builtin.shell:
                        cmd: authselect current -r | awk '{ print $1 }'
                      register: result_authselect_profile
                      changed_when: false
                      when:
                        - result_authselect_check_cmd is success

                    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: custom/hardening
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
                      ansible.builtin.shell:
                        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                      register: result_authselect_features
                      changed_when: false
                      when:
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
                      ansible.builtin.stat:
                        path: /etc/authselect/{{ authselect_custom_profile }}
                      register: result_authselect_custom_profile_present
                      changed_when: false
                      when:
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
                      ansible.builtin.command:
                        cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                      when:
                        - result_authselect_check_cmd is success
                        - authselect_current_profile is not match("custom/")
                        - not result_authselect_custom_profile_present.stat.exists

                    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
                      ansible.builtin.command:
                        cmd: authselect select {{ authselect_custom_profile }}
                      register: result_pam_authselect_select_profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
                      ansible.builtin.command:
                        cmd: authselect enable-feature {{ item }}
                      loop: '{{ result_authselect_features.stdout_lines }}'
                      register: result_pam_authselect_restore_features
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_features is not skipped
                        - result_pam_authselect_select_profile is not skipped

                    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - result_pam_authselect_restore_features is not skipped

                    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
                      ansible.builtin.set_fact:
                        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
                  when:
                    - result_authselect_present.stat.exists

                - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
                  ansible.builtin.set_fact:
                    pam_module_control: ''

                - name: 'Limit Password Reuse: system-auth - Ensure the "remember" option from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
                  ansible.builtin.replace:
                    dest: '{{ pam_file_path }}'
                    regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
                    replace: \1\2
                  register: result_pam_option_removal

                - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b
                  when:
                    - result_authselect_present.stat.exists
                    - result_pam_option_removal is changed
              when:
                - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_pwhistory_conf_check.stat.exists

    - name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured in PAM files'
      block:

        - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/system-auth

        - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: system-auth - Check if the required PAM module option is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present

        - name: 'Limit Password Reuse: system-auth - Ensure the "remember" PAM option for "pam_pwhistory.so" is included in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
            line: \1 remember={{ var_password_pam_remember }}
            state: present
          register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_add
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found == 0

        - name: 'Limit Password Reuse: system-auth - Ensure the required value for "remember" PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
            line: \1\2={{ var_password_pam_remember }} \3
          register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_edit
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found > 0

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_present.stat.exists
            - (result_pam_remember_add is defined and result_pam_remember_add.changed) or (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
      when:
        - '"pam" in ansible_facts.packages'
        - not result_pwhistory_conf_check.stat.exists


# Lock Accounts After Failed Password Attempts
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Lock Accounts After Failed Password Attempts
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_passwords_pam_faillock_deny: '5'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      MXFPRkF2TUd3NFp6VjVORzlaZDJoR1l6Vk5TMk5QVERGMmQzY0tNMHh3VkdOaFowUkhNRlZpWkZk
      S01UVlBVaXRRUjJkb2RWZDBlR3RYWWs1WFJXdHpVVmx6ZEVGQk5VNW5kbkJLV25SU1dFSjVjbGRx
      Y21WeWFHbHdXZ3AyWjNkMGMxaGxVa0V3TmxNdlRHeHNSbVZxYW5OaVVWWTViMmR1YlV0U1JYQTFa
      VWRCUzFOb1VWRkljRk5OTjJSbVlXWTBRVzR3ZERoM09UaGFUMGcwQ2xOVmFrbzVhR1JtYkZKU1JU
      bHBNMWt3ZFUxcVFuVnZVamxrUm5remFIb3JOM1ZUWkZkWmNWVkVRVmh1VlhVcmFGaGpla1JHYTNw
      S1l6TnVjM0pWUWxRS2JHdHBNbGx6T0dob1JYQkNMMlpNU0ZSS1JscE9PQzlvTUZrMlJYTkpLMDVR
      YjJvMWJYVnNaa2h6U0hONlZtWkZSSEJ5T0V4aE0weHJUMlpMT1hweGRRcHpWMUZUT1dwRmRrSTRl
      amhVZG1SdlJFbE9VSEZXYjJSS2QzaG1TRXhQV2xGRGRtRTJPRFp6U0ZjNE1WVlNMMnhLY2xReldX
      WnFia0p6ZDA5WFZYbFBDamhNZVdsc1MwTXhLM2czYzB0cGVtYzBNMlJLVXpCTFlVUmtiSFYzVFVS
      aVpGVk9LelJ5ZVhKdWJtOUZaMkY2Y2tWbGFIUkZkMnBRYmtkSlVFZDFVV2NLUm1Oc2NWVldUMVZI
      V2s1cEx6UTFOalJtYXpoTFpWSk5VR015Y21FMllUWldha3BDUWpreWMyY3JURTlUY1dVMWRIYzFT
      MFU1U2xJeWJuaE1Wak50V0FwVlMzSjFXbWR6VUhaRGJEbHJVVTR4TTJKSVozaFpiVGhuU1RFNVFX
      WmtjQ3MyTjBSUVdtNVBXRnA1VDNaVmFsaFJlbEJ3WjAxUGVrNUtOVFp5UjNadENtUnlWblU1YkhZ
      dlVXUkVXWFUyTjB0R1pFWk1SRU5KV25FeFZuVlhVbU5JVGtsT1prbDJOMjR2VW5Rck0wcEpNVTR3
      UVZkUWJXUTBZMWhKWmk5U05Fd0tLM0pHWjNaSk9ERjJTalZGZEd4bU1GWnNPRk5zV2twWFRHbHZT
      a3hDWTBkSFpFVk1kbVkxTTJadFUyWlBRVGxwZG5kMFl6VnZlVEV6VGpSeWRYaHhNUXBNT1dGeU1E
      WlVXa3N2VVhrMkwybFBhVlZQVWdvOWMxWmxSd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80667-9
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: Lock Accounts After Failed Password Attempts - Remediation where authselect tool is present
      block:

        - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Lock Accounts After Failed Password Attempts - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Lock Accounts After Failed Password Attempts - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Remediation where authselect tool is not present
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf file
      ansible.builtin.stat:
        path: /etc/security/faillock.conf
      register: result_faillock_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter in /etc/security/faillock.conf
      ansible.builtin.lineinfile:
        path: /etc/security/faillock.conf
        regexp: ^\s*deny\s*=
        line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter not in PAM files
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/system-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/system-auth
          register: result_pam_file_present

        - name: Lock Accounts After Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Lock Accounts After Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/system-auth

            - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Lock Accounts After Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Lock Accounts After Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Lock Accounts After Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Lock Accounts After Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/password-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/password-auth
          register: result_pam_file_present

        - name: Lock Accounts After Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Lock Accounts After Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/password-auth

            - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Lock Accounts After Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Lock Accounts After Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Lock Accounts After Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Lock Accounts After Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter in PAM files
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so deny parameter is already enabled in pam files
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail).*deny
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_deny_parameter_is_present

        - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so preauth deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
            line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found == 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so authfail deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
            line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found == 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the desired value for pam_faillock.so preauth deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found > 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the desired value for pam_faillock.so authfail deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found > 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_faillock_conf_check.stat.exists


# Set Lockout Time For Failed Password Attempts
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Lockout Time for Failed Password Attempts
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_passwords_pam_faillock_unlock_time: '900'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      OU1RVkF2YWxSUk1VbFBTbWxRVVUxaVRITjZSblJPYldkaVNXZ0tNa3hWSzNWc1dEaFZNRlp0UVRo
      SVExUmxLMjFwZVZrdldGUkZabWRKVW1NeFYwaHJUbVY2YmtKMFNEQkdTVUYxWTBvNVEyZFdXa1ZY
      T1hwUVpHbG5lUXBoTW1jMlNqaG1XRkV3U0c0elMxaHFTekk1ZDI5RWNsQkNSblUxV2s5cU1pdEJR
      MGxPYm1aQ1MwRlVNa1l6YWpCU2NHNU1jVWwzWlhsQ1dtbHJkbkkwQ2pSSGJVbG9jVzlFYmpSUFVD
      OVNaVGR0TVVrek5uQjVaVEp4WkRod1JEbExZWHBUVEZsVVFqUmpaeXRJYkhwbFJGSmFWakJEV20x
      TlIzQndXbkJXUVdrS1EzaHBkbk5UYUZZNVNIUktTRll5WVVOYWNFSklUWGhPVlZoSU5VeEVZVE41
      YlZCb1JFTnRRell4T1ZCdVpqaG9Sbmh5UkRRMFdDOVhNMHRQTTBKMVlncDVlR2xrUmtwNk5IUTJO
      WElyUlU1alUzTTVVVkpDYzFObmRIWnFiRWN4ZWpKcmVrc3hSWGh3Tmxac1ZrSmFiRmhTUWxkU1lr
      RXdRalkwUmxwd1JGRjNDbE5WVERZd1MzVkZkemx3YzI5aE16QnBNMkZqY1RCM04xcGxSbFpGY2xo
      alpFTkRXbEIxZDNsalVscFVVekExWmxFemRsSnhaRlE1ZGtwVGJsVlJhVUVLVVdwclRXUjFSRFph
      ZGxGWWVHa3lkVkpETTJaWWMxSTJkVmRsYjJreVkzaDJlVTVNVGtsNWNsSm1UblpYYTBsWlNEaDFa
      RFZ0TnpGcmNVWTNWMVpvTmdwNlpISllabVp5Vm5wWFYzWjBNMUJGYUdWRldHeElWbE0zWVhOcVow
      WTFXbEJEVjI1aGMxUlhhR296ZDI1MGJtZGFUUzlYZG10U04za3JWWE4yUmxKckNsWlpNMHBJZGt0
      VlFqUmtTVk5RV0dGamNGaGxTMFpaWkdsWU0zSXpkMWhQZHpCaFFYUTJVakpRUmtKcGVHNUdjRnBI
      VXlzMlUwaE9Va0ZPVURGUmJWWUtVV2xVWlZwRWRrUm1SM2R2TDNRNVZsRmFRbFYzU0VKTGF6Sm1j
      R1FyV21wMk5FWjRUa05NUmxWR1ZqSlVla3RyUlRaWVUyZFRaMWhEYTBWb2MyZ3lXUW9yUlVwdmMy
      NURiRWxxUm05RlNqSk5TbkoxZFFvOVprMTJOZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80670-3
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect tool is present
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Set Lockout Time for Failed Password Attempts - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect tool is not present
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf file
      ansible.builtin.stat:
        path: /etc/security/faillock.conf
      register: result_faillock_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter in /etc/security/faillock.conf
      ansible.builtin.lineinfile:
        path: /etc/security/faillock.conf
        regexp: ^\s*unlock_time\s*=
        line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
        state: present
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter not in PAM files
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/system-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/system-auth
          register: result_pam_file_present

        - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/system-auth

            - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Set Lockout Time for Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Set Lockout Time for Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/password-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/password-auth
          register: result_pam_file_present

        - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/password-auth

            - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Set Lockout Time for Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Set Lockout Time for Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter in PAM files
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so unlock_time parameter is already enabled in pam files
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail).*unlock_time
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_unlock_time_parameter_is_present

        - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of pam_faillock.so preauth unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
            line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of pam_faillock.so authfail unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
            line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value for pam_faillock.so preauth unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found > 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value for pam_faillock.so authfail unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found > 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_faillock_conf_check.stat.exists


# Set Interactive Session Timeout
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_tmout,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Interactive Session Timeout
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_tmout: '900'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      eHZkMUF2TTFCbVVEVk9WakJxVmpVeFlUZ3dPWEIzVVhCeFFWZ0tMMkZKYjFGQlNXNUlOVmxGUmtk
      RVFYVm1kMnBDTkVwRldVNDVMMjVSTUdOeGF5OWpibVJMWVVVMlIxbzRUVVpaYVZOUmIyd3libWsz
      T1RkMFltTXpUUXAxZGtoSllUUk5iVTlJTmxSVWFtdG9NRzVaY0VsaGJtbHNXbk0xU1RVek5sRlVa
      a1FyYzNWUFJqSXhNWHB4Y25kUkswbElkRFV3WW5OTk1IRnFWbUZ6Q2k5eWNrSldNVk5MY1VkT2Jq
      SlpUbWN6WkZCbFpHWndWR3BQTlhwdmRrd3dXVEptU0VzeVVHaDFWMkpQY0ZkUE5tOUlSRTR2TjA5
      bGNuZzJiamM1ZG1zS2MyYzJWbFZuU3k5c1NFbE5kSEIzVW1kdFFXTlZhMjk1TDFSM2NtZFRjbkI1
      V1doSlVESlVVR1JaWWxJek5tazNZbHBEYkdJeVNIQmpNR2hoZGxkbmFRcFpMMjVsY21wdlQwcEZW
      RTUwWlhsNVkxTnFVWEpITms5MVRXWTJhVmRJYUdsNmFVNHlhUzlaTkZCbFJYZFdWbUpGUVUxM1ZY
      Vllaak56VmpkQlNVNDVDbXBXSzNGSFRsZHZhR0prVUZFcmFVZDJNbU5HTWtZdlNuVm1aVXhMUkhr
      MmQzTXpMM1ZRYjBsS1UyWndSSGhyWlRWcFJsSkVNWGR0TnpORlpYbE9iWGNLVm5kSWFVTjNlRzFq
      U2tSSVJYSlVVR1pWZG14eVRVTklRWHA1UkRaRFpYWjZOVlpxTDNkNVNWTlZhRlZ3UjNCbGFtSk5Z
      VFE1VjFGdmJUTktUazB3ZFFwdGIyVTNZazlrTjJFclVUTkJabUpIZURCdGJWSnNXakpCVnpNME0w
      SlhWVGxQVTNsVVJESXZiMHBUZEV0c05YTTFkU3RHWWpKelUxWkxPR0ZSYVVsekNqQjJaVWhoYlVW
      T2VtOW1hVGgyT1dNMmN6Qm5PRVJHVkRsTFNGVkxTVUpaYXpGUmFrYzJTVlUyTTBsMEsweExUMmRx
      UjJKQlpVazNNMEpEYUdzNVdFY0tRV3BtUnpGVVozUlRWemRUWmxGVVQwUnBZM1UwTjA5M1JUVk9W
      bkJYYTB3eFJuaGtOMFI1Y0ZwVmNURkZURzFEWWpORVdrNW5SQ3RuZWxWaWFqaEZNUXBCVkVOVGFH
      TmxiWGRET1hkd1NWTldhV1ZxTXdvOWEzQXhWd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80673-7
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSSv4-8.6
    - PCI-DSSv4-8.6.1
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Correct any occurrence of TMOUT in /etc/profile
      replace:
        path: /etc/profile
        regexp: ^[^#].*TMOUT=.*
        replace: typeset -xr TMOUT={{ var_accounts_tmout }}
      register: profile_replaced
      when: '"kernel" in ansible_facts.packages'

    - name: Set Interactive Session Timeout
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: true
        regexp: TMOUT=
        line: typeset -xr TMOUT={{ var_accounts_tmout }}
        state: present
      when: '"kernel" in ansible_facts.packages'


# Ensure the Default Bash Umask is Set Correctly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Bash Umask is Set Correctly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      dEVXVkF2UVhaNWQxRnBTemhxUlU5TE5HMVpVVUo2TDNGVlkza0tSVlpOWW1KT2FFbDVOa2RRTlRW
      Qk1qUlJlVTlyTVdsUFJsVjVSV05SVTB4V1dHTTBjVWRvZEd4Tk9FeHFkRTkxZWxsS1pVeHVVRXRR
      U2xWQmMxTnJad3BGYVM5T1JVNXlNVk5IUmpaWldEZE1kVVJzZEdvdmNqSlNlVElyWjNCbFVqQnZl
      aTl2Um1nelpuaDVXVVZvWkRSNEszaG1URGxGTDFOaWNHRXhlWEpJQ2paQmIxbEJZMGhZT0VwWVdF
      VlFWeXRrUmt4RWRFWkNMMU0yWW1SRGRVUk5hRTV0Vnpnek4wbEpMMHBXZDA5cGNuTTFjeXN3ZFc0
      MVNqSm1TSGsxWWpBS01WVnlkMjlNSzA5RFpGZDJhR3czTHpCdmRGWXJhMXBuUVRGUFozVkJVM1pE
      Ymxwc2JFSTJPSEJHVUhWbVlrMU9XVUZDYzBsUlpuZEdWV1F5YjAxTE1BcHdUVUp6VDNCWFRYcGtS
      a1UyWTNKU01FTkRiWHBLUVRKWU9HOVhaekpQVUc5cGFsUkRUMjlwTVhGS1luVk9UVTlUUjNkUFNG
      aHFaRVkzVG1rM1JESm1DbTl0U1dnMlRFRTROamRhU1ZRck1rOUJNbFJVV0VNNWVWVXhSMU5GT0hn
      dlMzTk5VamxPTHpKc1EyUkhSa1YxTkVwd2NXaHFiREpJZHpaTFVUZDRiM1lLUVRCVE1raHpUa05p
      TUZwRFkyaHRPVEJJTDNFd1VVdHFVa05FV21kSWIweEdOMWN3YmtWelZtWllVRzVSU205elVGTkZP
      R0kwWlRkS1V6RmhlVVYzYmdvMlExVXdRalp5U1VKNVVWSjJXR2cwTjA5YWIxTnVRVE5yTkZGNk1F
      Vk9MM05GUzFwNlFWVnBlVnBQWjAxa2RFSnFORGxIUlZjNVFXVlpRV0pYYzAxRUNqQXJOMWg1TlZO
      cldHbDNZM0ZtYXpGc1kwOVJaa3BvV2xobU5qSTVWRUZSVUhod1JXdGxUa2t5Y1doNmRVRjBObkpH
      VWpkVFMwRTVNRlYxYjFaaWVVTUthbWxMVDJGME1sRjRObFl6V0V0bmJtZ3plVXM1U25oekt6RjBS
      RXByVEdWeFZrbENTR0ZGZW5BcldIbFVXRVpzU1ZGRk5XNUJaMkU1Ym5jell5OVBjQXBLTjNKUFJF
      UlpkU3RoTnpaV1JsTjNla05KT1FvOVEyUlVlZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81036-6
    - DISA-STIG-RHEL-08-020353
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_bashrc
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Check if umask in /etc/bashrc is already set
      ansible.builtin.lineinfile:
        path: /etc/bashrc
        regexp: ^[^#]*\bumask\s+\d+$
        state: absent
      check_mode: true
      changed_when: false
      register: umask_replace
      when: '"bash" in ansible_facts.packages'

    - name: Replace user umask in /etc/bashrc
      ansible.builtin.replace:
        path: /etc/bashrc
        regexp: ^([^#]*\b)umask\s+\d+$
        replace: \g<1>umask {{ var_accounts_user_umask }}
      when:
        - '"bash" in ansible_facts.packages'
        - umask_replace.found > 0

    - name: Ensure the Default umask is Appended Correctly
      ansible.builtin.lineinfile:
        create: true
        path: /etc/bashrc
        line: umask {{ var_accounts_user_umask }}
      when:
        - '"bash" in ansible_facts.packages'
        - umask_replace.found == 0


# Ensure the Default Umask is Set Correctly in login.defs
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Umask is Set Correctly in login.defs
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      ZGtRVkF2YVRrMlJ6VjBUM1Z4VERKWmF6TTNSR1F2T0VoaVZtWUthelYxTUU5cWRscEhVM05zU3pK
      UE4wTldWRVJRWW5kelZIWXlPVE5wWjJzeFpuVXZZa1pWZW1GSksycG5kV295VUhaV2MyOU1kVmgx
      V0hJM1NsUTJMd3BpTDFkVEwwRXlWbGt5VUdkbmNWZFRNVXRTT1dWNVJYcDJXVVI2WWpWRmVVZE9h
      RXh0WnpBeVpDODVjSEZyVjIxWlMybEJPQ3RKVlZOc1pXUktWVVUwQ25oVlFUQjJUbXcyUWpNeGN5
      OUtUVUZrYTFreGFqZEVlbTlMYmxZM2NqUktNa2xKVEZadWFHMVhjM2RHYjNvelpEbGxhamgxTms1
      dVJHaFVNRmRuY2tnS1RrVnZjSEJOYWtwT2NEQkVNM2wzTjFCR2JqTktkMlZGV0RkM1dWSXZkMU5L
      V25CT1RISXpTbkZ6YVRCWWNISnpkbWR0U0dKM05HVjRTM2w2YTFCT1VRb3hkRE00WmtWRGJVTXhP
      RlYzVTBjdllXSldjemRpUzB4S09UTktjSFpGYTJaRFpVVnRTVTVWUTBwSFZGZFdOWFY1UkhVNFJ6
      RnBNVGw1UkdOaFdXZDZDbWhJWWpndlVYaFVWRVpNV1ZaTldrNUdSVkZaYm14SlowWlViM2hFV1VS
      aGRtNVFSbVpvTkhac1FrTjFhVkpLV0dzMU0zWlZiamh4YVVwUVNISmhkbm9LSzAxV2VUSTRWMWxX
      V2paRlNraHVPSEl4VFd0dllYQXlWV0ZpYXpsaGR6Rk9RVmxHUW5RNVYyWmhibkJ6UzNkMWVEUm9U
      amQxVkVodGIyOHpVSFZwY1Fwa1puVlRaVmh0Uld4TGJsVkNWa2wzUm1kdmNsQXJiMGxEV2xVM1FT
      dGpMMVp6YmpGeVdrbDJTRFpuTWtsVGRHWXpSSGxITTA5S04yVXZVMUI0TTBveENtMURWbkpJWmxO
      dGJVTlhhbFZ1TldSUFUwOWFialpoVUdGU00xbDVUa0ZGVldoNmIyZDNXREJRYmpsWWIwRk9UMVZC
      Y1ZwUVIyTlpORFZRVXk5UEswZ0tNbXBhYmpaUWMxcENaV1J4U0V0aWVreEJVM1pqTkROR1pHcDVX
      VFpwYTA5V2RqTXJSbkl5UWxkaGRETTFjVTl0WTIxbWJGcFpZMFpFUkVWRFdGcFhXZ3BxVDFSM1ZE
      RlFXbFF5VTNCeFUyaERLM1pRVlFvOVRVOUxTZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-82888-9
    - DISA-STIG-RHEL-08-020351
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Check if UMASK is already set
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        regexp: ^(\s*)UMASK\s+.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_umask_is_set
      when: '"shadow-utils" in ansible_facts.packages'

    - name: Replace user UMASK in /etc/login.defs
      ansible.builtin.replace:
        path: /etc/login.defs
        regexp: ^(\s*)UMASK(\s+).*
        replace: \g<1>UMASK\g<2>{{ var_accounts_user_umask }}
      when:
        - '"shadow-utils" in ansible_facts.packages'
        - result_umask_is_set.found > 0

    - name: Ensure the Default UMASK is Appended Correctly
      ansible.builtin.lineinfile:
        create: true
        path: /etc/login.defs
        line: UMASK {{ var_accounts_user_umask }}
      when:
        - '"shadow-utils" in ansible_facts.packages'
        - result_umask_is_set.found == 0


# Ensure the Default Umask is Set Correctly in /etc/profile
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Umask is Set Correctly in /etc/profile
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bFBNRkF2VW5SVVlVcHdUME5sUjNWRmJqZ3JWbEZIUzJodFdYY0tSMjVEU1VwTE1uVkVZV2RqUVV4
      aE4wTTBaR2xuVWxCTFdURnFjMEZJYm1wdE4xaG5TbGRDZDBVeE56Tk1aMk5vSzB4bGFVVk1kVTFq
      Um10dE1qWTRjUXB6SzNsaWVUTkRjSGhzWTB0T05Xc3dlR2g0TVVJemRXSmpXVVZoYnpVclVIZEhh
      azlCTVRCRlkweDRkVXg1ZVUxRVltcFBhMUJRWVRSc1pXd3dURzVyQ2tsaWJGbFFPRll6U1hKd1VG
      STFVR0ZzYm01d1pHNUxNRzg1VDNrd09HSnVaV2xaVlVoM2RrWjRUblZXU1RWQlVsaENRazFMYjA1
      SGFubHlSa0UxY2trS2VtUkpWaXNyTW1Sc0wzWXJjMHB3UVhkM1ZtWnVSRzluTlUwckwxSkNaak50
      WmxCVmJVSTBUalJEZW1OMlFYQmFjaXRwUkZCd1NXeHFieXRvYjNwcFNBcHdOaTl3TXpkS1JWbHhL
      M3B6ZGt0Q09YbEtZbXhYUldKd2JGSTRUMHBFV0c1bk0zazBiM3BIU1d0M2VHTTRXRUZqYjJwa2FH
      OVBiVTQzT1VSUVFYWk5DbkF5TkcxT2IwaHlMek5zT1hJd2NHUjNVbWRtVG1WVVZWWkRTSEZOVW0x
      YWJsRnFXVkJpWVM5SU9VcDJMMDAyTVVWME4wZ3Jha0pxTUZWVVJVTkhPV2NLTjFwUVZreHhLM05P
      VkU5T1NuSTVTV1pEYVVRMk4yNTNiMDFMTVhsb2FuVm5LM1pYUjNNMmQzTTBZa2xVVlVNeGVreFpO
      blZ0YkZWMFpWTkhXblZuUndwSFdFZEplRWgzYm1WeldsZFBVRVJxUzNjMGJqaHlPVVJGUWxsMmNq
      bFVVR0ZhVEVSQ05sWnNhbWs0VFhkWGVraFhSakZIYVhsWFJrVjJkR3d5U1U1MkNtVnRaRU5JVVRs
      dFVYbzVNVTFISzBsaVRGVlNaWGR1YzBneFoxQjFTVzFXYlRVM09GaE5OalE1VUZWWWFEVXhjMGRS
      ZVhSQlpuVTBNVGRoV0ZSMlpHa0tUVlJCT0VOS2JYVkJVazVxV0ZKQ05Tc3ljamQ2V2xVelpEZzBS
      V3R1ZHpkTWRrRmtZVmhXUjJ4bFQzRkhVa05ZTjFsTFZtMXNOVTh3YW5sQ1ZIQlpiUXA1Y0RCU2FX
      b3dZMk53TDA1emRVSjZjelZOYVFvOU9UaEJjd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81035-8
    - DISA-STIG-RHEL-08-020353
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Locate Profile Configuration Files Where umask Is Defined
      ansible.builtin.find:
        paths:
          - /etc/profile.d
        patterns:
          - sh.local
          - '*.sh'
        contains: ^[\s]*umask\s+\d+
      register: result_profile_d_files

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Replace Existing umask Value in Files From /etc/profile.d
      ansible.builtin.replace:
        path: '{{ item.path }}'
        regexp: ^(\s*)umask\s+\d+
        replace: \1umask {{ var_accounts_user_umask }}
      loop: '{{ result_profile_d_files.files }}'
      register: result_umask_replaced_profile_d
      when: result_profile_d_files.matched

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Is Set in /etc/profile if Not Already Set Elsewhere
      ansible.builtin.lineinfile:
        create: true
        mode: 420
        path: /etc/profile
        line: umask {{ var_accounts_user_umask }}
      when: not result_profile_d_files.matched

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Value For All Existing umask Definition in /etc/profile
      ansible.builtin.replace:
        path: /etc/profile
        regexp: ^(\s*)umask\s+\d+
        replace: \1umask {{ var_accounts_user_umask }}
      register: result_umask_replaced_profile


# Build and Test AIDE Database
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_build_database,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Build and Test AIDE Database
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80675-2
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      SkdXVkF2TVdsTmVFcE9Sa2xQVUc5TE9FaFRRVWQ0YzBnd1QzTUtZeXMyU0c1aGF5OXRka1ZRTUZo
      clQyMXVkMmRWY1ZGSGExazJTR3hrV2tGdWVESXhaMDlzWkVWMU4wUnBSbEpJVlVGdksweERTVFJQ
      TTJoMGVtNVlVd3A0VW1sdVFsSXlTRXBzSzNSdFpVdzRSVTFpWkhOTVp6Y3ZLMlZwWWs1cU5qRTJT
      MVJ4V25CSWVVVjJVamRvZWxsT1ZrOVlVMFl3VEVkaFl6UnBOV3h1Q2t4SFZ6TlJjVVIyWVdkcFJU
      aHVUSE5xUVhSNWEySTRRMFZNUVU5cFVIUk1TbUZOWmk5SWFVMWFXbWhTT0VST2JEWk5WR0k1VWxa
      c2FIaFVMMWxWTmxZS2RFWkRWV2M1ZWpCM09YSmxkWGhEVXpkRVRqVlZNVTF4TjBGWVJGWlpPVEZq
      VWsxVVdtNTVTV1pGYUcweE5GZHBORzltVlZSSEx6bFdZME5YV2xsQmRRcGtOVFZtV2pWTWIzaDNi
      bk5NU2s5RlNrOVllRGc0ZW5CcE5qRnhSM0UyUjNKb2MybzNOMVpQU3pkclJXMTVSMUJ3TUVwWVYx
      SXlORkI1UjBjMldVbEtDbVY1U21jMGVFVXhPV0ZXTkhKRlpXRTNaV1ZJT1V4YU1WQnBjWEp4WVds
      dWVsTnpRM05OUm1jdmREWktkVWhqY2pSRFUyaEVUMU5SZGtWR01VbDBhbU1LUkdSNFJYcHJSVFJq
      WVd0eVNFbHNORkpRVkcxb2F6UXpRWHB1Y1dsSFRIRnlLelZyWTNOQ2NrcEJkekZCZFUxMGFqVjZa
      V0pvZWxscVIzZzVlRXhqTmdwRFdFOWhRVTFxTkhCaFVFRmtiR1ZJYlhWMU1tTlJjVkJDV21WV1Nt
      bzRWekpxVTA1WlYyeERjbEZsYTI5NWVUTlhNRXRoYkZkMWJua3pkbXBpU0cxMkNrZDNieXREYjJ0
      NVdtWkdiMFJSYVdGT2NFZEVSSGRUUkdaVGJWZENXVzlCVkZkbU9VUjNVbkIxVlZodVVISXhiRWQ1
      VWxGelRHTkpiMlZXWldzNVJFd0thMlJzUWtWbVVTczVNeTh6WjNsaFVFVXJhaTlVZHpBMFZYSnVh
      bWhaYlhaTlRqVkhXbXN6ZW5nMk55OVZhRGR1VG5OTU5rUTNXRVpuTW1kNmRWSldWZ3BHTDA4eGIw
      d3dhMmxyVFVoQ1ZscHVlV3hxUlFvOVVtTTJid290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Build and Test AIDE Database - Ensure AIDE Is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Build and Test AIDE Database
      ansible.builtin.command: /usr/sbin/aide --init
      changed_when: true
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Check Whether the Stock AIDE Database Exists
      ansible.builtin.stat:
        path: /var/lib/aide/aide.db.new.gz
      register: aide_database_stat
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Stage AIDE Database
      ansible.builtin.copy:
        src: /var/lib/aide/aide.db.new.gz
        dest: /var/lib/aide/aide.db.gz
        backup: true
        remote_src: true
      when:
        - '"kernel" in ansible_facts.packages'
        - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)


# Configure AIDE to Verify the Audit Tools
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_check_audit_tools,fix)
# Version: undefined
# platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure AIDE to Verify the Audit Tools
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-85964-5
    - DISA-STIG-RHEL-08-030650
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dHBORkZCU1doalJIcFVOR2xETjBKT1JVTmhhbGhIVld0RlRrY0tjVEZMWTB0elFXaFBjV2htZVVk
      b2NIVldUWFZxVlZjemRtdDBSVTEyY0RkMVMzbHZlRVpKWmtoc2VuWmFjM2dyWTJ0MGQydDFRVkJz
      VTBWbVNFWnhTQXBPTDBsNlFrbHZkbFI2ZW1reFEzcEdVMlZCVTJSaFdYaE9NV3Q1Y0dSbVRuUm1M
      ek5vTjJWTFpsWjRjMFExSzJKQk5ITjBLMHBxVUcxa2VscDFUa3hVQ2tWWWRtZGFNQ3ROTjA5dVp6
      aE1TMmt6VEdSWGJFRTNMMlptY2t3eFJFMTZhMDR2VkZwVlF6WmlORzl4VkhGWloyeFVVWGN4Ykho
      TVdqTk1ia2RQVlRZS00ycG9kMjFITjAxU2VWWkhlbW8xVnpJclJHTlBjVmwwTlZad1UyWjNUaXRH
      T0dZeFlXdFlUVzlZV0VsdFdGZGtRbXBXTkhoaWFIRTFkbnBsU2xKak53cHlRekZ4UVd3NVkxZDZS
      RFV3U2pSelJsZG9SR1ZsTjJGUWNpOW9jVFZVT0dJeWVIZHZTMVJ6YUVoWGEweFVRM2QxWms1M2Qw
      cDVRbEp0YVhreFFVUm5DbUpNUmpOdVpWVk5iV2h6WjFSWlZWQmlURVZ2YjJOVFNuZEtUWEZUU2sx
      SmJ6aFVMelZJYXl0VFl6bFlVbUoyYW1GeGNVcFRPU3RDYm5sdVlsTTNiWGtLVTJsTVNrTkZUMnRv
      VDNKMFJFMUViVWQxZVdkWGVtOWtkek53TDNWNWJYaGtSbGhOVEhGUFVsUmlVSG8yV21JeVlsZFRl
      RGhuVlZadFpFZE9iMGRsVUFwNE5rTk9jR3hhTVhOMVNUVnBZelJqVUV4U1JHZzNORXNyZERBd1Vq
      QkVSSGg2TTBRMFdWQnJibEJtZGxKTFJUaHRhako2VFdWSEswOHdOMGN3ZUhaTUNpODNZVzVSUlVr
      eVEzWm9RWFZVVGtsQlRsUk1jMVozU1hOYU1HcGFOemMyTURFMlZVWkphVlZTWjFJd2FVUlhRMkYw
      U1U5bFRURm1NV3BVZWpGa1NXOEtXbFEzV25KS2JFTndPWGxGUlZwUlNXNDNkMDFqWVU1TVkzTlZV
      REJSYm5nMmFXTXdiVTF6TldoemEybEVRMHBzVEVnNE9FMTRXSEk1VUZkWldYb3hVQW94YUVwTGNX
      OU5hbFpoYzNCUlVWQTVPV052UXdvOWFUaHljUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
      ansible.builtin.package_facts:
        manager: auto
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure aide is installed
      package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Set audit_tools fact
      set_fact:
        audit_tools:
          - /usr/sbin/auditctl
          - /usr/sbin/auditd
          - /usr/sbin/augenrules
          - /usr/sbin/aureport
          - /usr/sbin/ausearch
          - /usr/sbin/autrace
          - /usr/sbin/rsyslogd
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure existing AIDE configuration for audit tools are correct
      lineinfile:
        path: /etc/aide.conf
        regexp: ^{{ item }}\s
        line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
      with_items: '{{ audit_tools }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Configure AIDE to properly protect audit tools
      lineinfile:
        path: /etc/aide.conf
        line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
      with_items: '{{ audit_tools }}'
      when: '"kernel" in ansible_facts.packages'


# Configure Periodic Execution of AIDE
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure Periodic Execution of AIDE
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80676-0
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      Uk9NRkF2TUVONVYwUXhOa2M1TlhVNVJHUkNUWEp1ZGpOek5uY0tORmN5VG1Nd1JqQm9ObkYyTVRS
      cGRtcDJNekl5Y2sxaFoyeHpkek5ETlhWdVNVTk9ZM0ZXV2l0dVJHMDRPRE5KVG1kemNpODFhMXA0
      VUc1c05GZDVhUXA0U0dJM1F6bHFhR0V5YkdOa1RraE9WMkpDYm5aRmVHaEliMlZQWjB4V1RtOVZU
      MVZoZG5adVdDdENaV3RaVUdwNGVsSXJORVV2TUc1cWVtZGpUamhxQ2k5RmRXeHJWekZ4Y0dSS1Yx
      VkhTMDlvVDFGblNGWTRhazF0TDBGVVJHdHplbVZpZEhrNE9FWnBZVGR2UzNKNE5VeHVUVkY2T1dK
      elN5dGhXREUyVEcwS1IyOXRSMlZyVFVKMVlUQXJhM2xoVVd4NU5YbGxabUZYY1VNNGN5dG9WR294
      TDFkb2NERkdaMHcyWmprcmNYUmhaemRDYldaUGJWRnhTbEJpZUZCMk1RcGhlaTltWldOaE1XbEti
      VGwwTlhGeVJHOXZRMVpqUlRGcFkyMUpjbWdyV2tjNU1XWkNOSFZGYkZCclVUTldOSGhSVkVsbEt6
      TlpUM2hMVEZOaE1VWjJDbE0xZVZaME9GVkpSelpDV2paWE5IbEVha1o1YTNCM00zSmpNV3BNTkVR
      eFoyRmpielpVYTBOclkwTjJPV2xDZEZwMWMwdHNRbUk1T1U1a1ltZG9lREFLTkRaR1RHVjJOelJs
      UzJVM00zTTRhM0pYT0hWcVZHNTFWR0l2V2xkemMyZFdjVUpOUkZGbGIxbzJlaXR1TXpWMlZYaHlX
      RE52Wkd0RlRWVlFlVklyY0Fwb0sxVnhaM05yVVdGc01YUnRkV1ZYVFhWbU4wZEtSbkF3UXpWSE5Y
      aE5kVkIyZVdNNU1sQlBjVGd2TldkYWRVSlZjbHBJWlhrM2IxaHZXSEpZYWpJdkNtSjRNRFJWU0Zs
      VlRXbG1abTFrUjNoNlNVeFBORTF0TVdOWWIwTkdkRVoyY0ZkeGVWWk5MMGxxY1V0d2RHMUZaVEUw
      WWpCMU1XRm5PVGxCV0RsYWQyd0tkblJsWkdsaE5qWjZRMWxXUVV3eU5Vb3dhMjByU205SVl5dFNP
      RmxVUldSUGFuWm9kV2xxZVRWTmIwd3lUbFF6V1dGMVN6TXlTRVIzYzJoWFNrNHhaZ3BWTVc1VWJG
      aGlNSFpKSzBvMFIwVTNSMFV6Y3dvOVNEWXlWd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure AIDE is installed
      package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Set cron package name - RedHat
      set_fact:
        cron_pkg_name: cronie
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_os_family == "RedHat" or ansible_os_family == "Suse"

    - name: Set cron package name - Debian
      set_fact:
        cron_pkg_name: cron
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_os_family == "Debian"

    - name: Install cron
      package:
        name: '{{ cron_pkg_name }}'
        state: present
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Periodic Execution of AIDE
      cron:
        name: run AIDE check
        minute: 5
        hour: 4
        weekday: 0
        user: root
        job: /usr/sbin/aide --check
      when: '"kernel" in ansible_facts.packages'


# Ensure Local Login Warning Banner Is Configured Properly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_banner_etc_issue_cis,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Local Login Warning Banner Is Configured Properly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    cis_banner_text: Authorized users only. All activity may be monitored and reported.
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      OXZSVkF2YVVzNVduSnBPRU5XZUVsbEsweG5RWEE0U0ZaVmVUUUtaM1V5WWxRM1ZsUjNlRXQ0ZERO
      YVNtcDVhVFpqUjFVNVlXbHJiRmc1VUVOcVZWRXlkQ3RTWVZKMVVUWmlWbWRyY0VSeFRHcFVabTFI
      Y2t4b00yWTFiQXBFVW1sRlIwdHpSMHh1ZDJSTGRUaEZZMmhJVFU1clkwTkVZWFJDYkVaYWJHeFhV
      elpMY0ZSMGIwaHRWRmMwZVdNNVV5OU1kWEJSY1ZwU2RIVkJlVTF6Q25ObE55OHpkbEpYZVZGaFpW
      WjFRVlk1UmtKRFJrVlFkSEZKVEdkb1J6a3dWWGhIYVZGMU5HUklWVmQ2T0hCbFNIcHZhR1Z4Y1hO
      TFNuVldOVGRKZWtvS1NtWmhSa05hYVhkeE1Hc3ZPRmN4U205cE1IRjNVbTFPYWt4dVZHaG9lWGRQ
      U2tsS1pXVXdXblppY1V3eU1ESmlMMHRsTjIxcU1pdEZkM1J4ZUZKNmVncGpWV2RxUmtjMWIxVjNP
      R2hJU0ZSeWRYWmxTVkp4Ym14RlZHWkpOMlp1VG14bGFESXdPRUpCVGxoQ1MzSnVMME5xUjIxQlRW
      VjZiazFrTjJad1lreFZDamhwVUdoSVJVeFNjRWREVkRkVU1uQkhWRXh4UjBreWNIWmxTVGRJTkRG
      dFpHbDVRbUZPVXpkdVVrRTFRemhYVEVaeE0wUk5Ra2hXV2pGUFUzTnlUM0VLYlV0alZuWkhlSFE0
      VEZWaGNFTXphSFJpZVdOblpUY3ZNRzFTVGxsc1pGZFRWVEJtZWtwUVkySXpXVWszYldJMk9HOVlT
      M1pTZG14cFRXTXJSazhyVUFwTGRWWmlOMmRxT0VkMWFWVm9PUzlKTWprM1ZGVlpNa2RSZDJOa01I
      cFJNelJ3V0hsa1RsbFpjRTQxVUZWNGVsVnZaMkZhTDBKRU1tOXRRemxOVTBsTENrZ3ljMUpUVXpa
      eEx5dHVPVFJtWjAxRFYweDFVWGw2VG5WSU1YWm5lRTl4WjJwSFZUaDVaMDlhT0V0MU5YUlNPVTl6
      YVVod1p6SjNUV0pCVnk4MFYxZ0tXVlJVYlRZMVQyRlNPRFZTWlV0NVJrOWFTREp2ZFcxSGRHNXJa
      amRwTkM5NmFFaFROMFpCYnk5WlJHcFFPRWMyVUhWVlJrNDJXVUpDUlhGTkwyMTBaZ3B4TUM5TFYw
      NVlRbXRKUjJWemRHMHpRVEJ2VGdvOVNYcGtVZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86160-9
    - banner_etc_issue_cis
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure Local Login Warning Banner Is Configured Properly - Copy using inline content
      ansible.builtin.copy:
        content: '{{ cis_banner_text }}'
        dest: /etc/issue
      when: '"kernel" in ansible_facts.packages'


# Ensure Remote Login Warning Banner Is Configured Properly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Remote Login Warning Banner Is Configured Properly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    cis_banner_text: Authorized users only. All activity may be monitored and reported.
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      Tk1NRkF2YVhOUlQwZEZlVTVRTWk4M1lsWXJielY0YW5sS1lrRUtTVWhzUm0xdFVGQktRMFF5Wmxa
      WWNqWkVla2M1V2t0SVNTczFlUzlNY1VKTGNrMWhVMDFzUldRMk9XNVBZbmR5UzNSRFkzTmpSa3BG
      Tm1kb05XTkljQXB2Y2xKa1oweHhZakptZWpoRlZsQnhVM1JCYkRaVlRtbEJUVzFJWkhJNGJUZ3lh
      VUpVVVRWamFHeFNRMDFYV1c1TlJrSkhhWEZvT0dGcVMydHRSMUl5Q25jMWVtaDBWMDVXZDNSMFJU
      WkJSakZsV25aSmRFMWpjeTk0YWtoak9XdFJhQ3QzWWpWVk9FVXZabEZuTkhsM2NsTTFTWFZQYTFs
      a1ptcE1Va2xMY1ZBS1VVeFBTVzVOT1ZseWVYaEZaRTUxU0doTmNYZEVORU52VFdaNU1VeFJUWHAy
      U21WVVJEVlZXV014ZG1SV1UybEJaMWRyZGxSeWJtVlFaa28zTHl0TVZRbzJlbVZsWXpaa1NtSlpi
      REZOZFZBMVlVZENiR04yZVZSa1EyNWFXVEZuYkZrM1dEbFVlVE5aU3pWM2VsTnNaV0ZvVjNGNU9G
      ZHpaV2gxZHpaSFRISTRDbFZRUjFRM1RFcEhaM0JaT0U1bEwwazJWMmQ1TW5WVVJIQllUVVYyTVcx
      NFNIUmlWMVpsZERKNlNHOVZjblE0U25wVFdXdFVUbEZZU0dabmVsQkVlV0VLYlZoQlZXWmxiVmho
      Tm1ZNVpXTjJVa054Y1M5NmF6ZHBjV05KZEVwTlRHRmxNRGd2UVhGR05EVktUR2RITUdwek1VTm9j
      RlJHTWxveVVYaExUV3hNTmdwQ1QySXpNV0l5Um5sa2FYcHdkbTlwWjBOa2VVZGhSVzU0V2tSaFFY
      ZG5UbWMzYVhWcE5VaEhRWEU0UTBwM1JYUTVObkZ4V1RCUE5TOXpjV3RtVDNSYUNrTjNOa1I0TWxC
      eVdEbFBZMjlFUm1kRmJYbzRibVZUWTB0NmVVZERNMlJQSzFWa09YZEJNMk0xYW1GWE1GSmpiSEV2
      V0dVMFJVYzFSVWxxTldOWFNVUUtiSEExWTFodVpXTkVkemgzYTBWUk1WSnNiVms0U0ZKUVRrOXVj
      MjVzU3pSTWFqZzJaa2xRUjFSbmJWZGlRbHAzZDBOaVVqUkJkbkZJY0dRM1VIZFFVZ28yWjI5SGNI
      WTBaRTgxVkhOSVJEQmFUVEZ1THdvOU4ySXZNQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86167-4
    - banner_etc_issue_net_cis
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure Remote Login Warning Banner Is Configured Properly - Copy using inline content
      ansible.builtin.copy:
        content: '{{ cis_banner_text }}'
        dest: /etc/issue.net
      when: '"kernel" in ansible_facts.packages'


# Configure System Cryptography Policy
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_configure_crypto_policy,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure System Cryptography Policy
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_system_crypto_policy: DEFAULT:NO-SHA1
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VXdkMUF2VWtkTlltSlVMMHcxUmtSbE1HTkpSSFZDYkVwV2IyNEtNRE5IZGpGQllsTnBZV0o2VG10
      WlFXWlZjMGx1Y2xaYU5ETjFVM0I2Y2pSaE5IcERORFI2VjNRdksyNVVUR0ZYY2psWGExWnVNWGho
      VWtsdE0zVjBhQW96VVVoVFNqZEtkeTh4WWt3eGNubFBOM0ZUUjAxWGVuaHBPR1ptY1hoNmIyUkpW
      elEwTkRaRVdWbzBabFJsVXpZeVQzcFhSVFJFV0ZRclRWSnNTWGQ2Q2xSVFIwTjNha3B1VHpaV1Fu
      bEhSVGhtWldSM2RsaEZUMjFsZEVJMWJYcEhVSFUyYml0b1NEQlJha2h3YVhoV1dUWTRlR0ZFVkdG
      aWRUSXphRVl3WVdzS1VWUlNXR1poTW1Oa2FXSktZMWxTYWpSUFlVeDZaemt2UkV4WWRsVk9aV0pH
      UVhKM1dXMVdiRFVyS3pnclYzYzFUMEZDYUc5cmVsSjNVekI0WkhOdlRBcElNVU5aT1d0c2F6aHJN
      alJLVFdsbVpISm5kbTlIVkhsV1UxZ3lTR1pHYkV0UmIwbHpZbFYwVVM4MldVeHFUMVkzYWxweVFr
      WjFTMjFHVFhKMEx6WnRDbkF6TjIxQ1pETlJjR3BxYTJsWFZGbFJZVEJ1VEZSR2RuVkpWR2R0YUds
      RVZrWXhZWEpCWWpsR056WkthV292YlRSblQxZE5RakptUWtSeFZ6aDNiRFFLTUM5bVNEaFBSVVpY
      V2taNGNWbHFOVWNyUlc1Qk5tbEdhRmhyU0RKalFVZFBZWFkzZGt0MlEycENPRGhzYlZrdmVHRnNZ
      bkpKV1c5WVRteHlObmgxWVFwcWNXNVhabTFhUkRGMFlsWTBja1JQYTB0VmJqbEZTR0ZMT0dscFYw
      VmlZWGhyVFc1cVpFbFJRM2hyYmxoSGRTc3hjMkpSSzIwemNGQTNVMHhZZDBsekNsWldSMUJUYzJW
      b1ZuZzBTR1Y2TnpVelMweFlVVk5GZVhWWk9GaGlkVlYwUWtocGVtSmFiR2RvZEhGc2QzQkJlVWRN
      YTNCR1ZDdHRRV3hJZWxOMFpHc0taMVYxZVhaT09VRXJNa1J2UTJWalZscGxjVkpEVGxwVVFuZE1j
      WGd4U0ZsV2JqSldlWHBrUVZoa1JVOXZVWGhFTms1U2RVOWtVRk5GYjBwd1JXbzRPQXBEV1hkU1dV
      NDBTR2ROZEVOTWJUZHdkMjVtZVFvOVNtcERVQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80935-0
    - DISA-STIG-RHEL-08-010020
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Configure System Cryptography Policy
      lineinfile:
        path: /etc/crypto-policies/config
        regexp: ^(?!#)(\S+)$
        line: '{{ var_system_crypto_policy }}'
        create: true

    - name: Verify that Crypto Policy is Set (runtime)
      command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}


# Disable core dump backtraces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_coredump_disable_backtraces,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable core dump backtraces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82251-0
    - DISA-STIG-RHEL-08-010675
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bEVRVkZCU25adVJWRkRUbUp4WjBkRFMwOUhLMHQ1THpJME1FSUtZelpaTXpkWVdYYzJValZhYUhS
      T2RrWkNNVzFZTUVaM1V6VmxVV0ZDVWpGV2RtdzRVVXhNU1VGelpVaE5XR1EyZUVKV2JqZFhjSGRW
      Y2xSbWIydFFUd3B3ZFdwclJIcENTalVyZWxGSWNGWXZabGhxVjJGR1ozbHJWVXhWYlRCMlJEWTNP
      V0o0V0ZreFZuaEtSbFJwWmtNcldYTlJla3hJT0ZkVGNGQm5NbkV2Q2tOV09VSkViVFpyUmpOR2Ns
      UnZWSEJPZFN0b2FrbDFlRzVNU0VkdmFucFJjekpzV0dOTlkzTTBLMEZMY3pFek1FTkhSazExVjJG
      WmEydEhXakJOY0RVS2QwdHJSVlpZV0dwcmMweHZiME5vVFdabUszaEdhVnB3U2pocmRYVXZPRVZD
      YlZGcVIwOTVTbXA0ZVU1a1FXcExlbVJ4UlZsT1pWYzRORXgyY0dWQ2JncExhakJpZUc1bVozQXhT
      RmxRYVhGbVluWktTa05yVWxvelpWZENablF4UlVSbVVqaHdVUzlVT1c4M1UybGhWMXBwTjB3NVNu
      VjBVU3RGVFdWVVREaHBDakZ0YUdRNFVVVXZNMGgxY0VOcVEyeHhVamR5YzB0NFFrOUthRGRPWVVK
      YVowcEtUMWxFZEhCeVNrbGFORWgzVkdaNk55dHJTWFZKWjBRM2FtWTFNVE1LWVhGSFZtUmtOa2Rx
      TW5CeVNIRTFMMWhwYUVsNVJIZG5iMmhXU2s4NVQzQXpVRTFVVmtjck1FMHljQ3N2ZUdkb2JWSlVa
      VFJXV21KU2RtRk1hR0YyYWdwRk1WSkVhM2RKVURGbE5FbElRVkZtVGtoQmFYbDJSbUZLT1RKR1kw
      bFBVemRpUzBkM2JVMVRRVmxJZFhaNGEwSk1ZbXRrUzFsSWJsZzBWWEJIVjNCd0NrdGtXa1JGYWxa
      WFYwb3JjVUpyUlhZMlJDOXVaMlJQZWxJdldtMVdiVlJHYmpjM2JXWm5aMWxyY2xSblJrcHRNWFpt
      Vm5abVptaHhZa1prVmxac1Vra0tjRmxaU0ROU1IwUm9aWFoyYlhoS2IwNVdXbUppTVVaelJrRk5V
      Vmg1UjJkNmMwbFpLMDlGY2pkSk5rcERTakpoY1ZWRE1WZElSRGRsVFVSeVNHMVBWUXBFUVdKYWNW
      QkVjSFZDYWpCYU5XTkZWRkpuVlFvOVZUSlRRZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set 'ProcessSizeMax' to '0' in the [Coredump] section of '/etc/systemd/coredump.conf'
      ini_file:
        path: /etc/systemd/coredump.conf
        section: Coredump
        option: ProcessSizeMax
        value: '0'
        create: true
        mode: 420
      when: '"systemd" in ansible_facts.packages'


# Disable storing core dump
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_coredump_disable_storage,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable storing core dump
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82252-8
    - DISA-STIG-RHEL-08-010674
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxYzVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dDVZMUF2TVhWNGRXaE1hMUZQYm5WUGJXbFlSbmh4VGtobWNsTUtaREJKY2s1VlJIcHBLMnBWTkdk
      blZFTTJOWEpPUmxsNVRVeExVVnAyWms5S04yZGhNRlZJU1ZSeVlWRlFZVEJaUjA5eVJXRkxSakp4
      TDJ3eldXeG1Vd296V2s1dGJUZG9hRnBLUVZVNGJsSTNiWE5uYWtKck5FTmtTRFZQV0RWSWFFZEdL
      MGRvYldZMVQwNVpNbVZxVVZKMmFFOHpNWE5WU2tJeVRFcFRSMDltQ25sTmNVMTJXRmhwT0Vkak16
      VjVTVVZwY1hGVVVrMDJjRnBHYlUxWGRtSmtiWFpSWVhRMmFuTlljbHBRVGxVM1lXMTNaamQ0YUhS
      dlRGRnhOQ3R6VTJRS1Z6RmpWRFY2WW0xbk9GQjJRMk0xVkc5RFdEaG1jRmc1Vm5oalFYcHRLM1ZM
      YjFWSFMzaFJWMUJUZEc0eFkzYzNSMnhqU2k5RGJuSlFRVVJ2YTNKbVpBcHFNMUJLUldSb2IybHdk
      RXRTTWtwVmVtSnBabTFDWWxobGNtVnBTemhDVG5oeU4xVnVSMWR6TVhSdFJWRmpVV2RwVVdwbk1t
      VnphMmhaYUhObFVYaGFDbVIyTVRGT01YSTNjbk5NTmt4RWJXNDNhVGw0ZGs5RmIwUXZXVGtyY1ZO
      RFZGVjVWVEZZTW5sS1FVMWFURlZGTm1KTFVVNTBiR0ZpV1VJNVkzcDZiR29LY1ZCYVRXNTJNMWcw
      ZUhkNFYwSmlUVWcwUjBOeWVXMTZXV3RNVUZJclNFNXFNVzV0ZWtoSFFXTlBNbGhYT1hoNWQwNVhV
      SEp0Y1ZWdU5VMXlPSEY0TXdwSEwxTlJZV2hJTnl0MFQxbDRablJ5WTJGQ2VVMVBTVzFKY0hkWWIx
      QkdkRTFRZEdSNk5tdHdSR2hZU0hwR1UxbDRRbEVyZFdoNlRsSXhla2hpU1ZkTkNtZ3ljRWs0UW1K
      MlVHTjBXRkZ6WWtWQlNteGhOMGRHVlZWUlRTdHFTVnBZV1RaNGEyNTZSR0ZyVEZZMU1tWjJSazl0
      TlRKRFprMDJXbWxxT1ZoMmNWZ0tRMWd3WVZWWldYaHdkMlIzVlZseGVreEdVMkptWTIxaEx6SjNk
      bTlPVW5CVVp6aFBhR1ZpWTBRMGNXRk1URFJ6WVNzMk5uUklORWRIZG1ORFpYaHNid3BOWTFaRlpt
      c3pSMmhITm1KUU1ESnlZMDUyTVFvOU9YaEhSZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set 'Storage' to 'none' in the [Coredump] section of '/etc/systemd/coredump.conf'
      ini_file:
        path: /etc/systemd/coredump.conf
        section: Coredump
        option: Storage
        value: none
        create: true
        mode: 420
      when: '"systemd" in ansible_facts.packages'


# Disable Host-Based Authentication
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_disable_host_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable Host-Based Authentication
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80786-7
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - disable_host_auth
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3JRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      UmxORkZCU25KclRrUTRUbGR5VGtWTWQwVTJjRXc1ZW05bE1Wb0tkWEpQVkZOS1dIUnBabGhGTHpC
      UWQwSjZZVGhaVFdsek9FRjFUbHBGUmxCTlUzSndTa2RGU0dFd1pETkNNM1JTSzFsUlRUWk9kR1ZD
      VXpad1RsUjZVZ3BQU2toM05HaFpjamxVU0dsQlExbGxObGhoYUdoMWFVcHNVM2RPVVdreE5rNVlR
      MDVrUmpOQ1dEQnZWRTV2YkdWSU1tNVJiSGxETUZGcE4ycHhPSGxDQ2tkVVQzcFNaVWg2VjJSTVJq
      Y3hjRkJSZUhRNE5YSlFNV1JXZDFwNmVEZ3lhMFZqVm5SUFRDdFhiMFUwZFZCaE0weG1aVkI2VjBG
      RE9GcHZRMjUyUnpFS09GWjRhRXBHTVVSdmNuUnhORlZFTmxGWk9HRklhbWxDWTBkTU4wbGlOVFZJ
      YWt0S1ZtNVlkRXRqT1ZSbVVuQTJiV3RTVlhoVVNHNXBSbnB3YmxGTU5ncHNaVmt4UjJ4WVFXOTNZ
      Vll6TDBsSVowaDNZVEpDVDFNMmJtOXBNV0poVmtkTVRXVmhVMDV4WkRWdE9HWjBMMUl6WkVwak4w
      MXlXRzlWYzFKUk9HOW9DbGg0T1dkNFpUZG1jemhaYzNGUGQwMXJUWGhHTjFsUU0wY3dhRU4zYmtk
      SVZIaHJOa1V2TjBGSlFXUXZkV3AwU25oTmF5OXJTR2d5V2xBNGR6UnNjMVVLWkVWak5WZE5ZVzVO
      VFdwRFVHZzNURUpFVERGMk1HWkdiWFowZFhneE9VcEVURGxuUkdaWVlUUllTVkl6ZFdKM1IwVmhU
      WEJXY0RWRGRFRmhTakF3TVFwWFJFazBPRWxqYW00cldIYzBURzlTZFRoNlpITmtTVEZFVkVkUlN6
      QjFiMkp4VEdGV1dUVjNlRGhwT0RWU05sUnZWbkZ1UkZoeVprWk5PR05WUkdRckNpOXVXbFJDVjBw
      M1dESjZWazR2UnpKTWNuWlBabk42VG5SSkwycDJTM0JZWkdSRlMzWkxhbkZzV0RGRlpUVldVVTFH
      ZVZCdU1XUTVWMVpTVTB0cE5VRUtVVVkyUTBSTWQyeFlWR04zVjFkd1NqaFpTV1FyT0dvNVVVOHpS
      REJHVFhJclkxbGxNRXRyYW5ZNFJrRkdOR1ZSY1ZaM1oyMDRSbEo1V1V0R2FFcEdNd296V0ZSVU5s
      VkNTa3BuVWtkbU5XVXlTQ3M1VGdvOWQyVlVTQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable Host-Based Authentication
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*HostbasedAuthentication\s+
            line: HostbasedAuthentication no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Enable authselect
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_enable_authselect,fix)
# Version: undefined
# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora,multi_platform_ol
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Enable authselect
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_authselect_profile: sssd
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3JRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      WTFPRkF2YVU1ck1HZDFla2wzTDNSdGRVVlRkRWgwTVdwVGJXMEtRamgwVDAwM0szZFRWQ3NyVWxG
      bFVYTldkR2RVZFZoeE4zcHhSWEJVUWk5VGQzZEVSVUZFV0V0c09XRXpTUzh5YkdSSllqTklaM0pS
      ZWpOblVXZE9UUXBVZUdwRk5uSkpLMDlNTW5oM1MydE9XazgyTVZoRGNWVkhVWEV6TXpoMmFsTlNl
      V2RqU1RSeFNGb3hRMWRVVXpGWlprUkpZbGs0UWs1M1RtbGFaM1o1Q2toM2NqazFlSGhDVkdOakx6
      SjVaamhIVUhaRWQxbHpTVzlITW5GSWQzWjFRa05xWW5KamRtZ3ZNM2w0UVUxbE0xSm5TSEZEWkhC
      dWVFOW1MM05MUzNJS1RXOXFOVFZyVWtaWU5FcGpNMjlWWjI1eUwybERaSEF2VGxKMVpsTlJjbGxE
      VWxWb1VEUkJlSHBDVldReFJVeDFUR2h1ZEZkcGVWQkJNemhEWnpnNGFBcDVSV3BzY1dJelNHRk9O
      bTFvVDIxM1IyOWtaR1pzWlc4clp6QTJiV0ZpUjNSaWRXNURNakpXWTFaclJsUk1UazRyTWtoelF6
      aDZZakZzZEVOSFlVZGFDblVyYkhvclpUQk5URU5pUzI1TFptMUZWVFphVGk5T1ltNWlRbEk0TVhS
      NldUSlNRazluVVhsMFRHRXlVWFkyUm10S1QwUnpWbWwzT0ZoVmVEaEZVREFLVTIxdU9EZEllV1pV
      VjFRck5teDZkek41VGs4NVNsUldibGxSVldwdWRVdGFPR1UwTlRoTVkyYzNVRkI0WlVWcWRVWnFW
      WEJVZEZkM1dtVklaVXhRVWdwcGVUbExia3MzWW1GWVpWRnVkMGRRU25oeFpDdHZUVWxRVW5ORk0y
      UmpOVzRyV1ZWbVkxZzJkMEZvY21oaWJucEdSVXM0VW5KSmRHSlFTVEpvYzBrNENqZDNZamc0WVZG
      bmJrOTZlVVptV2xod1RVUkNUbU5zWkZWa2RrazFkbEYzY1VWRVoyVnpiV1Y2ZW0xTmIydDNhV0pv
      U1hnNFJIVkNURUZaU0dOUWIzWUtkbWd4YXl0S2FEQXZjRFoxWWxsUk1GWk1hRGREZG1ZMGIwZ3JT
      RXRJUTFoTGJYZ3haV2RpZWpBelExWkhXaTh6Y2tNMFpqRkVlalJWUW5KT00zRk5NZ3BCYVdOVGNt
      azRNVlIwVVRGaFZXcGhhMWRMWVFvOVREUnJjQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-88248-0
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Enable authselect - Check Current authselect Profile
      ansible.builtin.command:
        cmd: authselect current
      register: result_authselect_current
      changed_when: false
      failed_when: false

    - name: Enable authselect - Try to Select an authselect Profile
      ansible.builtin.command:
        cmd: authselect select "{{ var_authselect_profile }}"
      register: result_authselect_select
      changed_when: result_authselect_select.rc == 0
      failed_when: false
      when: result_authselect_current.rc != 0

    - name: Enable authselect - Verify If pam Has Been Altered
      ansible.builtin.command:
        cmd: rpm -qV pam
      register: result_altered_authselect
      changed_when: false
      failed_when: false
      when:
        - result_authselect_select is not skipped
        - result_authselect_select.rc != 0

    - name: Enable authselect - Informative Message Based on authselect Integrity Check
      ansible.builtin.assert:
        that:
          - result_authselect_current.rc == 0 or result_altered_authselect is skipped or result_altered_authselect.rc == 0
        fail_msg:
          - authselect is not used but files from the 'pam' package have been altered, so the authselect configuration won't be forced.

    - name: Enable authselect - Force authselect Profile Selection
      ansible.builtin.command:
        cmd: authselect select --force "{{ var_authselect_profile }}"
      when:
        - result_authselect_current.rc != 0
        - result_authselect_select.rc != 0
        - result_altered_authselect.rc == 0


# Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_pam_wheel_group_for_su: sugroup
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3ZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      aFNORkF2TUU1MFNsSkNlRGNyUVZOYVkwVlRhMU42WkVvd1NIWUtSM1J1V0VOQlJtNVpVeTlKWlhs
      MWFHVkNiWFJuVWtaTGVGZzJNMGQ0ZUUwNGVqSjBaelJQU3pscFkxQTFjV3d5VTNob1NFazBRM1ps
      TlUwemJGRm5kQXBNVlhSVldVdHlNMmh0YVZKNVRXRlhZVUpxTkVjMFRUZzBRakUzVVdOSlExaDBX
      VzB5WkRkT01WcDNaak15VVhKVVJIQlFTV3BuYkV3d05HSlJia3R2Q2xwRmIyUjVObEp4WW5wYWRI
      b3JiREY2ZEZremJEVk5hbE5IWkRGUUszbHdTbkExU1RaR1VGZEtMM0o1UkUxaGRWWmhUMWhqWVV0
      V2EzUkhNbE52VEZjS2NUbHdhVzg1U0docU5ERlFRMmR2YVRrNEwyTnJiMVpKY1c5TlFUY3JkMDR3
      VWt4NVNGUlVUVXh4ZEhWa1dDdE1XRFp5YlcxR1JFcExaRXBIU2xCRk5nbzNZak5yYldaak1FUkRN
      VlZPTDI1WWQwSmtkbE5aTVhWYWNtdHlPVFp3TlVGVmVtSmlTVkpRT1ZSdGJIWkdPV2xRTm5GWVVY
      cGtWWE5sVW1WalpVTm9DbXQyVVVKNE15dDZXakZaYUN0aWVsUmpTMWcxT0U1d2RqZFRjMk56TXpa
      S1VubHJZVXQ0Y0dKRWFITnhNa000WkM4MVVGQjNWVmhNTkRoclVYbFJSRVFLZHpBd2VWbzViRXRE
      VHpnNGVsUmpUR1ZVTlVGS05IUTVLMmc0TUcxUVpXUmlUbUpyZUc5M1kwWkpibG8zY2l0c1NYTllT
      VloyUkhVd2NGaEVSa2hEWmdwcUt6TndVbmwxTjBod2JtcHdTRFpvZUd4NVlsVkxSazFxVXpSNGFX
      NUpRMEphWm5SWk5qQTNTM0Z4YTBWRFpIcDVXVWtyVFdSMkwwWjBWelJoTjI4NUNrcG1WMFZ4Yms1
      elZqQkxTbEpyWW1ocVkyOWxTRVV5VEhGME4xWm9TMVZqVW5RMFUyZFJNMnhLVkVKYVZuYzVXVEZr
      WW5GVmRFWk1iVTFwTTJobWVsUUthbGh0YVZoV1kweEJUamxEU2xsVk1WUXdlbVEwV0VGVlZWQktL
      MUUwTkVOWU9YRXhlamx4VVhsNFZrVlJVM0J1WkM5dldqWjJjREJoVG01cVRFTmhjd3BhT1ZnMFNU
      ZFJhRFpWVWpSMFRXUTFjR1JqT0FvOVpGSm9Td290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86071-8
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - ensure_pam_wheel_group_empty
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty - Ensure {{ var_pam_wheel_group_for_su }} Group Exists
      ansible.builtin.group:
        name: '{{ var_pam_wheel_group_for_su }}'
        state: present
      when: '"pam" in ansible_facts.packages'

    - name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty - Ensure {{ var_pam_wheel_group_for_su }} Group is Empty
      ansible.builtin.lineinfile:
        path: /etc/group
        regexp: ^({{ var_pam_wheel_group_for_su }}:[^:]+:[0-9]+:).*$
        line: \1
        backrefs: true
      when: '"pam" in ansible_facts.packages'


# Ensure that /etc/cron.allow exists
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_cron_allow_exists,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Ensure that /etc/cron.allow exists
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86184-9
    - disable_strategy
    - file_cron_allow_exists
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3ZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      RlFjMUF2TXpZMmF6aFJiRTlOTDNSelFsRk1aM1k1VDIwd1JXUUtNVXhRY25JcldXZEVkWHBMWldk
      WVVuQjRSSG95U2pWVE5URndkQ3RqVTNOcFRFbDRSRFIwVTJKMk9UaHlMMkZPVEVKRlRYQXJiMjlu
      ZUhOVVRsRkpTUXBoVG1waWQzTnlORmhGVHpSc1QweGthVVppT1dSUllWRjJla3RrWjFST1JYYzNO
      akZYWkRoMlUwRjRRMnBvTm1aSFNHSjRUbVJsUjJKelRrazFOamxOQ25KSU1sQmhhRUpNUzBOaWRt
      eG9WbGhHWWtkMVZFOHZNbmxDUjIxU1JVWm1Wak13U1U1b1JISXZjbTlqWXpCellreGtjM1l5WTJs
      V1V6UlFSbFZwZHlzS2IzZDRhQzlVU1M4NVVEUlhWSFZVYWt4U0wwWlJaRU5MVFRWTWVXZElVbkJY
      YUdaaVdqbEZWMDlsTDBwbGJsWTRVMU5IVjNkdlJIUjJRVUpqY0RWdU1BcFFVRzg0YzIxM2JteG5k
      WG8zZEZKTFpWZE5URWh0VXl0VWRHSnZZVVZ4ZWtsdmVXTnVhSHBMT0V3MWRVRjRjMVZHTkhCMVRU
      WjVPUzlKUjJoaVVUVjZDbFJGY0dSdGR5dDVaV2RDTlVaRFdWUkRRbk4xUnpWNmEzZDVhbTVvYVdV
      cmFHMVljbTlDUVd4aWNVVTRTWFZ2SzNseFVrMHJVVmxWUkc0M1VEQjFhVFFLZEhocWJtaFBkak5F
      WW5sWmRFTXJOa0pwTm05eFpVMXROMUJtZFdOamNuVTNNME52Y0ZkSWFWQlBMMjVtYnpKUVprcGFl
      a3BhTkZGRFJUSmhhMjl3ZEFwNVNXUkVVMDlrTVVONmIxTTFVbFpOYUhGTU1YcEtZVFV5Umlzd1Vq
      SktkbFJxZDA1RWRYbFVkRUl2V2xrelRVZDNVMlZ2TkVsWGFFMDJaakpOVERWNkNscElkRko0T1M5
      WUwxZHJjek5zVDJwb1VFdzBWMHBJV0ZneUswRllSMlJzTUdSU2FXSnJSVFZGV2s1WU1uaDNia1ZC
      T0VWdWFtRlZWMGxyY0U1Q1J6SUtWRzVCUXpodVMzSmtjMUZFTVZFNWRIUkRUeXMxT0VkalpHNHpN
      MU5PTm5GUVJpczJlamhUZFV4a1MzcEthVkkyVWxSQ1VXUnZTeTlDYzNaME0yaHNUQXBXZURGTUsz
      WlZhMnMzZUZaYVUwUlNjSFJuY0FvOWFrOVBjZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Add empty /etc/cron.allow
      file:
        path: /etc/cron.allow
        state: touch
        owner: '0'
        mode: '0600'
      when: '"kernel" in ansible_facts.packages'


# Ensure that /etc/cron.deny does not exist
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Ensure that /etc/cron.deny does not exist
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86849-7
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - disable_strategy
    - file_cron_deny_not_exist
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxY3ZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      bEZRVkF2TUdoVlIzZFBZMmhDYUVkTGNEUkpialV3TVdKT05rUUtUVEpXTDNOVFZEUXZRU3RtV2tk
      bGRqVnlNM3BxVWxsc016WjZSa2RTZWtsdU9HczNaelpCVlZRMGFHeDBOR3BXZG5KcE9YWkdiR2N2
      YzBkemVrZHJiUXBxT0dOV1FYVldPRVJLY1U5UFRuQTVOR0o0ZEZCaFNHNURSRTFYUkVaU1ltMXNN
      bGxtY1dkTGRsRldkVkZ1VnpoTkwyMDROamRUUWpoRkwyMVJTSGxRQ2l0cFRuZHBiWGMzSzBZNFMx
      ZE1kemxJT0VodGNVVTBSa3RoVXpWdlMxSnRlV2t3TjA0NU1UWkhXVTh3VkZORlJHRktVM2QzVmpJ
      eVQwOUVXUzgxY1ZjS2VXeDJkbXBVZG5OclNrOVBkMHg2UjNrMmRXTkdVVXRKUjBGVU5ucG1Sa0Uy
      VVdrNFZWVjJSRFoxVDNKVUswdHdTRGRyVlV0UGNqWmtUVkEwYlVkV1pBcEJMM2RVZFZaV1dFcFNZ
      elEyVEcxT05tUmFhWHAwTkdnclVIUjZZbk5QUlhKV0x6WTRORzlKYldWemNqRnVSRkYyVGxKeGFq
      WTFZbGRFUW1OcFN5c3dDalJoU0N0eE1VdFpORWxTWWpOYU1sVjRWblp3VFhFME5tUnBMMFV6SzFK
      TVNYWTRNemxQUVdkMUszVjVhMkZ2Y0VoU2FWTkhha3R0WlhCeGRubExVVUVLUlZjNGVXbHhkVm8w
      WTFOelIwOURXbk4yVlhnMlFqZGxTVllyUTJFeU1pOUhjMkl6ZVVreldXUnlkbEpCYjNKdWFEUm9Z
      bWhrVGxKclZrUlhTME5SWXdwMFduVkVjVGx2V0dReFdrUmhNVVk1UkhKamVsTnBLMmhaVmtSNVdq
      bHFXR3RRZVVKcFNEbFZSMmN2TVdGTVp6ZDVVQ3RKWnpSamNFWkdaV2d4TjFwSkNsUnJZMFp3UlZk
      alZVRnVWR1p6T1daT2JsQkVORkl4TkZnd2IySk1jRkYwUTJoclJ6Wm5VVWhMUkRJNFZtSjNUM0JK
      ZURaMmNIWTBRemt6ZEVvMlJrNEtRek41U21nMmVraG1jVkpOV0haTk1YaHNaVGQwYVdVeVZFOWpT
      MmhLTUZodWFVZGpXQzlPZEcxRU0wTjVaVTFUVDA5blMxUnNkazVuU0VaSkwweFNNd292VlZoa04x
      RmxjRUUxUjNwVUwzZFVVVmRHV1FvOU1sRXdXUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Remove /etc/cron.deny
      file:
        path: /etc/cron.deny
        state: absent
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.daily
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_d,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.d
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82277-5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NU1ORkF2YWtsUlVtNWlZVmRsWlRCdlVtaHRhbmdyY25sVmRrOEtTMlF5TkdjMGEzWmhSa1paWjJs
      Q1duZEVVV3hzUzJSMldEQnJNRnBIUkdkbFkyMUpVRXRyVGt4c2EwSjJVMjVZWlZFclVtdFFTVWRR
      WjIxR1NUWkZUQXBUUkhBNWRuWTFVVmMwWVROc2EyOTNia2x4YWt0QlZsQXpXR0ZOWWt4SGNVbElS
      RlJHWTNCWVdHcDBTMmhyU1d0Tk1WaERjMnBJYkV4c1IzaERlbGQ0Q2xkcE4xZG9aMHN3YjFaa2Ix
      QlNLMVJhTTAxS01GWXhVV2RsTjFkSmMxUXlZbE5VVW1Jdk4wOUlUMmRwVUhoeWFqUklhRmRGUVhK
      WmRFNUVTVTVSYUZNS05IUTRhWGxoZFdWb1QyMHpjRlpWTkZWdlFtWXZZMk54TUd0c09EbHhXSFJK
      Y1dsWmNtOUJjMU14UVdOaVJIbDVTMlZGWldOallteExlbEV6SzA5R1NRcEVNR0Y1YkhKeGNIQkJi
      VUl3VUU0MVJYSjJkMWxqWlhwTVRrbGFRVUpXUkRGNWVqUmhSVUZMVHpSYVVHTklWRXhyVlV4WGJr
      TkVWV3ByZWxreGVsTnhDbHBLYWxodGMwUldhbk53YjJRclUzQnFZVVYyTkdkWlJGbDZhMUJCUXpZ
      eFUyZG9XbkZGVlRaTWEyOUlNVTl0VlZCQ1FtVmhkRnBoZVdFM2RqVlpaV1VLYVVWaE9XbGllRmNy
      VjFkWVEyNHZVV2hIVjNkTFJURmtibVpPVG5BMlVuQjZTREJWTWtwT1FXMXpPRzlST1VJclV6UlFS
      SFozZEZKeFRVcGtUbGRCYWdwRmQxcHBkRUpUTTNsellVTnlkVVZtTHpWVmJtSmpRVXB6U0hsTmJX
      SjROelZETmsxcU1XcDVlV2dyZVZCTmRsSkdXRE40TldGaVltWnNNMXB2UVZNckNrSjRlbWh6V0RW
      WmFTdDZkeTkxYWpkWk5EVldSMmRtU205ME5EZEVRMU5MVlZZeldWQlNaelZFVGpOR1VqSkdkMFV5
      WW1OalRDOXBiVVo2UW5oaGNsZ0thbXhNUnpWWFpGUXpTbFF4T0VZd1V6WTVZVllyZWxkRldGbFRS
      a2hDYTA5RGRYRnlOR280YWxnd1lWTXpNMGswU1VGc1oxRkhObk5GYzFVek16bDRjQXBSTWxsT2Qw
      dFVSbkZIWlRKM1lrOVRjM1p0S3dvOVNuRkNSZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.d/ file(s)
      command: 'find -H /etc/cron.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.d/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.daily
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_daily,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.daily
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82240-3
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_daily
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bEpTVkF2TW1kcU0wcDJTMW8xVHpJNE1ucERWWEJSY1VwQ00xVUtkVEVyWTFNdldrNHlaV3BZVXpO
      eVV6TlZaRnBTTTNOTWQyVnFVa3gxTTA0NGNpdHFkVEJ3YmxSWk1tOXdOVUZHTDJ0ME9GaEhXVEpF
      YUZKRWNrMXhhUXBMZWtveFZrUXdMMUZwTlcxeWIzcEJPR3htU0RCWFZEVmxkVXRGYm1sRlNVZE9Z
      eXRpTjFweWRqbFJlbTgwZWtaa01XYzNXREFyTVZsb0szSnRjM2xqQ2xWd2R5OUtaMkphVG1oNE1H
      dzVPSEZzWVhSTmN6ZDZXa0Y2T1haSGIyVTRORXhOVmpoaVVWUlJTU3M0WVZFMWExQkZXalJ2YVZo
      NVdIUnBUVWhOUW1zS2JsQk9ZMWxGTTNaS04yZEVVbVJqWldWR01GUjFORFZEUlZaM1QzcFpRbUpu
      Tm1KWVlqWm1ibkkzWTBKU1ZUSlZibmN2ZDBsMVJtaExlVk5JYlRCbVJncGxTSEpQVjNVcmREZDFO
      UzlsVVVsbk9EQnlSRUpVZVRKS1oyWlNRMk50YkhZelNUVlBUMlUwY1hSR1J6aE1kRFEzZGtwTVFV
      WmplSHA2ZFRZMmJ6Tm5Da1ZrWlRoWWJGb3ZUMVZZTWl0dGNrdFRabGRHUm1GVkwySmtTSEF5TDFC
      VFNuZ3pZbFJuVUdsMVVYZEljbkp0ZDJjNGJtOWhMMHM1VEVoNlJWQnFOWEFLZEZNNFEySnBVVFJZ
      T1Rnd1ZIcDZVa1ZZZVdzdlQwMXJTRTl5UlUxUldtdFhRak5LYm5SM1NteFZaWE5pTXpZeWIxcFhP
      RTF0UWtGelFtTlpWbXgzY3dvM2Ezb3lhM0o2WldoaWRFbFNZbmt4VW1wb2JsSkNUakJDY1hkbllu
      WnRPSGN3TlZkc1RrOUxORlpDVVdKNk9FMHdabTlPUzJSNFdFczNSR0Z1TWxCeENqZGFOMVZWVHpK
      V1duRTNkVlJxYmtsMVV6aDFkMnBEUWpJM1pXeHBXRVp5TDBSa1JuY3haR0k1U1dodFVpdEljelJa
      UVhwc04xUnRZVkJwVTBSU2R5OEtWbFJzVkRreWJWVnJTMmgyVEU0eUswcG9TRTUxZEU1aFMyUjVl
      RlJJWlhwamEzSm1aVkpzZERkRGJGY3JhWFZ3YXpkTlIya3ZNbWhNWkhWQlZWaE9VZ3AzTkdaRVZI
      ZDJObmxVTXpFdk9XRlBNRzVDTXdvOWNXNWpSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.daily/ file(s)
      command: 'find -H /etc/cron.daily/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.daily/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.hourly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.hourly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82230-4
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_hourly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WmxRVkF2VWxOamNHaEJXR0ZCVlhsb1psTlZTUzlLYlVkQ05WVUtWMUIyZVRoV2JWVndhM0ZOTlZa
      aVJuQlVlVWNyYzFaek9FbDFWamxOTlRabFZHTllMMUJSY2tSTmFFZDJhR040UVZoTE5VRldiR1Yy
      T0dSb1EwdFZWUW81WVhsSFMwSnRLMDFSWlM5RFMwWkxVUzlMWjBjNVlVcFhhVUZKYTJKUVRVTXpN
      ek4yVUVseFVtZEtjMGt4TjBOUlQyOXdVbGd2WTJNME9IUTVha1ZWQ2toR1ZVcHJORUV3Y25KRGMy
      ZEVaekJ3YjNVMmQyRldRU3RFV1cxRVdtOWxWelJpZDFsaVFVVm1XbnBrZVZCNVZFdDFNMFpUUzNJ
      eVpIRnhTVXRMT0hvS2JYRmhNbUZOYnpsSFZuVnRWbmh0YUM5RlUyZEZRM2RxT1dOcFIyUjVNVEZ3
      UjNBd09IaGFRMHhqTDNGWWRuWm9RM3B0UXpJelJ6TllaR1JhVjJwSGJ3cFhhSE1yWWt0aGJGZG1N
      MFp1YmxSTWJrb3dZbGhIUjNOUVlVMUxUVlZuUVdwQlNrOU1VV3hCTnpSU1REUllhbGR2ZGxRNGJH
      SlFVM1JETm1abVkyOXRDazFFV1ZWVlZsbHJSWGhQVUhsNk1XZFpLMjF0WVVRdlVFMUJjMkZ0TVVG
      Uk5YZHlSRXRoVldweGJGZHRMMXBpUWl0d1ZTdFlWazEyUlZGVldsTjFkV2NLZUhKMmJHZGtlblZZ
      YmpOSlYzZ3pTV0U0U3l0SmJ6STNNekk1YlRoSUx5OTZXRWwzU1hsdlZGZEhWbkZCZEVKVE9ISkdR
      VTEzZWtaNk1rSkxibkJCZWdwbFIwTnFZVGhSVHpaVVQxTXZhRlJvWWpaSFIwSkVTbGR6YjAweVZI
      ZHRaazlNTHpSTGJqaFpRMDQyZUZSVkwyRklhakZNV2twMWNFVkRORTUwZG1SNkNrMHJZWGM1Y0Ra
      V1EySjBZbkJOWkRNcmRXRkdlamxQUkUxV1kycG9jRUZ5YWxRclJqQjJUbWsyYWtaRGNHUnFLemRM
      TTFkaGJIZGxhV1JNVUV0cGJsWUtRMmwwUjNWTFNFYzVOa1EyUm1GWFJFbEdVRUZwYldwT1VtUnpM
      M1ZuWWpKbWJrSlZhRWgzUVZGRlVqZ3hOMGRVZUZSdVYwSnhNalpyUmxWQloydFBjUW94VldweE5V
      MHdPR0UyY1VodlQyeEZhR2d2UmdvOUwyd3JlZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.hourly/ file(s)
      command: 'find -H /etc/cron.hourly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.hourly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.monthly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.monthly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82263-5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_monthly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      Vm1ZMUF2YVZKQlUxZEpjakZ0TjFwM2VGWnJXa0ZpUVcxblVGSUtTMlEzUW1SdFdtUlJTREJLU21w
      ak0wSTFSelpxTVhoV2VYSnhlVlFyY1RaaWIwRlJOMEkxTDB0UFdIcHNibFZFUVhSNlZEUnpkbmxN
      VDBkQ01tZEZhQXBHSzFKMWFsSllRU3RUSzI5RlkwNVdMMnhJZWxsWk4zUlJUMk5QU1hoTk1rNDRP
      RVJ3WjFwcVFXOTVSek5PUWpWSFl6aFVZbWhQT1cxcU5sTXhlVTEyQ21sNFpIWkpRV1ZNTlhaU1lT
      OVNjamwzVTA0MFVtcFdaRlpuVXpsdVRtdGFhMjkzUlRoeGJEZEljbXhUTTFWUmVIUnJUME5xYWsx
      emNtTTBiVlZoVm5RS2RuWjFjSFZaWkdac05rcHRhRk5CYzNSUWJEZHJZeTl5VVRKMFppOU1ORWt6
      VG5oSWFXeFFNR0l6UWtObVFXSkpjWFZ0Y21NNGJFVmxRMWhpY1ZGS1FncEhVWGxvVWtNM05ETlRj
      MjEwV1d0QlYxQmpRblo1UW1KUFVGRkZVRzkzT1VOUVVYZE9UREJoVFdsdFRqTkpkMnRGU25GQ01W
      bERjMlUxVlVwWVJqQk9DbU50TnpVMWVUVnljMHREYWtwREwzbHVkbk5SYVc1TFdrZDZRV2xIWVhN
      MlozZGpWbTVrYzBFNU1XOXRZeXNyTUZoTE4zaElRa2xvUVZSSVZsQkhSRllLTVV4UFpteDZZMkpr
      YlhKT1ZtUXhOVkZIYmxKalJYZDVhMjAyS3pseFFXbGFZVGh0YjFSVFIwNTFVVVJwY2pKT1JqQm5P
      R3RRU21oeFMzZ3pNMm81VndwVWFXZFZjV2RMVERSNFdHYzNhMUozWmpsV2QxTXhUVkF6UjBFMFoz
      SjBXVGgyWmxVcmVXVjZTa1pqVUU0d2FXY3JjMjAzYUhKR1VXTmFha1F4YzJFNENtaFRaMUE1UVRS
      SlZtRkZXRVZPWlN0NlMzWktjREY0U1ZaNlFsaHRRWFpETXpWVkwydEJTR3RYZVdOMlJVUk1ZV1p4
      ZFV4elNsSllkRXRFWTB4UkszUUtSVUkyVkZKTmFqZFRkbXRXZW5relFYZzNWMGh3TUdRclMxVjVR
      V1JpT0VaQlRGQlhOR2c0T1daSWR6SmtiMlZEYUhSb1pHTlZSbGxEWW1FM1ZUWlFNUXBwUkVwaVNs
      RjJOblJSVUdObU56UlRSMjVRYndvOU1uRTNUUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.monthly/ file(s)
      command: 'find -H /etc/cron.monthly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.monthly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on crontab
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_crontab,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on crontab
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82206-4
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      MVRiMUZCU1N0UE5IaENiMll3TVc1RWNrVnBiM05TVldoeU4yVUtSek5IZW1rNU5VOWhjaTh4T1Zr
      d1Z6WkthM00yVGpVMFRWUkZUWEoxVUZWVVZWTXZhVkpaV0dsVFJGTmhaR2xGUkZWWGJVWjVSRUZE
      VjNkUFZrWkdRZ28yZGpWMmJFeHdVV3gwVEdab1EzQm9aM0Z5VW5FNFUwZHViMko2UkV4T05EWmlW
      RVl4YW1kbVNrVnpSRmhaVjJOSVQydEZMemx1V0doVVpqTjRVWGRqQ2tGUlppdG5jbTFpWTBoUGVT
      dEdURU54VW1Sd2IybHNjVXBqTDJKMlV6bGlZMjlaUW1aelJrNVdTVVpHVVhwNWMyeDJhaTkyTDJo
      bmJDdENiM2xWUkNzS2NXNW9Za0pDYUZocWNVNWFkbmRCU1V4Wk5FcGFXVUY2V25oalkzWkVjV2RC
      VGpVM0syVlFTRUZIY2todkszQmpZVUZ2TDJZdlEyZzBTV2d3WlZsbWFncFZXWGhtYnpsNWVXUlpl
      a04yUm5SaFNYbzRSWEUwU1hsVVZucGlTbGhNUkRWdFJHdGFVM3BhVEVSSFluUTFTemhhZVc1ak5u
      VkdiWGwzTWxVemExWm1DbTEzWTNKYVN6Rk9ibWhsUjBWM1duTkNhM2MyUzJ0VVlWZEtiVXR2TW5W
      M2RHZENhWGswWjFGa2FuaDJWRk5VY0V0cE1VWjJXVzFFZWxSR1lWRmtabVFLTUZZemFIQkphWFpO
      UW5KT05tVklXVVZCVml0a01WazNXbVZCTWpRMFF6Z3lLMHROY0ZselREaEZheTlUWkVkaVZEZHdN
      MlZJY3pabE5GSmhUalJ3VVFwalozcExkR3RrTkVFNGNGbE9WVUZCYWpNelkzVTVlRnBNYW5oM2Qz
      Y3pXSE0zY25rM1owVkpiSFZ3TjNGM2N5OUVTMjlDZVhoNFpYZHVTVmRzUmt0M0NqQlhUVEUzYkdK
      MmEzaHZSSFUzTkVjdk5FZHlPVzlGWW5reFpDOXBTbkpzT0RKMGJsSTFkMlZFYTBabk9GUkhRekEz
      V2s1MWJrUTJSbVJuVVRGdU5uSUtVamhJYnk5WE5tVkJWazQ1YjFkVFJHbDFRMWRxTW13M1FWRTVZ
      bnBtYzBVMU56WnZiM2xDZW5CRFFWSldRakJ3Y0c1VmNHaE9Wa2hMYmpOUk5tZ3ZMd3BqY1VVM1FV
      Rk1XVVpUU1VWaGVrb3ZhblZtYmdvOU5YRnFUZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Test for existence /etc/crontab
      stat:
        path: /etc/crontab
      register: file_exists
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/crontab
      file:
        path: /etc/crontab
        mode: u-xs,g-xwrs,o-xwrt
      when:
        - '"kernel" in ansible_facts.packages'
        - file_exists.stat is defined and file_exists.stat.exists


# Verify Permissions on cron.weekly
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.weekly
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82253-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_weekly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      VnJXVkF2TUVweWN6WnhUMkZtVVZSbVowWkZRa3BLU25NMFVIUUtWa0o0TjJ0U1IwSjRhbXd4VDNn
      clptOHphMnBLYTB0VEt6VkJLelpOY0ZvM1RHbERTMFJ2ZWpoRE5YUkxNRWgwYjIxWGVuRnViemx4
      U3pFNVVtRkZZd3AyY1VSVWVXUlZhMnB1Ums4elpXTnNOVFJ1Y25GM2NESkNWRzU2VmxKSGMwWTNU
      VVpDYm10dGVIUmtXbG95VGxkblVtUllUV1JyWlU5d056Z3piMlZYQ21ZNVNrSkhaRWh1UlhGVlQx
      YzRlR0pNU2xZclFqUnZkemRMU1dvclVtaHlUbWxQUVhCMFNIbDBkbmxqU21GVGNWSkVNbk14Umpk
      dFJIcEVMMk5JYjBrS2ExTjFjRUpNYVVKelZsRXhkRzQ0ZFRoVU1IUnBRa3Q0TDNZcmVtZG1VRGxz
      WVdZNGRtZFFkV1ptVldJNU0ydG5ZbEV4TkhCaVNtSmtOamg1UTBOelNRcGplV3BqV1daaWJrSlpi
      MEZETVU5aVptaHNWR2hGWkZsb1JrSnVla2hoYlhOVWRFWkRZa3AyU1hCWGJqRkdRbXBNYW10T2VH
      b3JjVkZKVUVkWU5GRmFDbmsxVG1VeVVsaGFlVTVNVTB4SVduTjVabVk1WkVKVFJFb3labEZyU2tS
      VVRGUnJaMWd4UWxOUmVUSXZlbUo0ZUhkSmFsZDVWblU1VlU1b1pUQkNiMElLVm5CSlp5dGFVRFpp
      TVc4emJIQjZTRWN3VG5NMllXeHhUa3hXZVdoTGVIWjJVMHhIZW5CRk5qZDNSekJQUjFFNFRUZ3hT
      RzlSYkdsb1JpOUlMMWxHWlFwUlZYQnFUbXhVVDFaRVFVRXliSEpRVVVaSmNHSjVUR3huWlRWT016
      WkRXbmRKSzFocFR6QjRhR2xOVlhneloxSktiMVprZUZCWFdIcE5WbWRyYm1kT0NuZEZZaXR0UkhN
      NFRqQm1MMUo1Ykdwc2N6aGxNbk5OYUUxdU9IbDRkVmRZUVdwVFFYWjRiazlRTkRaRWVFazVlVmRv
      WTNOcmJHeFZaamhPT1ZkdGMwZ0tkR1ZaWTNZeVMwTlRjbVZZY1doSk1UQkNUbmMzWkVWTWFXUTJU
      MHBNVTI4M2R6RklSbWgzYkVKclVYcHNaR0YxYlRSdVN5dFhZMVJ5WjFKb2FFTXJaZ3BEVm1GNFpV
      eDNiR1ZCZHpsR1RFVjBWVEJMYXdvOVNFNVVZd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.weekly/ file(s)
      command: 'find -H /etc/cron.weekly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.weekly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permission_user_init_files,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_user_initialization_files_regex: ^\.[\w\- ]+$
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      VjNaMUF2TTFodlEwMDJiakZpU1hreVRUbFVTbGcxUlRCNlVWVUtLMDVhWTIxdVR6a3JjakZPY2xs
      SE9YbExkMDgxWVdkM1pYWXdjbXNyU1VWTFVVcHZkVzlVWWxwRU1YaHhNakZWV0dWSFZsaEJSR2x1
      YkdSM2EyUmtNUW94V2xobWNHdDNkMFpDUldaTE1WQlNlbGhaVkdad2MzcFNaMko2VW5ReVduSXpX
      bWxNWW10cGNHTlhaRlZEWjB0S1EySk5VamQyV0dremRHMUtSMlpJQ21jeGFHd3ZTVkZQWld4aGVI
      TkNTbGRsWlZwaFozWTJWbnBMYzJneWJIUjFRVEZYYnl0dFMwZHRZbVp4VEVVMFVuRXdVVk0yZEVk
      S05sa3pXVFJhUVcwS1FrbENOM1J6TW5nM1lrWndVMGR3YUZGTWVHWmlNV2w1VWtSTVp6SlZkVkEw
      UmtwdWMyNUhjRFpXTldaaUsyeEZkMlJOTjJ0dFZIbHRhemxzV1cxNFFRcFJURmd4UzNaSFRVNXNT
      VzlDTmxKalZUUkNZVWd2UTNSb2FqWkhkV0ZPYWpOaVJVd3hSbWxUUTNWTFdFaG5NMVZzWWpkV1dt
      WjNaM1JzUW1oMlMxVnZDbkIyVWxZd04zZENVMFUzYVhaU1dFUnpiWHBJYkZBck1XVm9TM1ZIVURk
      Skwwc3ZXVkJ4THpSWGJFNDNUVEpUZDJKb2FuSkxiWEpVY0hkSFNraGFlVUVLVGxOWk1IWlpUV1E0
      V2t4SWRVRm5TMkpuZFhCaE56RjNUWEZMZVdkQ1puRlNla0pPVUVOdFZVbzNOMUJ2WW1aM05pdHZL
      MFpGTDBocWJYZEZVM1J6Y1Fwd0wycFJjbVZKYW1aUVJrbzFiRzFJWkRsT1VrZFFPWHA0VGtsMk5V
      bzVZalY0V213elZFaFRWa1pXUlN0V0wycG5ZalJQZWpkU1ZFSm9RemRFVDBkVENuVlhZM2xEU1ho
      WlYyVnNXSEJOVjI5b1Z5dHJVbWxHTDAxT1NtTlJiMDlLWW1sTmJrSnZLMHBZV0dsTlZtdG1RbUpE
      YjNoaFQyUm9helJwTlVSMVQwa0tlRUowUlhkeWIyVjFjV1UzYVhKT1lTOVZTa1JvTUhwS1JVdHpS
      azAyWmxWaFVuSmlSMnR5TkRCQlVrTndjelF2V0dGcVEyNDBUR3RxUVdsMFdrc3ZWQXByWmpJMGFV
      TTJWQzl0Y1ZodVN6QjVWbmRQUXdvOWJHcG5kZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84043-9
    - DISA-STIG-RHEL-08-010770
    - file_permission_user_init_files
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Gather User Info
      ansible.builtin.getent:
        database: passwd

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Find Init Files
      ansible.builtin.find:
        paths: '{{ item.value[4] }}'
        pattern: '{{ var_user_initialization_files_regex }}'
        hidden: true
        use_regex: true
      with_dict: '{{ ansible_facts.getent_passwd }}'
      when:
        - item.value[4] != "/sbin/nologin"
        - item.key not in ["nobody", "nfsnobody"]
        - item.value[1] | int >= 1000
      register: found_init_files

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Fix Init Files Permissions
      ansible.builtin.file:
        path: '{{ item.1.path }}'
        mode: u-s,g-wxs,o=
      loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'', {''skip_missing'': True}) }}'


# Configure Firewalld to Restrict Loopback Traffic
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# complexity = low
# strategy = configure
# disruption = low
- name: Configure Firewalld to Restrict Loopback Traffic
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-87272-1
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.1
    - configure_strategy
    - firewalld_loopback_traffic_restricted
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      eDZUVkF2YW5GTWJuVTBSRzFTUm5jMWVUUTBXV012Vm5BdlUyVUtRWEZuYkhSeVRFNWFURWxvTURa
      VVlsYzRNUzlaYzNNMVEwNUNVVWxrU0dJMlNuZ3JUVE12VTFwVE5XOWpSbE5vVVVaS1VFOTVObEEx
      Vm1kWFRHSnZPUXA2YjNBeVZrRndSblI0VFdGTVIwcENkR0pFVFdKM2IxbEZSekJEWnpCS1ZtVlFO
      a293YWtZNE0zUkhhQ3RGT0N0MmNIUmxVaXN6VjI1cmRrOWxRVFZ4Q21OalRtVXhWRE5hTDNkeVdF
      ZDRTRzVzV0dkQldXRkxkR3hhYWxWemVWQlBkaTlZZURWSGVuZDZlRzk0Tkhod1ZETlNUR2x4WXps
      M0wxZEZVVTlQVlZjS1ZXTjFVaTlQTjJOS1JYRlNPVlpNTmpkbFVIbFpTakk0WVhabmRHMVhSWEpF
      TTA1SFRDOUlMeTh4VWs5VlVXbGtXR3RzUW1sclR6bG1kVTVpTW1sMk1RcENaRXhUUTBkUlVFd3lW
      elpKWkcwMFdWUm9VMlZTWnpCdk1pOXBjek5uTTFSNFNUVjRRV0ZHZVVsUFdYRk1UazFaYzJKU2Qz
      Qk5UbWhRTkcxNFQyMTBDa04zTTJKTVdXaDRaa2N6ZEN0aGRsUkdkWGwzY1U5NlRIRmxTakpGZVd0
      dWNrbzBVMUZLY3pKTFdrOXRWa3hMTmxFM1RucG9WazlQZDFCcFIyTm9ZMG9LZFVwdU5Hb3lVV2hO
      YkhkaVN6aHRjbXRPTmtOUmNHbzNXVm81VkVoSGR6QktaMDR4YW14TFpEUXpZVUZOWVU5NkwwaGxk
      MHBFUVdzdmVGcHpiVFppT1FwQmNsZ3hTRmxPVFdKUE5GTnRlREpCYldkQmEwVmhTbkJPTW5CdlMy
      eDVVMlV6UmxSa1JHcElUMGhFUkUxbVVYbG5XRmhaVFhaaVlVRXhTQzl0U3pKVENtcEZZM0JsWldS
      Qk4yOXZjVkJ4VUZaa05WRkJVa2xsU1dKeFEySjVSbGxFTVRKeGJWWm5NVWRTTVVob2JEVnRSRmhO
      ZVdsaFpGaEpiM1JIU1dOQldYUUtaMDR2VTNSTVoxRjBNeXQwVnk4NU9ISmhRa05rUzFJMlIzQkhV
      bE5yY25weGVGZG1ObFV3UW5NeGJ5OUJPVXA1Wm5sRU9XbFdUemx0UzNJNGRXaGlZd28zVldKWVZE
      ZDRjMDU1VVVaeWNIRkZWMmt4Y1FvOVkxZEtVUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Package is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - firewalld
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Restrict Loopback Traffic - Collect Facts About System Services
      ansible.builtin.service_facts:
      register: result_services_states
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Restrict Loopback Traffic - Remediation is Applicable if firewalld Service is Running
      block:

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted Zone Restricts IPv4 Loopback Traffic
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
          register: result_trusted_ipv4_restriction
          changed_when:
            - '''ALREADY_ENABLED'' not in result_trusted_ipv4_restriction.stderr'

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted Zone Restricts IPv6 Loopback Traffic
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'
          register: result_trusted_ipv6_restriction
          changed_when:
            - '''ALREADY_ENABLED'' not in result_trusted_ipv6_restriction.stderr'

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Changes are Applied
          ansible.builtin.service:
            name: firewalld
            state: reloaded
          when:
            - result_trusted_ipv4_restriction is changed or result_trusted_ipv6_restriction is changed
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_facts.services['firewalld.service'].state == 'running'

    - name: Configure Firewalld to Restrict Loopback Traffic - Informative Message Based on Service State
      ansible.builtin.assert:
        that:
          - ansible_facts.services['firewalld.service'].state == 'running'
        fail_msg:
          - firewalld service is not active. Remediation aborted!
          - This remediation could not be applied because it depends on firewalld service running.
          - The service is not started by this remediation in order to prevent connection issues.
        success_msg:
          - Configure Firewalld to Restrict Loopback Traffic remediation successfully executed
      when: '"kernel" in ansible_facts.packages'


# Configure Firewalld to Trust Loopback Traffic
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# complexity = low
# strategy = configure
# disruption = low
- name: Configure Firewalld to Trust Loopback Traffic
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-87278-8
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.1
    - configure_strategy
    - firewalld_loopback_traffic_trusted
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      bElSVkF2TURGR2NtTlRhakpvWTJrMVJXSnBNSEEzVVRSRlpEY0tjR1I0V2xOdVUwTmFRVW8xVURW
      NGJXWnJNbTVCU2prck9GaFZaRXMwZG1WS1RUaFFiQzk2Ym5KbFIyMXBUbmRFWldGdVFVbDNRV1pJ
      ZFZKa1MxZEhlUXBDVTJwYVIwZGFOMlp5YW5kNVpVcExTRTF1YmxNdloxQnFXblpFZVc5SWVGVlZU
      MUp5Wm1sWlZEWlBRVWQwVGpGVGF6SjVkRGd2ZEVscVluWnFUVlF3Q2xGdWJYYzRSVWx3ZW5nNFVI
      RlBUV0ZaVEVSdFUxbDNXbUl4ZDFSSWEyZFZVa2hRVlhKVFExcDNlRmxoVjNKa2JtOW9SV0o0WVU5
      amFFWkZkV1E0ZDBVS1pWWnFURzVDYUhabkwwTndTemRXTjFBcllWVk5iVVZwUkRkMFNXaFJUWFox
      WTAxcVFsTmxkazVQTkRWVU1tTnVha3BVUVhwTWJqUnlaWEp2WXpWVGRRbzRTREpQVFdZME0zUXhO
      WHBzTm5oUU5rRjJjbU0zWTFaUU1qTjVWM1ZaT1VzeWMwWTNkVlpOV1hkVU1XbGhWa2xGUnpWS1oz
      SXJObHBGWVZGRmNGTXdDbVZzVDNBclpWbEdiVTVWZW1sblIxcElPRTV4VldSUFZGUTROVTVVZWs5
      YVRYaHlNVVUyZEUxbGIwWlljbk5ZVUZORmNEbEhPVFp2VkVaeU1UVkpiRTBLYUhOQ2FrbDZSMGN5
      Y0dsUWFEVmpaMmwzTWt0emRHbHNja2h0YzJaYU1rOTZaazlhVjFCT1NYcG5NVlpEYTI0eFRrUXdh
      bHBhY3k5dFJIQlJWMEU1ZEFwQ2RHaFlZV1JpVVhsM2MyTm9PV05XWkZNeGVYZDFRWEEzUzIxR1Nt
      cEtRVGxhZURORGNrVXZkMWhZUVc1TlJFbGFRbVkwVFZkMFdGaElUMUUxWTBOVENqRnJlQzl5YjJk
      S1kwNXNWbkZtU1hJM2NHSjNURkZoYVZwTE5XZFJLelJaVjFCa1FucEZjbWxwV25JdlEwSlVXVmRK
      VERsYVMydDNhSGxaVUdwVGJYWUtkM1pRWW1sWWJtZHViRGx2VUVZek9YUk9lRGxIYmtGTGNXWlRX
      RmhJUjBGM09FVk5ja1ZHZVdoWlVIRXZiR3hSU1ZWUGVEVkJNRmxsUTFJNWVteGtXZ3BCU0dselEz
      TnpjMDl2VFc0cllXbEVjVlZuZUFvOU1IUXpNQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Package is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - firewalld
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Trust Loopback Traffic - Collect Facts About System Services
      ansible.builtin.service_facts:
      register: result_services_states
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Trust Loopback Traffic - Remediation is Applicable if firewalld Service is Running
      block:

        - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld trusted Zone Includes lo Interface
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-interface=lo
          register: result_lo_interface_assignment
          changed_when:
            - '''ALREADY_ENABLED'' not in result_lo_interface_assignment.stderr'

        - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Changes are Applied
          ansible.builtin.service:
            name: firewalld
            state: reloaded
          when:
            - result_lo_interface_assignment is changed
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_facts.services['firewalld.service'].state == 'running'

    - name: Configure Firewalld to Trust Loopback Traffic - Informative Message Based on Service State
      ansible.builtin.assert:
        that:
          - ansible_facts.services['firewalld.service'].state == 'running'
        fail_msg:
          - firewalld service is not active. Remediation aborted!
          - This remediation could not be applied because it depends on firewalld service running.
          - The service is not started by this remediation in order to prevent connection issues.
        success_msg:
          - Configure Firewalld to Trust Loopback Traffic remediation successfully executed
      when: '"kernel" in ansible_facts.packages'


# Ensure journald is configured to compress large log files
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_journald_compress,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure journald is configured to compress large log files
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-85930-6
    - journald_compress
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      OTFaMUF2TVZKcGVuWlhVbmhLZDNkbmVXdGxkWE5uTVRrNVUyTUtUWGwyU2xWNVdVNDBPV3RaT0V3
      eU5DOVBhM1ZaU1ZwVldVTjFWR1pJTVdZeEszWnNWV3hhUTJWcWJFTnNjRk16U1RaVWRUTlFUM1ZN
      V0ROMVFVUnpSd3BKTUVkT05EQlVkM1pVVWtOR1IzcFpaSFZHUmxaNVJWUXZjRWRWVEVOMmVVVlVV
      Rkp5YkhsalVqWlhUMWs1V2sxbUsyNURhM1J2S3pkdVZFMTBhRzQzQ2xaUU5FMVROeXRJY1cxM1Ns
      WlFSWHBNWm1kS1MxUkJTVnBIT1hGcGFqaDFaVGRZTkhWS2FYWTBlRGhIZEVreFpFdHhla3h3YjNr
      eVFuQXdURE42UVU0S1dFNXVhbW94V1hwblFVNVhaSG95VHpGQlVuaHRUalp1YWxWaGJtVnBURFVy
      WlVweVYwMUZRVUZNYlhwblNpdGxjeXN4TjBSR2FVTnNSVE5EZUdka2RBcFRhblIyZW5oNVZrTXpX
      V3A2UW1kUVdHaHlVMnh2VFM4M2FXNXlkR2RtYTJwMGRsZG9iaTkxZEV4a2RGWkJSalJ2TVU1bFNV
      bEhZak5oYTNrNVkyTklDbmRGYW1Rd1pXVmhkRGxJUzFoV2NFSmxURlZrUzI1WFMxWm9VbTUzTTJn
      dlNXYzVZMWhSVG1ObldWbE5jVkIzVUVsaldtVTNiVXhHUmpKMmVFb3ZRakFLTTBOV1FtOTBTWFZo
      VVc1Q01XNWlURlp1VFVwVVR6SnRRMDUyTkc5S00wbHRURGsxTXpjMGRFNVRjWFIzWlRoV1FrUjNi
      akZRT0V4R05HZFdSbmhWY0Fvd2RGWm5hMHhHVW5oaE9ITkpUMDlSV1ZCYVUwTlJkVU50TTJsRWVr
      MDRUWFZDU1cxYU9VcG1ObTAzVFdzNVJXOTJiVXhOWVhsWmMzQnlTMmMyWm5kaENtWnJjRVZNTm5S
      VFNDODROR0ZPUjNCUU5GUXdLMmRsZVhKUVRIRnRjM0pFTVhvMGVuRnRZekpqUjAxVVdGZHVMMlpp
      ZFRNd1RTdFNUeXQyT1hkSFoxQUtkbWxoT1ZOek0yUkRZMjlCWjJ0TGVUaE5OVVJKZERsWU5WRllX
      VlJUZVVwb2FtNXBPRU5uTms5QlJsbzVPVFppTmtaWk0wdGFkQ3REYjFKbE1YRnFlZ3B1VWtjNVZs
      aEJiamN4WkZWS2EwZzFVemRsV1FvOVdrZHdRZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure journald is configured to compress large log files - Search for a section in files
      ansible.builtin.find:
        paths: '{{item.path}}'
        patterns: '{{item.pattern}}'
        contains: ^\s*\[Journal\]
        read_whole_file: true
        use_regex: true
      register: systemd_dropin_files_with_section
      loop:
        - path: '{{ ''/etc/systemd/journald.conf'' | dirname }}'
          pattern: '{{ ''/etc/systemd/journald.conf'' | basename | regex_escape }}'
        - path: /etc/systemd/journald.conf.d
          pattern: .*\.conf
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to compress large log files - Count number of files which contain the correct section
      ansible.builtin.set_fact:
        count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results | map(attribute=''matched'') | list | map(''int'') | sum}}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to compress large log files - Add missing configuration to correct section
      ini_file:
        path: '{{item}}'
        section: Journal
        option: Compress
        value: 'yes'
        state: present
        no_extra_spaces: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int > 0
      loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[]) | map(attribute=''path'') | list }}'

    - name: Ensure journald is configured to compress large log files - Add configuration to new remediation file
      ini_file:
        path: /etc/systemd/journald.conf.d/complianceascode_hardening.conf
        section: Journal
        option: Compress
        value: 'yes'
        state: present
        no_extra_spaces: true
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int == 0


# Ensure journald is configured to send logs to rsyslog
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_journald_forward_to_syslog,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure journald is configured to send logs to rsyslog
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-85995-9
    - journald_forward_to_syslog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      Y3lkMUF2YVZaMFlVUlhkRkE1TWxoU01rbGplVnBXYjFWdFFYRUtWVVZVTTFac1FsaGFWMmd3YnpC
      NlFTOVJUak5LVEVjNWJIaHpjWGxrZEU0M1FXWXliMWRZTVhCNVVXZGtNV1o2VUhveVExbFJiVk42
      TUVFMVpsUkJUd3AyV2paVmFYRXphMk5ZY25WNmRsTllXbE55VlVsdVJXRXpkMHd5UW5aaFNsUlJW
      elo1T0M5aFFTOHZUM1Z6WlN0Q1RtSnZNRkZNY1RKNU1VRldSbXQxQ21wS1REVlNUVE5TZEU5TVVI
      SmtaRTF5TjJkUFRYWTJjWEJ6WW1GQldWVjVhelJLSzNod1lWSkdVQzlsUnpoVFRYb3hWbm8wUlZv
      MlpXNDRSMXBLV1ZvS1MyMXNRMlpNWlZaa2FuUmtNbWMwTDBKaVIzUnlWRFowVEVRM1RWRnZWMll4
      WlRSNGQzWkVTR2RZUVZjcmIzcHRLMVpMUW1SNWJERjZhM1I0Ukd4b1V3cG1kR2hLTkN0blZucEhk
      M2d4WTBodVVHVlZjbEl2YUZGeVZXaEpPRzV1U20xRVNDdEVPREpUTHl0TlVWaFBlbXg2TUZKNFpV
      UmxZWEppT0hscVRHbFhDaXRKYzNsRGJtbHNiMDVOWlZnNWNsWkRkV1FyTDAxTVYzTmFWbG94UTNS
      YU5UazJjWFp6V0RWME5FbGhjMmxQT1M5TU5HTkhkRVkyVUV4bVlqbDRWMmtLTmpKRGFFWnNOalYy
      TmtsRVMwdzNXa2hqWW5kMFZtcFJVa1UyVDJZdlNuWlViREZRZVZScGRrMTFhMU56Umpoek1GRlhR
      MmhvWml0aFMwcExSRnB2VkFwUFJYbzRUVWw1UVZrNE5WWnBOR2h3ZFhwVmRtODJhak5KUVdwVmNs
      QkpWbWR2TVc1YU4yUkRjM0ZHWlU4elZXSTFNWEJLZVV0bkwyY3JWVTFvUW1OWENsaEdXbVpIVkU1
      YWFWWlZSVmw1V0ZwUFoycG5XbkJ4Y25OSFNESnVjMk5wUTIxWmRsVmFWbWgwTUZweldXZHRiMWN6
      ZEhaelQwSkNUM1pQUTFGYU5GQUthakp5TTFRMWNuaFVNa2RzZW1GMk5EUlRWa3hwTjJoV1JuQlNk
      a3Q0Y1VKS1pVcHZhVFp5T1UxRU0xWktjMHRvTm1KQk1HVjRZMVJ2VmpsMlVXWkVNZ3BrVFRCNE1t
      TllZVFZxZUZKeVlXUjBLelprVGdvOUszVnVUUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure journald is configured to send logs to rsyslog - Search for a section in files
      ansible.builtin.find:
        paths: '{{item.path}}'
        patterns: '{{item.pattern}}'
        contains: ^\s*\[Journal\]
        read_whole_file: true
        use_regex: true
      register: systemd_dropin_files_with_section
      loop:
        - path: '{{ ''/etc/systemd/journald.conf'' | dirname }}'
          pattern: '{{ ''/etc/systemd/journald.conf'' | basename | regex_escape }}'
        - path: /etc/systemd/journald.conf.d
          pattern: .*\.conf
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to send logs to rsyslog - Count number of files which contain the correct section
      ansible.builtin.set_fact:
        count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results | map(attribute=''matched'') | list | map(''int'') | sum}}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to send logs to rsyslog - Add missing configuration to correct section
      ini_file:
        path: '{{item}}'
        section: Journal
        option: ForwardToSyslog
        value: 'yes'
        state: present
        no_extra_spaces: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int > 0
      loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[]) | map(attribute=''path'') | list }}'

    - name: Ensure journald is configured to send logs to rsyslog - Add configuration to new remediation file
      ini_file:
        path: /etc/systemd/journald.conf.d/complianceascode_hardening.conf
        section: Journal
        option: ForwardToSyslog
        value: 'yes'
        state: present
        no_extra_spaces: true
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int == 0


# Ensure journald is configured to write log files to persistent disk
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_journald_storage,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure journald is configured to write log files to persistent disk
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86045-2
    - journald_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bERZMUF2UVRacmRrWTRNekpGUWtWMk5FRlpSREZMU0ZCeFowNEtWSGRNWldKRGQybzFkRVpJTTI0
      M1NVOXZLM0pGTWxkRE5HOXlkbXQ1Y0RocVluRndlRWRXWkRrd2JuRndLMDVpU2pCdkwzZElSek5q
      TjNZeVNEbE1iQXBrWkdweWJ5dFliR2x4U2pKa1JtNVlaRmhVWTBNNFMwZ3hWbFIwT1VKTFZHTnhl
      VE5KTVdaYVZVTkljazE0TVVsck9Xa3laRXdyUzBGbU9GVjVWVXREQ21kbVVqWllSME5OWms5UU5t
      azRSbHB6YkdGUGRqTXhhblptUVdjeFYySjVla2x0ZVRWUVJsaHVWWFJvT1dsdGNsSkpSU3NyVUU1
      WWNYcDJUUzl4TUVZS01XdzJPVTVJVVRSRGVHbHlia2R2VGpsdlQyUmpPRmgyUjJoeFNYcDRhM2xD
      VlhRMmJFSm5NME5LVTNVNVFUQndkbkIzYm1vek5XWXZlalJPTW5ObGFRcHdSMUJSUkdacFRtWkhV
      VEp2V1c0elVXcDBRWGQyUW1sdGRXMUxRalpWYm5FNFR6aDJWVzk1Wm10dFEwTnlaemhPV1UxTGRq
      aE5URVZKY0VGQ01VeEdDakV6U0hoNmQyRkhNVmxJVjJoME1rdHpNSFpoT1U5NFNtczRkVVppU201
      dkwzaHlaMmNyTDJKMGVtOXVjR2xtY3pkeUsyRnpVbnBFVVhVME5XZ3dTRllLVUhJemVFZEtVRFpN
      T0ZneVoyUk1RbWd2YlZaaFowOXBiVGg1UkRWSWJtdHJSM0p3VnpCNFNuWjViR0ZOTWs0dmNVcFNi
      aXRyYUZKWU1EQlliRWt2V1FwcFVrcGlVelUzY2tzelNYRkJiMUZtWW1zMVNFSmFaek5TTTBGaVJt
      TktZM2d3YzFsRFVpdHdWbE42ZW1WNlpuazVWVTFSU0ZJeFRDdEJkemh4VUdoM0NuSnpOa3RLVTI5
      R2VYQXdWekJ2WW1GNFF6SnJTRUpDYW1ndlZtdEliMWxyU0dkUFptUklRbU00WmxWQlV6VTJaVlY0
      Um00MWREVnRZU3RvYzNFeFN5c0tZVU5JZFVGellVaE9Rbkl4YVhZMWQwMVZSQzgzWmtGUVIzaGpP
      RUo1TTFWa2VGbEVSekUyVjJGMVJIRlpWVlZvVlZwV0syMW9XRmRXUjFoS2QxSnlkd3BPUTNWb2FF
      cGxaV3A1WkRCaU1tdHdVVXhyVXdvOVV5dGlhZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure journald is configured to write log files to persistent disk - Search for a section in files
      ansible.builtin.find:
        paths: '{{item.path}}'
        patterns: '{{item.pattern}}'
        contains: ^\s*\[Journal\]
        read_whole_file: true
        use_regex: true
      register: systemd_dropin_files_with_section
      loop:
        - path: '{{ ''/etc/systemd/journald.conf'' | dirname }}'
          pattern: '{{ ''/etc/systemd/journald.conf'' | basename | regex_escape }}'
        - path: /etc/systemd/journald.conf.d
          pattern: .*\.conf
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to write log files to persistent disk - Count number of files which contain the correct section
      ansible.builtin.set_fact:
        count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results | map(attribute=''matched'') | list | map(''int'') | sum}}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to write log files to persistent disk - Add missing configuration to correct section
      ini_file:
        path: '{{item}}'
        section: Journal
        option: Storage
        value: persistent
        state: present
        no_extra_spaces: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int > 0
      loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[]) | map(attribute=''path'') | list }}'

    - name: Ensure journald is configured to write log files to persistent disk - Add configuration to new remediation file
      ini_file:
        path: /etc/systemd/journald.conf.d/complianceascode_hardening.conf
        section: Journal
        option: Storage
        value: persistent
        state: present
        no_extra_spaces: true
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int == 0


# Disable Mounting of cramfs
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of cramfs
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-81031-7
    - DISA-STIG-RHEL-08-040025
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      RmpSVkF2TVhSMmFHRlpUak5VVTBSUmRHOVVabFJqVTBFeE5YZ0tSMUZFU2xOM2FIZExORXh4Wmsx
      b1kzVndiMk15UkROVlZFaDFXbkptVm1seVp6WmhMMHd3UVVWdVEyODRXazF1TVROWFdraEpkVGhW
      YWpsS2NrWm9OQXA0TDFoUFlUUXdiVWhsVlZVMmIxaFdSRkkxVm14alJXcFlkVXN2V1ZaRFVuQjVU
      blZIT0c4NFRUUnlSVFU0TmxCMlozUXdkR3RxVUVReGNrVkpjREYzQ21aeVVEQmpaSFYxWVhoNllt
      cHBNamM0TmpCNlYyWmlVbEJCTWxGWFQwRk5kVFZ0WTNkbGNFMVRMMko1U1dKcWQzcGtSMFZxZDBk
      RFp6bExSbWRNZDBvS1ZWRmhUbmhtY0ZwRVVsWmFWazgwVlhoT1VuZEllVnAwWm5abGNsZHRhRkpQ
      VkZCbFpFeG1iVlJRWkdwdmRIQXhOa2Q0WVN0UE4wNXFiMFpLZWs1Q1RncEVVa2xQVXpZdmJuUmtO
      VVVyVWtKVlJDOHhkVWxRVUVkdE1FNVlNbTg0VW5kWU5rdHdlV2hXV214c2NWaEdjVEJJVTBWclZV
      MXVXa0pLYzJVclFYRjNDbXBZVm1aR01tVjBNa2t4T1hJNVdqbFlNekJpWWxRMFoyOVBZemRNYzNJ
      eU5ESlZWMGt2Y0ZaTU0yUjRXa1JZY0VKWE1HeHBiSE5OZVU0NGREbFJiazhLWTBKbllTdFFkME5t
      TjJsTk9XNTFLMncxVUdOR1YzUlROak4xYUVwQ05uRkVTa3hyYWxSUlQweDJNVTlGVG5sSk16bGFR
      aTk0ZFhKV2JYb3lOelJZY2dwWk5HSnFaR0ZOU0VKeVlrZFNVRTVXZVV0dVUzZE9aVlZCT1hGRlpt
      OWxTbk5RZUVwVGVIcExRa05aWjNVdmNYVkxhVWwxZFdaSGVrNWhMMFUyUjB4TUNuRkxaaXR1U1dw
      RlpXODVZWFJQVEZOc1UwUnFPWGRWTUdWbWRWZGtSRGsxVUU5aWEyMUNNa2RaVEhKeVlreFFNbEJ3
      TTA5WVNIQmxWbkpJUlUxbVdVVUtSQ3N5ZURCa2FYZFdaV1k0YTNGcU9VMXVaMFpxUlVsdk5EQXlU
      REJHZVdvclJFdEhkR0prTUdSRGJXbFpkR1l2Vmk5MmRsTm1jbEF4TWtRNVVtOTFSUW8zTjNkU09E
      UlhTa0ZVUVdKRlRHTlRWWEZxYkFvOWJ6WXZkd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'cramfs' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/cramfs.conf
        regexp: install\s+cramfs
        line: install cramfs /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'cramfs' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/cramfs.conf
        regexp: ^blacklist cramfs$
        line: blacklist cramfs
      when: '"kernel" in ansible_facts.packages'


# Add nodev Option to /dev/shm
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add nodev Option to /dev/shm
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80837-8
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      TllORkF2TURCRlpsZGlURzlhY0c5eGNubDBiamRHWWtKTFFtRUtTR2htTm5aNksxWkhlR3R2ZFRo
      VVUxa3ZNMk42T1VSUGRXdDZWU3RqU2pGVVFUUkROMnhFVFc1ME56TjFXazgyWTBwWlFrc3llSGt3
      U20wMWNUUTNSd3BZU0RGTFRVUXpVRGhzUVhOamJGQnpUMmRLWldSalMyVkJkbFJ0V2xjMWVtdGpX
      a1YzTkRZeVQyNXFWbkkwWlhFNVkzcFRhRE5RTkhSd2QxaDZkRlJvQ21OSk5GZzVTRUpVZVU5TmNr
      bHhZMjlyU25KV2FtWnVOaTlVUmpFM1NtUkhRMGRDVkVONFozRnBTRVZLZFhkblozaFhObEUzTW1K
      SlFsZFJNREpsVWprS1pVNVJUbXRXTjIxSFYyMVFhRTlsVTNKQlEwNWFRVUpvSzJkbFpVVm1TbE0z
      VFVsRlNFcEZUM1ZQYUdwb1MyMUtWRzQ0YnpFeFVua3ZjVzFLYmxZMmNBcHZha1V6WXl0UFZqRXZh
      bFZoYTNkeVl6RkxOVTV0TjNadGJGbHBlWFZrWlRGcVVrTTFabWxJYXl0R1dXMVNZVzkzTVUxcWVV
      RlBTblpsTlc5MllYVnpDbFZaT1VsTk5IVk1WMVpPZVZsSGFUaFFXVEYzU1c1UVZFeENOVzExUW5W
      RldXbHphemswWlU4elRFVlBaV0p2TVV4bGJFNWxlaXRJTW1kamRDOUNNa2NLT1RkeWFreGFZMXBG
      VDA5dVpWcElhakp6VjJseVpuSlRiRXRyUlZoRWVFaHZaVlpCUkVwM1RIaDFNMlZxV1hZd2FWZEZZ
      bXBIZVZORU1WQkVaSEFyVXdwSVZuSlZRbWRqVVZOSGJqZzViR1JuVXpGV2FITkpjRGxJVmxnelYz
      VmtVMlJOV0hGV01HbDZNa0ZvZW1SMGFFdENjblJaVURGeVdHVlVaa2xvVjBaNENscE5NV1pvUkZK
      RVNrbHFSVWhUWmt4c1pUUldRVEZXVUdscmMweDVOVmhVWVVVMmJ6aEdTVWRSUjBaaU9TdG5kM00x
      T1dkdVFWb3dlSGxOWW1FdldEY0tORmRVUlZGdmNERk9SbkpsWWt0VEswbzJOV0kxWlhwQloyb3li
      VVpaTTAxME5reDBVMGRYU1Zaakt6VlZWbWhwTDBaTFVtTnJiWGgyZVRWM1ZVeEhUd3BvU3l0bmRF
      Z3lWbEY0YWtaTmFqaFFWRk42YlFvOVkwdEdUUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "nodev" not in mount_info.options

    - name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Add noexec Option to /dev/shm
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add noexec Option to /dev/shm
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80838-6
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      SXZTVkF2TTFGeUwzbFhXalV2V0RZNWJXMWpSbXAzUzJGdU9VWUtTbXBHVXpGQ2FUWlNNVnBRYzFG
      MWNuZDRRMmxpVVdwR1JtcEdaVWxwYjA1SWJrTk5PWG95U21ORWMyTk5helpRU2k5S1ZqTnhjakl2
      WjJvMGJ6VkRXQXBKTkVWcVZFTk5RVkpXWTBvM1RuUTNjekZKTTFWclREVndjVGRQTDI5cmVrZFFk
      M3A1U0dabU5FczJkME5MZW0xTGFGbE5aazlDV2pSb1QxRTJNa3BLQ2pkWVVqQmhkRUZKTUVaR2NF
      Y3ZMemhEZUZoMldEVjRlRlpIYnpaRVJVOTJUbWx3YlVOTmRtcENhbU14YkZwWU4zRnBjMDVUU1c5
      b2IwWkNjSFZYVFdvS2RHUlBObmx5VlhSbUwxWm9kVXAxTTI5blJrbExVbEl6VWtoa1NsWmpTaXRK
      TWtsc1EyNWpTbWMyYUVreFEwSkVTVFJ2Wml0bWJsVkhTbkJWUWxwb2VBcDNSVXh2WVRGa0szVjVN
      bWxXYUhKVFRpOWtabEJWYTJoUVpXeDVkMG8yVWxCU2JYbHpZbkZ1Um5aemVGVmFNbWd6U1daV1lU
      RmFObFkxYURnMlJEbFJDbTFtVDJ0QllucGpjbTFFVGk5bFNtMUpUbVJ3VTNoV01tWm9lbTkxYzBK
      bFVVbHpiV1o1YVdKeVNscFJZVFkyVm1WaGNUUlFPRTU2Y0dwSk1YVktiM2tLTkN0cWRqTnBNbTFI
      VlV0aU4zUmFjV3RPYTNOYVVXNWljVTk2U0dzNVozTlJSVmhHY21aVWQwWXhkbXhxWkZCRWFURmtR
      bHBaU2pkR1VFODROMmRPTVFwUE9YazJXVTVNU0VoSWJqWjFNREY2Ulhoc2RWVlhNbEIxVVU4eVVH
      SXJXVEEwZWtGTFF6WmlPV0Y2YmpobWVGZEJVVFZQUTBwblpuSnBXWGQ0TWxweUNtTlpiellyTUhG
      a1VqWjZUalpMUjNFdmVFbzRaa3N3Y0ZGb05uRmxSWFprZWxJeWEyYzRSMWxKYjFKSVJHcHlSVEJT
      WkhGbVJVdHBUMEZLWjFCSU1sUUtPVFl3ZW5ZeVRYQkdORGgyWVRWWWMzRkRhVk5FV2xod1REbEZa
      eTlhZUVkQ1kyeHFlRUZrYXpFMVVYSmpOV2w0TjFGdlJYQlhRVzFDYjA1cU4wSlFPQXAzZW5FdldF
      cHZOVzgwZFdKalFsZE9SV016T0FvOVExcERVQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "noexec" not in mount_info.options

    - name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Add nosuid Option to /dev/shm
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add nosuid Option to /dev/shm
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80839-4
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      ZHBjMUF2TVRGbWFUZHBNa1ZEZWxSTkx6WTNjV1JIU1dFek5VMEtiWGh2WmpOcWJEaG5kRmxMVjBK
      QmQwVk1halVyYVZoS1RpdERNemN5VDBkcWRFeDViRzVZUldnMFFXbzBiRGhUWW5kYVNuVm5ZbWxG
      UjJoYVltVndXZ3BPYldScWVYcHZZbkpVYTJGTVluZHhTbGN2UTA4NWJGQnlhVzU2TlZoT1ZUQk1i
      M0JzYzJZcmRtNURlRmhvT1RRM1RXUk5iSGhPVFV3MFlqQXlibmxrQ21aSlFuZFROMU00TTFWTWRV
      bzFSRFZMVEcxaFYxVklTV2xpZVRSSVNYTkVXVkZxVUVaWFdIZ3lTWFl6TDJObmMzWkdOak5HYTI5
      M1ZYUkNWRWxVUTBvS2FUZzBWeXR2YW1KUU1DdG9UbXAwUlZGMlN5OUpWRVpzUlZGeWJEUmpRMFJ2
      VVZsWGJVZFJRM2RDVEZSaVFrWk5jazlMT0ZveFdXeHdjekpCYTJzMVF3cFFVemx3Y2xWSVVEWlRh
      eXRVU0UxaE9WZG1hbTVzVVRWT2JuRTBXR1ZxVjIxdVQxaE9jWEI2V1RWaGJqTm1WRlUyU0c5ck9V
      aFRZamxuU0VOSGEyUjNDbXhJWlM4MU9WTkZVbTlxYzNCTVdHRlhTVmhOY0hOd2FtUTJaMGwyTTBK
      U1ExWTJOMVpLYjJWa1VFdEtZV0pITTFCV1FsUk9ZVTFPVmtoS2RtTm9MMVVLTldVcmVGUTNPWEZ4
      YmtaM2VVRkNMM2x1VmpkVWFYVk1RekkzVVdKWllsRTJUMGhTYTIweE5uUTFOblJzY1dwbFpWaExh
      RTVUUVRkaFoySTBTMnMyTndwWlZubHhkMjR5TUV3M2RGQTJZelpEYm5wblpGcHRSbkIxYW5GeFF6
      UnNUemN4Vm05cVJWaHVVVWhVU0dFeE1tOUNjM0ZTVDNWWWJERmFiVVJJYlhCUkNraHdTRVZzVkVG
      M2EyTm1TMWhoUVd0QlNVOWtXaXRxZFUxSWRqWk1lVGxTUm1kbU5tNTBTelJIZGxkTU9WaHFha0pa
      VjNwWFNtTlVRWFZ1ZVZoeFlXc0tPRUpWYVVjNGRYYzVORmhvT0VWMmNGb3hZbE5VVlVKbWJscFlW
      VEJ4TlRSVWVYZzBSVEpRZWt0UVpIaEpkV1o1YkhSUVFuZGtPSGRJYVhwRmVrUnJhQW8xWm5kdGVF
      cElLelJEYldGUlVXaHNlbGxVYVFvOVdrOHpSZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "nosuid" not in mount_info.options

    - name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Ensure There Are No Accounts With Blank or Null Passwords
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_no_empty_passwords,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Prevent Login to Accounts With Empty Password
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80841-0
    - CJIS-5.5.2
    - DISA-STIG-RHEL-08-020331
    - DISA-STIG-RHEL-08-020332
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaE5RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      ZFpVVkF2VWtGREszSlNjMVZ3Y0hCdFVETlFUVU5ZY1VsVlEzZ0tkRUZJVG1KUk5FY3ZRMUZ2Wlhk
      S1RVMWxNM1ZCZVRoUVluSnpkMjB6YTNFeWNFNTVPV3N4TDA5UVpUQmhPR1ZCVFZoM1VuWXhhbkpC
      VDIxTlJuWnhaUW8wZVhSQ1FqRTJTM054TlM4elJEWkdUVVZPYURabFVEWmxNa3hOZEdVNVRFNVNi
      RFl5VTBaeFJsSjFVVkZTZG5jNFZ6bExObXRHYzJacWIyVnJWbU16Q2k5a1lVTnVRbXhDTWtOeWNs
      ZHNZUzh2VkZOR1ZuRXdhSEJIZFVnMVVtRnBVRWxDYWs5Qk5tTTFhME42VVhGalZXSlBObmxtYWxs
      d1pWbGhLMHAyVjJzS1VGWndjMGhDYWpkRWFrcEpiWGd4UlhoMmNHcHpLMDVIUVd4bVEzSnlSSGRC
      VDBOTlVGWnZRMjF1VjFORVVIbFZTM1F4WkdGSFNFbFVhVlJVYUd0M1ZRcDBlREUyUVZoRU15OWpT
      RkJUTW5kQllTOVJTV1pCYTJkWU9FUm9XVE5KWWxWUWNDOWpOR2RETVhZdk4wdDJhVEp2T0ZSSFUw
      Vk5TV1l4VjFVM2RIbDNDbE5YTWpaM1JWVkdNSGhoUVZOMFJFazVURTVRVldZck5WZFpXVmhvUjJs
      bWJVeHpiWGhaZUZkc2MwcFRha3BYZWprMFlta3dZWE5sVGtoTFdUUkphMWNLTWpaeVFrY3dWMHh6
      TjJ4RlNHcDFZazlsWVdwT1RrWlRNMVp5VUhsQ2QyWTJTU3RQWTJONVZrZ3haWEJSVkU5T2F6bG9W
      bEpVVUVkemNFSmpjRXRNTHdvMEszWnlTMWhNWjJJME9YVkVNbEZMV0drelMwY3dTbWhZWlUwNUwz
      Rk1kRlZGZFVwaFMyRnBhMDFoV2taRmNXVjNVM2g0WVdkSlR6ZEVUWHBEUjB4MUNrSnNXbUZRUzJs
      WFQyOVROVlp5V0ZvclVHbGlSSHBVYTFSVVFsaG1NbGxPYzNSek16WkhabHBMTWxaTlZWSmxVa2xv
      UnpacWNEUmtVRTlEYzIxT2NUTUtlRXhyWlhGak9UaHlSR3ByUlZORVJFOTZNbWQxYUZORFRFbDZj
      MUJZYkRreVkyZDFRMjh2YURoU1kzZGthRTU2TjNKdmJrTnJObGxPTDFveVdYTTRWQXA2TnpKVVQz
      Qm5TV2g0V1dKcU5rY3pPVGRWYndvOVRTOUlaQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Prevent Login to Accounts With Empty Password - Check if system relies on authselect
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"kernel" in ansible_facts.packages'

    - name: Prevent Login to Accounts With Empty Password - Remediate using authselect
      block:

        - name: Prevent Login to Accounts With Empty Password - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Prevent Login to Accounts With Empty Password - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Prevent Login to Accounts With Empty Password - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Prevent Login to Accounts With Empty Password - Ensure "without-nullok" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature without-nullok
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("without-nullok")

        - name: Prevent Login to Accounts With Empty Password - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"kernel" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Prevent Login to Accounts With Empty Password - Remediate directly editing PAM files
      ansible.builtin.replace:
        dest: '{{ item }}'
        regexp: nullok
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - '"kernel" in ansible_facts.packages'
        - not result_authselect_present.stat.exists


# Install AIDE
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_package_aide_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install AIDE
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80844-4
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaE5RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      VnJaMUF2TVM5Q04zbDBVMWR2Tld4dFozQTVZM2d6VmtKRlNDOEtkRTgzUmxReVZqVTVOMUI1WjBz
      emNYQTBOazlsYVd0a2NIbzRkbkZXUmtGTk5tRklRVzk2WVZaaVN6SnFkMU55VUVwWFIxZG5LMGxV
      V1RKaFZWVjJTd3BTYkZab01YZDZUMU5ZYUdVd2NWQTFWRlkzT1VWTGN5OXpXbUV2TmtGaWFHVXdh
      RE0zYTNkeVEzcFZlbE5UYWl0R1pGUXZSV2xFVG1GVFNVZHpZMlpQQ2xKcE5HOW5jbk5JU0RSTWFV
      TjVhVmhVVGtaVFRGWjVUak5xYkRabWRXOTNhU3R6YlZWRFVFUm1PVVIxWVdwNlZrMVFWSEJtY0dw
      bWRtbEVVVGxTTVhNS1pIQTBNSFJ3ZFdWa0wzRnhOek4yWkM5UmFVeG5RV1pOUkdzMFMwTnpSbEow
      TmsweE1XNTRXVlpPWnpsYVJXc3JMMU4wYm1SeVpYQXpWVTkyTkZCdFl3cHphSHByWW1aeE1EVjVk
      ekZyUmpBd2VIWlRNVzByY2xoMk5rSnBNMkZhV1dGNlVuQXZiRmc0Um1Oek5scFVUMmg0Y0cxcGJH
      a3hlRzl5UWxwbk9FZE9Damw2VUZaalNUbGlTbmg0YlhKdlZEaE5VRVpGU1ZwMFJFMVNTR0V5YVdk
      Wk9HdzVRM2xTT0V0QlJFMDFhRTlRTm1JMVEyaFZLelZZU1ZreFZHNDJURlFLY1dsSVJXczJVekpJ
      ZGxwb1VVb3pRemg1VVdwdVdqZHVRa3RQU3padU9VWm9WM014TDNGV2VFMUJVbU5aZEhwS1NETnha
      elJwYTBwVGJEZzRjRzFRVWdwbVdHazNMME13Y25oaGEyTnpXbEl4U25sRVNuZGtkM1ExVlhSS09V
      aGpaREpTTm5oM1UzZHNXR0ZPYlhCWmFUWnNVR2xIVURkTlZVbFplR3BYY0dVNUNtMXNTV2hGZEVk
      VmNUTlphbXRsVldjM2JuUkZNVTlCVGxOVk5XSnlSbTVUYXpOTlVsUkNXRTQyTjFWd1dEUlFTWGhS
      VDFKcWRqY3pUMUE0WjNKWVFVTUtkRmRCTDNWdFdFNTBNVGRLUnpNNWFXbEJTREVyUTJWalRXaHlR
      VTh2TlRkVU1sZHFhbkkzTW5Sc1ZXNTZOMU5NVTFaQlNrZG5hM2cyZDNoUWFUSk5ZUXAwWVRoNk4w
      bHNORGxNZFZkelducDZTR3BJU3dvOWIwc3dUZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure aide is installed
      package:
        name: aide
        state: present
      when: '"kernel" in ansible_facts.packages'


# Install firewalld Package
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_package_firewalld_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install firewalld Package
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82998-6
    - DISA-STIG-RHEL-08-040100
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_firewalld_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaE9RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      MTRaMUF2TVZCaGF6ZEhOM05HVEdWSFIzZDRZVUpUTlRjdmF6QUtjalkzU0VFNWRqWnlNalpqZERG
      cmJtNW5lVEE0VkV0MVdXUTROMVpNTVZWSk9YRlhPQzlwY0hoRkt6RnJaREJrVjFrek5EVXJkM05r
      WjAxQ1psQTNWZ280VFhwSFkzbHNVM3BGV0dKTmIxY3pWM2xHTjNaamQySjNTSGR3UkdZeVZIbDVk
      RFZ2ZVZGdlZqTTViazVKUXpCTmJHWjNNVFl2TjNSQksyZGhabTVXQ2pSMU9HTTRNM0ZpY0hCaVVs
      Y3JPRGRKZFdaeVNVUjBUVXhJWlhsQ1pFbFhlRTFQU0ZWU1pYSjJTSE50UzNoUGFuZHZWMW9yUm5G
      TFJuRndla2t6Ukc4S04wUkdPRkF4YVhaVUwzbEdZbnBpVVUxNVZtRk1OVzloVldJcldGTlZjWHBL
      UldKalRtZzFiV0Z1ZW5oUFFrcEhUaXRZVkZWNGNYZzRVekZJYkZWTk1BcDNiRmNyVEVaV1kyVmlN
      VVJ1ZDI1UmJqVlNTMjFTTHpaRFFVdGljRGhFYkRrMWNXbEdkSGwwTVRnNWJ6Qk5TRVpzTDJscFVu
      TlpjSEo1VVU1dVowTndDbFUzVDBKak1WQlRiVEJXWjFCemRHNHhiRGhJTVhaQ01sWnJRVk54SzNo
      R2VqbGlMM053Y0ZnNVExTTNTalpYV21VemRVRmlla3MzYzBWTGMyTkpWbUlLVEd0amVsSmFUMjV3
      ZGt4V1NUVlBMMUZEUXpKc05EbFVjMjQ0VkhwaE5tTkNkM2wyWW5OQlNrMVBaRTVEY2tkdWRYQnNh
      V1o2Ym1zcloxVXpWR3RvZUFweE5WWnJhblJ2Ym05WU5ETjRNWGN6U1hWQlQxUlJVRlJZTjFkWlJY
      RnZibGxYZDJKS0wxVnBaM1I0VFhSUlNXeFhWMnRPU0UwMlVubFVRWGxCZFRacUNuQnVVMGxZVWsx
      SlZIVnphVGxYYVhod1NUTTNlRlZRYWk5TGNuUjVRMU50U0c5bVJVZGxUMGN4ZFVWV09FbElORVV6
      TmtOQ05EQkpSV1JRVFhab01HWUtNREpZUTBWNGFWbGhOak55YnpVcmJGWlZWVlJOTWpJcldYUnpU
      azVYYVd4cWIzaFFWakZET1V4Rk0yZHJkekpvVVZSeWFXOXhRVzlDUTFCcFVXbDJaQXBRUjNGNWJq
      Z3hlbE5OU0RKWWNsVkhkSGRETXdvOVJGWjJSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure firewalld is installed
      package:
        name: firewalld
        state: present
      when: '"kernel" in ansible_facts.packages'


# Install nftables Package
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_package_nftables_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install nftables Package
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86376-1
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_nftables_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      QndjMUF2TTJodmVIZHBPVEpUT0RGelQybFZlak4zVG1ScmRuUUtNM2xwWXprMU9HVTBjWEpPVVVS
      RmJucG9Nek01Wm5rdmVtNW5MMm8zVURJeFZEQkxiRmxMV0ZVMlpYaE5la3ROVlZFM1lsZENja3BQ
      UjBaclJrTlBZd3BPYzJWc1F6TlphR1J3ZVUxUGRFNVlWVlpMZDFaTlNHUndRbUprVGtJNVlUWTJl
      VzUyYUdZME5qaHBNMmxtUlUxM2EyRm1TVzlJVnl0MFFqVk9ZbGd6Q25vd1VEUnNLM0pITlRWNVdT
      dHdiRXBsVDNCTlRHcDVXR3hzTm5CNGJraFRhalpMWkhaWWRsTjVVM1pXY1dsYVdETnZXR2xpUmpO
      U1NXTkxLMUJuVTFJS2MzTk1USEJvYW5aelJWTkVUMkZ1YlRGMmFUa3pNbE01ZEhwNEwzZEJjazlt
      ZWxkVVdHVnZWVVIyV1ZKeFNXTkVZUzlaWjFGM1ExbFhSbEVyWVVKNGJBcHRZWEpOVlVreVYxQkVU
      akZTVEdoSGIxWmtUMjgyTTFkWVdteDVlVWROWWtSb1RtMDNVekpFYTBwbFFsSXZZbWxJUVUxWU1W
      aHBMM2t6Y1hKNFRHc3hDbVphZEd4M2NtODRlV2R4ZUZkVVNsZFFjMGd5YkVreloyZEdTMkZqWWta
      eE1GQkpjRE5hWlZSSE55dGpPVmxzZDI1ek9XMUNOVlkzUmpkd1FsRXljbWNLU201dU5VOWhPV1oz
      V0haT01FVk1WbTl0YVVsSmNpOHhhMEpEWlVSUFVtbGpUblJRU25FMWVqQnNXa2RqZFZOTlIyNUtO
      R0k0V25CUlQxRXZlRWxtVGdwNlZuSjZWMVEzUVcxMk4yWmtPVm93WW1OUmJYUmxlbFpXU2xCbFRX
      cHZObnB5VG1Nd1dGbEdSVzB6UVU1UWNtUnlWalJMZFhFd1UwaFFPRkJ4VUc5TENrdE1RMVZIYkZR
      NWJ6QjJVWFJMWlVoblNsVnpaemhEUTA5MlUzRjVNREU0YUN0eWEwWk1UWHByV25NNU5FbEpTV1Vy
      VWxOVFZrUmtSVXd5TmpnMVRXZ0tZbXMxYTNoWlMzcGFWR1oyVHpSbkswMURZVlJ0TWtscGRHcFlW
      MEZpY0c5QlQxcDVkUzh6TTI1a01taExLMGx3Y0hwVldHZHVNSFJqZW14UlFraGlTZ3BSTkVWd1Yx
      VnlUR3RqUTI1RmNEaDRObTFqY3dvOU1tNXlLd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure nftables is installed
      package:
        name: nftables
        state: present
      when: ( "kernel" in ansible_facts.packages )


# Ensure rsyslog Default File Permissions Configured
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_rsyslog_filecreatemode,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Ensure rsyslog Default File Permissions Configured
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-88321-5
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_filecreatemode
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ZEdWVkF2VWpKcGFFc3JSbmxCYTJSWWFFUnJkRU5KWmtObWFGUUtVM0ZxUkdwdmVFVmlXRGhET0dn
      emNXMHhkelZhT1hCV01DdENSMWN3U2xRM1RGVlJTRmRKU1hsNWFtazJZelUySzJaeWFrOWFRVTVr
      WjFnclVXNXBad3BUUVVKRWQzQnNZVmMwYkc4MGIxZHZXbEZCVlZsV01FcGpNRU15THpGdmFIWkxi
      bkJCTlZjdlVYTk1iMjA1T0dsaU0yZEpOMk5wUzJ0QlFqSkZZVmRMQ25sb1VUWndjMlV6VURBeGRI
      Rk5iRE5IZFUxVlJYRnBPUzkzWVRKc1ZrSXlXR1ZxYmxOdFlqVjNWak42YlZWNWRqRmhRMDg0VGtG
      UFNFbFVVblJ5VVVFS1MydFFOV2t6TVhwS2F6VklTMnQwZVRWWFlYcDBkbkZvUTBOb1psUlRRa0pa
      UmxkdFVXdFRXbTR2ZG05b2VtRnhhSGxxTm1WWFlsTmlMMUZOY0d0UGVncEdiMmxxZFRKSmJVUlNS
      SEZESzBrNGRsZGFTWGhqVVZkek5HZ3ZObkF6TjBwTFEzWnJhazlxZGxjclNEaHFhVEJKYTBsWmVr
      SkNZa3hTY2t3MFNFeG1DalJhZURCQlNWZG9SRVZRYTNrMlVUQnlUMjVJY1dWbmJsSnliRmhHVHpk
      dlpWQkllbXhSYm1KU05UZGhhazlCU0ZKRU5td3hXRTU1UTBOakx5czVhM1VLWWtzMVJuSm1WRkZS
      TUVOVFFWQlNXVkIwVEU0MllsWkhNMkp6UmxKeGFVbHNObkUzVlcweE1GQkRhazVHVUdKRVEyWklT
      bEpGWW5wNVNGbGxVRlI0ZVFwV1NGSmhSM2MyYURWWmVrSkJaaXRTVnpocFN6STBNRlV5TkZWRksz
      cGtlaTgzSzJGV1dHWlJVSGRpYjBOSFZIUTVNbGgzUms5MWJWcFFhWGxtTld4TUNrZ3ZhRGgxZURs
      TFJIaDJTWGR5Vms4eFVXY3dTMlJWWkdsUk16RjZPV0ZJZGtoM1dsVmxZa05IZHpjNWVFd3ZaVlUy
      VFM5U1VreFZjWGx4WVRGRWRFSUthRGhxV2s1VGQwTkpkRzlCTWxsa1EwNVRielJXYzNwWEsyWlFN
      SEkyUzFsUksxQm5kM0YzVjJwSmMyOVVVVE0xWjFsaFZIQnlORFJ5ZDJWQlNtbENMd3AzWjFKdk5E
      UTVWVzU0Um1rMFVrZFZXbk0xTndvOWFVVXhad290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure rsyslog Default File Permissions Configured - Search for $FileCreateMode Parameter in rsyslog Main Config File
      ansible.builtin.find:
        paths: /etc
        pattern: rsyslog.conf
        contains: ^\s*\$FileCreateMode\s*\d+
      register: rsyslog_main_file_with_filecreatemode
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure rsyslog Default File Permissions Configured - Search for $FileCreateMode Parameter in rsyslog Include Files
      ansible.builtin.find:
        paths: /etc/rsyslog.d/
        pattern: '*.conf'
        contains: ^\s*\$FileCreateMode\s*\d+
      register: rsyslog_includes_with_filecreatemode
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure rsyslog Default File Permissions Configured - Assemble List of rsyslog Configuration Files with $FileCreateMode Parameter
      ansible.builtin.set_fact:
        rsyslog_filecreatemode_files: '{{ rsyslog_main_file_with_filecreatemode.files | map(attribute=''path'') | list + rsyslog_includes_with_filecreatemode.files | map(attribute=''path'') | list }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure rsyslog Default File Permissions Configured - Remove $FileCreateMode Parameter from Multiple Files to Avoid Conflicts
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        regexp: \$FileCreateMode.*
        state: absent
      register: result_rsyslog_filecreatemode_removed
      loop: '{{ rsyslog_filecreatemode_files }}'
      when:
        - '"kernel" in ansible_facts.packages'
        - rsyslog_filecreatemode_files | length > 1

    - name: Ensure rsyslog Default File Permissions Configured - Add $FileCreateMode Parameter and Expected Value
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.d/99-rsyslog_filecreatemode.conf
        line: $FileCreateMode 0640
        mode: 416
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - rsyslog_filecreatemode_files | length == 0 or result_rsyslog_filecreatemode_removed is not skipped

    - name: Ensure rsyslog Default File Permissions Configured - Ensure Correct Value of Existing $FileCreateMode Parameter
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        regexp: ^\$FileCreateMode
        line: $FileCreateMode 0640
      loop: '{{ rsyslog_filecreatemode_files }}'
      when:
        - '"kernel" in ansible_facts.packages'
        - rsyslog_filecreatemode_files | length == 1


# Disable Network File System (nfs)
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_service_nfs_disabled,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Disable Network File System (nfs)
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82762-6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WkZiMUF2TURGT015OVZWWFZPUldkeE1XdHFibFJhZHpVcmJISUtMMVF3T0VFMU5Ua3JSbE5CVVRs
      WlVERnJhbkZvYldVeWFHOUtjalJPZERFMFlYUnZTV3R1UWxweVN6TjJRVlpaSzJaMFlVRk1SWFJt
      S3pORVZDdGhVQXBzVEUxT1F6ZGFRMGM1T0hGbFFqZHVjV1JJTWxoTlJsWldTMVJEVmxoUlJHcFZZ
      emxKWW04dmFuWTVSM1kwTVZSU1kyb3plRGh5WnpaRE5qTXlUMWM0Q25kelRXbHRjbVkyTjJ4VWNY
      QnhXbXcwTldob1ExZ3dNRXBMVWswNVJ6aDZUM0prVUVVM1J6Vm9PVW94UTJsbVpHSkpWV2hCWkV4
      SFZ6WnNURVZDUm00S1F6YzRNRGMyVDBKamQyNU5VVWMyVVZKQlpIZHZRak5SUzJ3eE4yWXZTSEE0
      T0ZoU1ltVXpWbUpIVURSR2ExRjJjMk5yYldOdGNISnpObFJGSzA1dmRBb3hTbWcwVXpGNVpIRmxV
      bXRJYlhSQlZtOXNkbnBXVlU1ak9YTnpjRWNyWjA5MlZHRlVhakUzV1RWdlYwRjRWbVUyU0dWNE5s
      UTNXalpQZUM5eFkzWXJDa3NyUm5KWVVYQjVTVVY0ZUc1SVVtZHphV0o1ZFRBMlFrVkxkazVsVGtG
      eWJtdHFaRkpPTkROQlNIaDJSbEI2WnpneGJWbFphVkZNYW1WS1JGTkdheXNLY1hKemFFSk5XRXBV
      Vkd0bGQwWm5SREp3YkZoSVNEbDFjRFZLV0VGaVQycFlLemRtU0RWU05GcDVaM2xIYmpZck1qUkZL
      emhVTW5OTmFWbE9lV1UyTHdwUlVYVktWa0poY1ZjdlFVWmpTbFZ2TWxWc2JXSnlhRmR3T1U5eVpE
      SjFkak56ZWxJemNYUjFSV1l5UW5sb01Vb3pXRGwxUmxCQmRreERZVzEwVlV0UUNpczNaSEZMYUdr
      MVRESkVVMjl4Um5sRGVGaFNkSE5aZEZCc1p5ODRiMFl5YXl0QmFESjRiVnByWWxFMmNXWjJkR1pH
      Y1U0MWJtTTRhVmR6Y0dKeVkyd0tjVU5pZW1ObGNtaDFTblJ0Y21sd1EzZFZNSFl2VmxsNVNFTjJV
      M1V4TVZoc2NsQm9TM0JMZUhOR2NsbFZhM1Z0V0Zad2MxZHhMM1pKWTFOeFZucDJRZ29yYm5wTFJW
      ZDJlV3BZYWl0Q2QxTXZOVXhhYUFvOVExWldRUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable Network File System (nfs) - Collect systemd Services Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable Network File System (nfs) - Ensure nfs-server.service is Masked
      ansible.builtin.systemd:
        name: nfs-server.service
        state: stopped
        enabled: false
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - service_exists.stdout_lines is search("nfs-server.service", multiline=True)

    - name: Unit Socket Exists - nfs-server.socket
      ansible.builtin.command: systemctl -q list-unit-files nfs-server.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable Network File System (nfs) - Disable Socket nfs-server
      ansible.builtin.systemd:
        name: nfs-server.socket
        enabled: false
        state: stopped
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - socket_file_exists.stdout_lines is search("nfs-server.socket", multiline=True)


# Disable rpcbind Service
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_service_rpcbind_disabled,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Disable rpcbind Service
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82858-2
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.4
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - service_rpcbind_disabled
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WllVVkF2TXk5emFuaEtXbmRNWW5RelZFbHRabTlqVW5OSVFqZ0tiekU1Y0V0aE5WWlZNM0ZvVEVG
      RWFucGhaQzlYVEhwUlpWY3dXWE1yZG1Gc1dsbHlTM2R3U25kVE5WSnRla3RHU1ZKVWFVRmhaMFJs
      ZDFweE1Ya3Jjd3BZYWxWa2FXdGxjMGg2WlZsMVVYRlNVMDVDVTFsVGJrMXZaREk1UlM5alVsSjBM
      M2h1VEdSVVQwSkNZMVoxZGpWblRWQlpja1pNWVROS09GQkJRVGxHQ25KMksydzFZVXBSVUU5cU9F
      VlRZVk5SVFZKRlZuSlJSREZ6VjFkaFFuTjRMM1JTYVc5QlNYWlhSbVZUY2t0U2EwZFpTRTFuWkZk
      U2RrdFpWVTFuVFc4S1RrSXlUSEp6ZGpORVFWVXJSalJySzFBd2IwVnhhbFJzVVVOM2NGVkxVM0pU
      T0V4UVpFdFJNMFpTU1RreFIzVlVVbkIyWW1GdVZGQTRNbmRHV2xONWVRcElSVU5ZVjJ4bU5HazVj
      Mk5RV0VsUWNFMVlORmRGVW5GTVZqVjBRM1pDUnpkd04xZHJaakE0ZHpKUmVVUkhWV1ExUjNCTWRT
      ODRiMHRSZFRSR01raHpDa3hWUkZGa1MwaHpOR2xMUlZZdldHNXZRM001Y2pVd2QzQklWMUZPUldj
      eUsyWm5SaTgzVjJnemMzZDFXR3BCYVdkTVptZFNjVEo2YzA5WmVFRk1RbXdLVEd0UVR6UXZWa056
      TVVkM1RtZFVUVVIyS3l0UmQxQlljMnhYYmtaT1QzVXhkbEpDUzBkSU1XMWhZVlV5ZEU5bFFXaG5h
      VEZJY1hScGJHVXZUVWs1Y0FvNGFWVmlkemhxVjNaT2QwNUdNVFZYTlU1bVdGTnpLelYxVFdwNVpV
      NVllRkpXUnpKWmNFdFVNa2RCY3paVVMzUTBiRzFUY3pabkwxVjBhVXBsUTA4MUNtUjJia0ZHT0RG
      aFVITmlObXd3VVRab1ZHMXFNR1pzWmtaaVpXaHJiM0pNWlZwNGVsbzFiVGxPWTFGQkx6VnBTWFpL
      YWtWTFJFazRURUUyU2pWRWJ6UUtiM2NyTVZGS2VFbHROeXRKTTJ0bE5uRjFOM0lyUnpCSlluWlNN
      RU4yZGpFMVJYVkdjMnN5V1hocVFYRXhVRmxwVjFGelRuSXpWalY2UWtZMlYydEVOd3BSUkdoNUsx
      UmpjWHBHTldoUldXeGFiazUxU1FvOWJGSnhXUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable rpcbind Service - Collect systemd Services Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable rpcbind Service - Ensure rpcbind.service is Masked
      ansible.builtin.systemd:
        name: rpcbind.service
        state: stopped
        enabled: false
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - service_exists.stdout_lines is search("rpcbind.service", multiline=True)

    - name: Unit Socket Exists - rpcbind.socket
      ansible.builtin.command: systemctl -q list-unit-files rpcbind.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable rpcbind Service - Disable Socket rpcbind
      ansible.builtin.systemd:
        name: rpcbind.socket
        enabled: false
        state: stopped
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - socket_file_exists.stdout_lines is search("rpcbind.socket", multiline=True)


# Disable SSH Access via Empty Passwords
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Access via Empty Passwords
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80896-4
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-020330
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      ZEJWVkF2YVZkTFZXRlhiR2MzTVhCdFlXZ3ZkbGhrZFdsM2JHa0tTMVJ3UVZkUGRGZG9Tbk01ZEVO
      QlQzYzBaa3R2U0c1VWRUVjVka0pYYURsdVZGZFlNRzFLU3psdE1FNWhaMmxRU2s1MVp6ZG1SR2h5
      ZFdwRWFubDJWZ3BTT1VGek5YbzFOalZwWTA4cmNYTmtja2RWTTFsVk9FazBja05GZEVZeGNFUkJS
      M2d4TWtwTlIxUnFkblJxT1RsU2F5dFphRmx1TWxkdFVVaFNNRWt4Q2psMU5HRXdZakYyTDJwNlVt
      OWFOMUZVVkdWWGF6WjRVMWs0VmpGaVJHdzNieXRLUVhVM2JUQTNXWE14VUN0TFJURnphRGgxT0ZK
      R2NFdFpZa2R0TlZnS1J5dGlhakJNWkZZd2JWSklhM0J6ZDBkTldIRkZNRzFRWm5GbFZpOTVkRXB1
      TVdOck9VRXlORWxrYVhVNWEzUktPSFZpUmpST09XVkxVemw0WTNGMlVncGtjVVF3VFRrM1pGa3Zh
      a3M1TDJ0SUsyRm5TekpMZW5Sb1JsRlNaRWRzTjJkQlFUSnBTbnB1WTBnd1NXTXpUbWhDUkRGcVNY
      aEhMMVZYV2tkT1FUSXZDbHB3Vm1GcmFtRnhOM0pCY2xsV1YxSnVNakF5VkdKbVpsZ3dja04zVTI0
      M1lrNVFUa2RVV0V4bmFsQlNUVFZDTUdsaE5sbG5ibE5PWVVNNE4wOVRSbEVLVTJGNFZqTmpVMnhW
      V0VkTFoydGtjV1pFVm1WMGVra3hRMm8zYkZNME0zRjZURmRzTmpoaFFtYzBiamt5WkZCdmFrazJk
      M1Y0Um0xQlNpczBOM0l2VmdvMlJ6VlFNM00wYkV0WmVFaDNZVk12ZWxWQmFURTRVVVZPU1RkUFVu
      RjViV2hhWTB0NU9YcERLMGRyZEc1bmFDOW1iVTF3WmpGU1NtVTRUV3BtYXpkbkNsQkhOR1JRUlha
      dWQyaHNMM28yYlVaWFlWcHhOMU4xVDFaUmVFczVNRzFEUWtObWRIZHRNMWQ2TTJSTVYzWklTbEJo
      SzJjMlJtaHVlRXRtY0VwSFUwMEtiRVZPUlVoU1pEUkVVRmhUVTNsc2JuUnpWMWRXWkdocVZIVk9T
      SHBQVnpGb2RtRmhSRlpOV1hsT2IzZEhPVE5qUlVKdFIzbDVVMlZJVW5FM2FVRXhWUXBzTldaRVNF
      aG1hWEF3VEdZd1UybEtNREpZU1FvOU1WRXpZZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Access via Empty Passwords
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
            line: PermitEmptyPasswords no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Disable SSH Support for .rhosts Files
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_rhosts,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Support for .rhosts Files
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80899-8
    - CJIS-5.5.6
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      RnRORkF2TWtoNlVtWk1TVzFsWm1OSWRqVjJja2d4U1hkRWVFb0tOV281VjJjdmFreFBhV3RKVDBS
      TlFuTkZXbXhyU1ZKSVYxQTVPSGxIZUVOUVYyVkxWSFJvU1Rsc2FYRnFhRFpzWWsxMU9IQnVlVFZa
      VTI5V1dHeG5lZ3BCWVVoSVJYVm1hVWQ2TTB4UE1VUlFURGxaU25GSVQxSkdaa05rUm5veGIxZ3JT
      bVZMYnpjNU9YbE9TMHBNTTBSblNsUkhUelJrVFV4MmMyUm9kM3A1Q25GR1EyeFdVbUpQU0ZoU01Y
      a3hhVll2Wld4MmVWZzRNV2huV0dWRFJWUkVkbGRVVGxoNlYwMVZkbWxHVm5aTVlrRmtRM0ptZGt4
      bWRFVjRORXhISzBNS1lTdG1NRnAxYTNCV1oyTkdhRTl6WTNSNFVFUjBTRVJFYjBnd00wWk9helJr
      UjFad05Ea3paRzFYTWpaUWFtaFBWQ3N2YlRNMWNVVnViVTB3VG1SRFdncHlOVWxxVkRSd1oxQTRS
      M3BoV25CVllsRTJXbFJoYVdSTWMzaENia0UyT0hCaEx6bDZVMEZWVFhkeFMxWnlRVFl4YkdOMGVu
      SllaMmt4VTBaSlRFOUdDbkZFVlV4elRtYzBkMWszT1RsREwzWnFjWHAwVFcxWGFtOU5Ua2xSYUV0
      RVFsVjJha3hEY0VkcGJFcHRkM2c1SzBWWEswMVhjMDlHTkdWUE9HVkdSR0lLVWxWUlNHNHZVa3BU
      YVhGMFJuZzFRVWx6TTFWQmFUUmthRTh3TDJGSmNsbG9WemhYZUdaaVJEbGtUM2xIVWxjd2FsQlZh
      MUF2V0U1V1Iyc3hkU3RNY3dwTGVHaDZOVmd6Y0U1c1NWbFdOa1ZoY0RVNVZrUkJabmh4U2pacmVI
      UkplVXN2VTNkUFlqQlVZMDFoTW01TmVIVmlUVlpEYzNSM2FUbHZhM1ZQUjNOakNsazVWazVsYXpo
      WVFUSkViRXhyWmpWUWJreG1aR3R6ZWxOdWQweHJOVFpLUlZoU01YaElPVzVUUTA1YVNIRmtTRmxE
      TldWS01rbzJWVkZOT1NzeVNIa0tSRXMxTm5seFJXZzJiVmRxV0dsVU0wdE1ZbHBZTkVwSldUVlFW
      blIxT0ZwTk9HdzFjRTQzVjA1QmJqZDVWa2R4YXpORmJVZ3hiR1J4ZG1Oc1VqRkhXZ3BTZWxveFR6
      SXdLM0Y2TW1ZNUswMUxTV3R6Y3dvOWIyRlROZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Support for .rhosts Files
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*IgnoreRhosts\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*IgnoreRhosts\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*IgnoreRhosts\s+
            line: IgnoreRhosts yes
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Disable SSH Root Login
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_root_login,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Root Login
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80901-2
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010550
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bEVVVkF2VW1Rd1VFUlZWVVZ5WjBWaVFrVnVhVTlTTTFVd1Yxb0tLMUJGZUd0dmVqVkNLMGxQZWpC
      NGRsVnNXVVZGTXpKVE5teFNPV1phUWxOdWFXaHdNME4zVlU5U2IwTmpWRzg0WlhVNUswSTVTUzl6
      VTJSaWJHOUxMd3BWZEdKc1JGSmpaVlZGVlhOTWFHMVFjRll3Ymt0UlRWSmplbTkxZVVoT2RXbFRW
      emhZVm5rNVkxWTVRMlJPUTBOSVNUaFdUMDltVW5SWkszVmxXa2RoQ21kc01XMURaMFZXU0dsT2J6
      Sm1ZMEZRWm1KSVNXb3JSazEzZDJadWMwTnZOMGhOWm5aSVYwWnpVVWh1TkRKbFFtcHpibk5UTjBS
      c2NsaGFNa0UzZVhrS1UwUXZaeTgxY21veE5rRTNWRE5aWmtzeE5rUjViRE42WjFod2VVZG9Lek5a
      YlVsVWNWWmtkMDB2V0VWUFdqZzNSamN2UVRndlVtSkplbXM1Um5OeVpRcEdTM1pPV0c1TlVYWlFZ
      Uzk1WVRsMVYyeHRaelpYV1RsM2EwSTFUR1J5VWtsclUwTjFZVFJhZVVGVE1tbDNZVXBxVEVwV05W
      UnpPRFJ0WW5kVWNHMVFDazlrTVc5MldrNUZZMGRpVFVsUU1HZFhiRVF3YzNkVVQyeE5NbXAzVEVW
      b2F6UTRjMm93VUZBNE5UUldUV0Z3WW1SbE5sZzBibGN6V0ROaWRGRXpUR1lLWTNrNE1IQkZkVlkx
      T0VOd1JrcG5UWGxKTjFKaVJVTm1RbUU1WlVodFdsaEVkWGwxYzFKRk5ubFBTekphUkdZeE5XRkNj
      VUpOUzFKdVRFWktkVUphWndwRFIxRk5ZbWQ0ZERrdmJtNDFTVUZ1UjI4NE0wOUZZazFLYWxCMk1I
      QnNjRFJuTm0xSWRXNDVSalptUm1jek5rMVVaMFZqTjJsak1ETmlORnBQU21SbUNuZEtSRzVCYlZV
      NVlXTXpiall6V0RoblpsTklXbmN3V25kcWVFUm1SM2xJTld0d1JURlRaWGhWWmxSU2VFNTNZMGxN
      T0VrMGVGTXpaa04wUTBVMlNEZ0tiMnN5TjFCa2FFcERiRTVOWXpWSWNuZFhSak51WkVKa1lrTlpj
      R0kxVDBOd1VHRk1XamhsUVhJclZIZENaMFkzU1dJM1ptWnFNbXRNZW5WMFVsQjZkd3B2UlhwTFdV
      VTJTV0pwWjFZMmJIQnNXVWRqTkFvOVpFOUtSUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Root Login
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitRootLogin\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitRootLogin\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitRootLogin\s+
            line: PermitRootLogin no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Do Not Allow SSH Environment Options
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Do Not Allow SSH Environment Options
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80903-8
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010830
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WlBaMUF2TTB0Q2R6TjRjVkJJWldzMmRHRmhWM0pOVFZaNFpub0tOa2xuWldWUVVFeFBjVXBIVnpK
      Q1NsSkpWblJuV2xaMmN6bGxUVGxNT0hWamFrcFFkMXBwVEVaNWVtZDFMMmxOUmpaeVJrRjZXVTR3
      WlRGRVlVVjFUQXB5WjJWSEwzVjVWRFpCU1hFMFJURklabEJ2T0RjdlpVSnJTVlE1VjNaNmEwcFNT
      R1JaV0c1dlJVTllVMWt5YUd0WmRsUlhOVTB6UjA0MVRtRldRMlZoQ21Kc2ExWjZiRU4yWVRCNU0w
      eFRSblI0VlhBNVEycEZURWRNTjFSblkwaFBVV2M1UTBGaVpVZ3dkMk5IUkhBNFIzTkxjbkpzZVVS
      dFUwRnZURmRoT1hBS1dXWXZRVk00UlZCRE1WQlFOalpMU2tJeWRGRk9PSFJ4ZFdKVVR6YzNRbVZC
      VVdWdWRreHdRM015WmtoNmJYbGxUMmx3Y21Sakt6UlZha1UyUVdOM2F3cEdOV0Z1VUdOQldsTmhN
      amxKWjA1NE9GbHhSVk5XYzNFM05HeEpZMlZYTVVOclN6aDBNM0V5ZFhFd2FXVmxhMk5MY1RGMWQy
      bHpUa0ZaTUVrMlFsVm1DbXN5YWxGUGFtdDVOWFZhVmtwR1VVc3JiblIxT1hsblZuWXhZbVE0T0ZO
      eVJGaGlaMDlXV1VNMlRIVnpZblExUkRad1ZYaE1iMDk0YlhreVZWcEVOMDBLV0V0b1dqbE5PRFoz
      WlhSaVNUbEdkakpGYmxWeFZXOXdaVEF6VGs4MWVuSXllSEU1Vm1Gak1ERkdhRk5TSzJadVdrOTZW
      bGROZWxKNWNWUm9WbEJrTHdveVJHOTBaM1E1YUhCbWNGZE9PR2xoYUZWMFNVTm5NRTV0VUUxdk5X
      NXNjVVo2VVhsdFF6TlJLMWxhY21JMVdtSjVNRmx0ZFM5aGNHbGxTRVVyZWs5WENqRklaMUV2TkRW
      c1NraExRa0k1TWtwSGRYaGFOemxuYTFScmRFYzVPVk5MVm10dWVYSklTVnBZVjFkRmFUVlhhMGRu
      VlVZelpIWm5XR3hWTlRCSWEyb0tkbnBNUkdOMlkxQnhaa1pwYlhKTVpHODFkREEwWjNVNFltcExU
      Mk5ZUTNGelZrWjBSbE42U0VKeWMxbHlkVW9yV2sxSmRGRkZVMlZRVTBsVU9YTlFTd3BIY1U1M04w
      VTVjRlpLZW14eGVHUnFabTFhYWdvOWFVMXJSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Do Not Allow SSH Environment Options
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
            line: PermitUserEnvironment no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Enable SSH Warning Banner
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Enable SSH Warning Banner
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-87978-3
    - CJIS-5.5.6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner_net
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      dFdTVkZCU1VKRk16TnRTeTlITmxGa2JqRlNSRlE1UzNCdWVqWUtaRTVvVXpONmFHd3dOV015WjJS
      Qk4zVlpSSGxCV1VkR016TjNUMUZqZUZFMU9YVndTMGN3U21sMWQzaDJaM2d4UjA1bVpHVTJjbE5E
      WW5VMWFUVjNlUXBUWlZseEsyeERkSE5vUVRsWk9GQlNZMWhoVkRCeFUydDBaV0V6ZGxFMVdEQk9N
      MVUxT1d0aE15dFNUa2xQTlVGWkwxcERXV1ZGV0c5eFRVaFplVTlPQ2pkTkswUXpOSEZXV0RoM2VV
      UkNiVXBRYW5kdmVtRnNkRzVWYWl0QmJrRkpkbFZyYm5Rd1pYQm1iRVJRTVVSNFpVWmxObWRwUlRa
      SWQweG5iRGhEUjJjS2RHWjRWaXRRTVVWRlEzaEZUMWxNVkc1VlEzbzJValI2TVhaVWNraG5TVkp1
      UzBWM1p6VmtOWHBTVUM5SVpFa3JNVVJQWVdoelR6ZzVOMmRDU1dKaVZRcHlVMVUwUkdONFYxWXJO
      VkEyT1ZwMmFGWnVlbloyUkVab1pFaExXV041ZGxKSlYzWnhaVkkwTWtKclRrNUVhazFZYXpobmNX
      Y3lRVmhEVWxsU1lUVndDazF0UkZwQ2NDOWxhSGhpUmxSNE5YaE9aRVJYWlZaWVdWTktaM0JLV2k5
      bGFITm1jMnAwY1V4dVdVUmtkSFJMY25Gc1NtUk5jRVIwVG1acGJGbERVRFVLTVVKcFFrdzNjbWMw
      Ykhvd1VrVnlSRFJOYW05UmQzQmlVR2N5WVVsSVptWnRObXhyY0dKeVVFbHRaakZVVldST2NFZERN
      SFJZUzA5V1owMDVha1ozV2dwUFYybGxOM05PVDI1blpFdE5jbVpSVW1WbmVFbHRhVkJTYTJSa1Zq
      TXdVRzFrTUdsVWFsWlpaVEJMTjFZNVNtVm1NeXRhTkdRdk0zRkNhVXBNV1Voa0NtRnNiRlpqV1d0
      VFptWmpiWHBzUVc1blprSmplRUp6WVRScVYwaFlZVkI0T1dwbU9YTXZkM2xRTlhsSVowTmxWM2xz
      ZGsxSFRuQlRSMjUwZEVObFNsTUtUWGhRTmxkTFQzZFhNbmhTWVZOdWRXOTVPVnBoZFZCeFZtOXRS
      MkZPT1RaUmRXeHRaVVZaYmpreE5qVlFkMGhFUjJNdmVuQkVha2xVTDNGUEswTlZPQXBKVUVKWVdr
      SldjelF5U1ZFME5sVlpUbGxMYlFvOVVWUjNUUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable SSH Warning Banner
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Banner\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Banner\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Banner\s+
            line: Banner /etc/issue.net
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Idle Timeout Interval
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Client Alive Interval
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sshd_idle_timeout_value: '300'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      aFhNRkZCU25ocFIzRjRUVThyWVV4eVVqTlZhMjVaVTIxb1l6QUtLMjlGVFUxT1VUWm5ka04yV1U5
      aWVEWlNOR1ZCYldSbFoyOUtTVkZWUzNJeVFWRjBTVFV4UjA5TWJYZENVSEUwUkdkVmFuVlBUVmcz
      WjBaU09HeDFSQXBXY0hWTFV6SnhRM0l2ZEVkUFNFRkpRMHR0YVdkb01IazBhMWxHYW1oS1MxZ3Zj
      WFpKTW1ZclUweFZaMWczVkdoVVVqQmxNWG9yVjFwcVVUZEpTVWhSQ2tWT1ZsSm5VM0poVEd4WVNt
      WXJaaXRwVUc5NWRuUjRhRXN2Vm01UWVXMVpaams0Y0d4eEwyTXdNalJoSzIxQ1JESTNSRkJpTkda
      dU0zSjJjbmcwYlhrS1JqRk1kSFZqYzJobGFXRlZZVkV6Unpkc2VFVk9Sa3hNT0hsblNVcFRNMHRM
      WW5OSlRFdFVXbXNyWTNSRVVYWkxVRXR1TURodGRrcDFSSFJ4WjNGb1JRcHlZVEZGVERWVE4zWjFl
      WEpYYTBjeFJWRk5TbmxKVWlzd2JEZEJiMjAxVTJONFZXbFBiemRZZFRscGRYbGlRVTV2ZG05NlNV
      RXpZa2xZUXpFMFpVWTVDakZMWm5SVGNHdGtOM2hIZUd4NWRqaHhlWGR5WW5kQ2EwUnljMWhRUTFS
      c1psUXhiREJDWVVFdmNsQTNSazF6VkM5Nk4wRXJMeTlqVERObE1UTnZRemtLUm5NMFlsRlhlbTkw
      ZUZSREwzcG5TelZXVURZNVFreE9SbHBWWm1wTlZuRjNPR2t3WjFkeWQxRTJRa1ozYnpCWGVVMVlX
      VTh4UkhwdWVtOXNXV0pOT1Fwc1FVVnlZa0ZIUlRKck9YYzFiVWRYVDBSVk9XMXJlSFp2YWtwNGVt
      WlZTVkZVY2pkbFFuWmFjV04wUlZSS1MyeDRkVk5STlU1UmVVdDNRbHAzYmtOU0NuTklVbXBJT0Rs
      VFVsRkRNbFJNWVRNNUwwOVBXVTVxVVhkQ1Z6STNUMUIyTkU1M1ExTTNZWGRKWVhSMU5GRkZUbXRN
      T0VkNll6Tm1OWEZRZDFrd01Ya0tiVko2WmxwUE5UUkdkbkZxTVRkb1JESjRiME5hYUVkbWJHOWtT
      MFJVTkVneE0wcHdVRk5hV1ZwNmJEQktXbXBtYURoVU5VMHhReTk2VmtJMlpraHNZZ3BvU25wdU16
      bHZkbHBOVTFoMllrZFlLMUZFVndvOVJHbEpNUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80906-1
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010201
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Client Alive Interval
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveInterval\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveInterval\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveInterval\s+
            line: ClientAliveInterval {{ sshd_idle_timeout_value }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Client Alive Count Max to zero
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_keepalive,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Client Alive Count Max
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_keepalive: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      ODNNRkF2TTFWeU9XNU5kbmRtYTA5WWVXeFRlV2ROVlUwM2JqY0tVM3AySzNsRFN6bExPRGhoTkVS
      NmJFd3JjMXBRVUc5U2NYZ3dUelExWkZoVVpHRmlNVzB4VkhVNU5tczFkWGhTV2xKcWRIWldVM295
      WWpjMU9WQnBSQXB6YjBwQmRXSnJLMmx1VTBvdk1WSnNla2RZU0UxWlRXTklTa2t4THpCV2JsbGlW
      bGh6Y2tOTFNGUXhUVlJhSzNjNFVIYzFTV3hqZEhkVk9HTk5SR1ZaQ21WclZrczRkVU5rTkZac01Y
      TnRXbnBaWmxKUlduTTVZell5ZUdFdldTczJaM0Y2WWtjcksyZGpUVkpGWlhseVYyMVNWazlvWlhw
      VWJXUkhXWGhpTkVZS2VVUXhZM0ozVUdaMU5uVmtjbTV2V1haeWNXUlJWM0o1VlN0dGIxRjZObTAx
      T0hwbWJFTkJTRWR2U2t0MVZ6UnBVVmh2UzFkd1EyTXZTMWhCUTJsNE5RbzRTRTUzZURneFNHMDBk
      MDQ0Vmxjd00zQkROMVZUU21jMmJVSXhVRFpsT0VoeU9GbG1UaXRJV1ZWM1NGUlhlVTAxY1dselVG
      TmpWakZyYVVNNE1VaGxDbFl6YVVkblVUZHlUVmhqTWtacVRtcEdRV2RRTldVd1FUQktSRFJuZEhk
      cVlpOUxVVUozTlN0allVRnlOV0p5U2tOa1dGSkVPR2hNZWl0WFRuUmpTRThLZWpaUk15OXJNa2xx
      U1VjMVFuSXlWWFZ1TlUxV2EwRnlWbUp6UzFjd0wzTm5UVkZXVTAxV2VYUkVlbk4xTDBKQk0xUkVN
      bGROVVdOR2RrNDNkVXN6V0FwelFrdE5Rek15TDBKRlMybHBORTA0YlZkbE0wTlVkR2d5ZWxNemFr
      VlRkamxqZUhwcWFHcDRWemR2VTJKdlQyUXdWbmhIT0UxQ1JGaFJTREoxTm5Cd0NsUkhTelpvV0ds
      RlRURk5NVzFVZVdsS0swWm1ZelpSVlZKUU9UTk1iVzVFVkZnelNuQnhlVk5ZYW1WTGNtRXpLekJY
      UlRaQ1RucEtlVVJ3YWxWSVUyUUtiMGR0VkZodlYyWmphMWcxVkdodVN5dEtNbXhMTVhNMmEwRTVS
      VnBvV1V3MldETXhhWE12TUN0M2NWcDFOVVVyZGs4NFRXMUdiV0l6TW01WGJXeDZTUXB5U1hac0wy
      WXJiMjE1VVN0S00wcFhVelJsYmdvOVdGWnhNZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80907-9
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010200
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Client Alive Count Max
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
            line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure SSH LoginGraceTime is configured
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure SSH LoginGraceTime is configured
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_login_grace_time: '60'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      eFNVVkF2TWtvME5XdHZXRkpqUlRkVVVUVkZabk5VUzJsMWNUQUtVVTFtV0VWTmVGRkdWMmhyVUZo
      VFEzUk1UVlZHVFhJMFZreHNPVVpXWm1KQlNFZ3hRVlYxS3pCTE1WWnNhVGt4V0VkUGREbGxLM2t5
      UW5NMGNEUkdZZ3BsWkdkeFQxRlFiRGRoZEVSRlRuazRSWEpzU0hCclEyeE5VR0pKVmxKdFQyeGla
      MUV3TWpVNVVHaHpZemhCYzBGNmFUSXJOVkIxT0Uxck5YQTRWM2xhQ2tJdk0zVkxaV2x2TDIxT1Nt
      OXFla1J2Y1c5NlUyVlhOMWQ0VmtWdGRrVmljVU5DT1dKQmJqSlZXRTlWVG1SbmJXNHZhbEZNZW1G
      bFZuazBjMlZaTnpJS1FXeFVVSE5NTkhCcWQySmxSMk15VDBkdVMzVTFiRnBUV1d4c01IZExiMkpT
      YUVVMWQxbDFiRmszVDFWUk5IVXlXRGxhZG0xTlRrOXVhRVo2WTFCVFVRbzVjbWd5VTFoelIzWmth
      bGhLYlRaWVowZFpaSEo0VlVkcE0yOXdPUzh6T0hSWVpHMU1jR0ZhUTFVMkswOTNValFyWmxac1Rt
      azFjSE0xY1ZoV2FqZ3JDaTlIY0hSR1pITk5ObFFyTUdKRGJWZG5MMDgwVkdsbVIxSktaVzF3VEVs
      VFZXUlZaMDUzWkZrM01IaEpXbTl0UkU5UGR6ZDRNM2xZYVdGbFIwcEpZMDBLY21sSFZHaGhlVWw0
      TW5aTWNFbHhUakpsVkV4WVYwWjFUalJaYmt4RldFaElLMWxGZVRsak1UTmtSbFpJWjBaVVQyMXBX
      RmR0Y0hGdlJISlhZVUZVYmdvMU5HaHViRlUzVDI0MlVVZzVOalpRUVV4M1REbHBjMFZ4UzJrdlZr
      bE9UR2RDVEUxR01IQkVlbk5sWjNkWE5XdDFlWFY1TkdOUGRrTlhUMjFaUm1SSUNsSjVPRmcwZWta
      RFlUQjFRWG9yUzFCNFpWRnFjRGR1YmpKTmRHb3JkRUY0YmpCUGRtNHhXRFpUY1ROelFsZ3djRGhE
      VGpGTmNIRmpaSGt2UkVSR2MxTUtWbEJaVFVRcmFGcExMMll2WVV0bVFVaDJkVFZ3YjB0RU1YZDFi
      RkpqYjNwWU1GVmliRWxNTm5ST2FYZDVha2RzUm1SNWVEUllPRkZyTmxoSVoweFVjZ3BSTHl0MVVD
      dDBhRU51YTNKU1RXUXpTbTlQVHdvOVRUQnZRd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86551-9
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_login_grace_time
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure SSH LoginGraceTime is configured
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LoginGraceTime\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LoginGraceTime\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LoginGraceTime\s+
            line: LoginGraceTime {{ var_sshd_set_login_grace_time }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Daemon LogLevel to VERBOSE
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Daemon LogLevel to VERBOSE
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82420-1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_verbose
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      Sm9ORkZCU2poUWEyUk9PSGRMU0V3NU4yMUlibWhHZW1GV2QyRUtlbG80VFhFM1MzWXpiV1J1U0RG
      T1pFTnJhMlIxUWtaQlRVUkhjbkJVZGxGSFMwbFdSR0ZuZVZkb01rRTFZV1JaVGt4R2VEVjFjbVJX
      V201b1JVWkhOZ3BGZUVzeloxVktVVXRCYWpsb2R6ZDBXV1ZXYkdSelF6QnNhakF6ZVV4WFpFMVZh
      RzU1TjI5SVdEWXdMMVpKVWpoUmRHcFdaVzVWT0UxMVRGRkVaRTFZQ2xOR1ZGcHBNalJEWmtWMmFE
      VTBiSEZ6UzNGWFpISXlLek40ZHpOWmVVNUVUVVpwUVRWeGR6aE5TbGRQVFZKalpUVllNR3BqYldW
      SFZVTnBSV05ZVnpVS2VEQTVORnBHVGxGcmFqWnNhV05KTmpVMk9GbEdaV0U0Y0RWWWMySmxjSFJX
      YkhKVFZtbG1WQzlXWVM4eVltSTFhVTV0UjJGWVlrNURUMUZIVmtKM1FncENSV0ZxVmtKdWNVOUZi
      MGxoVFU5SVVsZHdTazVtTlVKMmNWUjJjbkpyVEdaaGN6Z3JaR1ZVTkUxdkszWlphVlpXWmk5MllW
      Wm5jSFY2TjJKcEszSk5DbTVFUTA0dmRWSjRPRXRwZDFsbVpYVnlWR3h5VEVOWFdXRkJVRzFxUldV
      eVNsWXpjREZpSzAxUWJTdEplVmN4TVdkUGFVbHFVbUphUTNkVVprZzJkV2dLUm1Wc1FrbzVhRVJG
      VUV4aFNFNDBORlJvUVZkUVpYSmhVRkJNWTNSWWVtcDZRekpITlZsVFRXcDVZMEZKTjB0b1VraFlU
      WEp3Wm5SNGJ6Qk5WVzlzZHdwM2VFWlZLMUJYUVVkM01uWnFMMlZUZFZCcVFrdEhRVkJXZUc4NU1X
      SjVVMEZzUkU5QkszVTBlbkpKU1ZSVVFVeDRhV1Z0WXpGaU1URnhjQzgxZEdwVENubGFWMDUyYW1Z
      NWQyNTNhR1pHU205bFQxUmxaR2xOUTBkUGVVaFVkWFp0UjIxTVVHWnFOamRVVkd4b2RVVkZOVXhM
      WkVONVZrcEdXSFJRVDBVelEyMEtjSEp2UXk5elZFbHJTWGh6VkVwQlFXNXdTVTFYY0ZGTmNtVkZV
      bU5vZEVRNVlXWm1Ra0pPTVV4b1puRkhZa3huV1VOeE0zSlVlbWxCZVRKcVNEaHVhZ29yWTBwNGR6
      Z3dNVXhJWTI5WmVXTjFWM0pFZWdvOWRGUjJMd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Daemon LogLevel to VERBOSE
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LogLevel\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LogLevel\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*LogLevel\s+
            line: LogLevel VERBOSE
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH authentication attempt limit
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH authentication attempt limit
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sshd_max_auth_tries_value: '4'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      TlRiMUF2YVdkWVdFOW5TMkZuV2psdFJWbHFWWEZDTlROdVZTc0tTR05GT0UxeU5IcGxabmN5VVhO
      TVF6UlNWMk56WVZCSU5EQmFOMlEyUW5nd1NGb3JNMDB4VERkTE4wdHBXVmxZTHpadVFXdENhM3BX
      V0hKa1l5dFlRUXBCZURNNE5HaHBRa3hrTVRrNFdtRkJiSEprT0RNM1UwZE5aelI1TlVsWk5ETkhN
      RmMwYVdOcmQySnNVMmRUV0ZKSlVERnNiWFV4YkZNNFFXeFpZak5hQ2paVlUzQmxZelE0U0RGc1Jq
      SkpZbFpqU21aR2VFdHROR05LZW1aMlptZEVlR1U1UzNWdWVFVkdSbmxxWlVaSmNsTnBLeTh4WTJv
      cllXbHlTbFpPUjFjS1EyMHJNbFl6TW1SRmVFdDFlSFkyTDBGcE1tODVZazlUYmxOWFMyeGxTeTg0
      WW1aU1NFRlRZMVpuWldKUWN6aGxjSE41YXpOcU5HRnVZbmgwT0dGYWJBcFNlSEF4VkdOVldWaHFk
      MHhrVW0wNWFFRnpUMGN2U1Rsc2FVWXdSVW95UVdveU9HTllZbU4zZUhWaGEwaEVSRU00UjFCb2NV
      dHhjR2RzVUZoeGFWcFJDbm92WjJseU1FcEZPV0o2YTFwaGIxUkxlQzlRUW1adVlrcEhPV2RpVlRG
      dGNUaEJjelZ1T1Rnd09HWlpOSHBOU21jelNVaHljbFZ1VGpFclVXZ3labWNLVG10dFpHbG9hRVJ1
      WTNSMWFWRlBPRkZ6Y2xsVE5WWnFUa0p2ZDBwMlRFWkJWRzlsYUZoVVdrZG5ZVWQ1WTFsWlRWWk9i
      a1p2YlZWMFNtdHpkaTlpUndwUlNscFVTSGw0ZUhaVFdVUnhWV2hYUkZGUlZGaDJVbVJ1UkV0T1Ft
      MHJTRGxuY1d0SU0waFRXQ3REV20xSE1rRjBibFp0VERaSlJsb3dRVWxzVFRGQ0NtUXJjVGswZDBs
      TVdVazBPRmRwZEdrNWQwbExNWFl4VVRRNVJYRnNhRk5WY1U5RlRFWjBkSFZVTVZRM1JDdHdORFpR
      ZDBwMlUyczBOVmhaTm10VU4ya0taelJXT0ZCWU5YVTBkbTVtVTBOeWR6VnZjVTlVVjNwdFIyaHVO
      bUZDUzAxc1UwUkNXbkJ5Wm1wc00weFFLMjg0Y0RSeWFIWlJZMVkxUlROUGNVZ3JSd3BWTm0xblEz
      TnFWSEJrU2sxRE5qTjNOM1JCUlFvOVJYUTFjd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83500-9
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_auth_tries
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH authentication attempt limit
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxAuthTries\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxAuthTries\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxAuthTries\s+
            line: MaxAuthTries {{ sshd_max_auth_tries_value }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH MaxSessions limit
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_max_sessions,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH MaxSessions limit
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_max_sessions: '10'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      bDNaMUF2YVRCUFNHeDVSaXR0V1hGQ1ptOTRUVGxzUzBWUVFsSUtSRnB3Vm1OVmRpOXBXRTFqTTJr
      MU5rcGhTRFJuVVRCSlVtZHVWRUp0Y2xCaVJXVllkRlpWWmpjeVltUndaeXRYYjB0VFpYbG1hSEJa
      V1VaWGNHZFlkQXBVY0dsMk0yTlFZbTEyWW01SVRUWjNlSGxPZURoUVZrODBiR3hSTkUwNVV6TnFO
      MnhuVnk5UGREaHhjMmhOVjNOT1ZGWnJTM0JaUW14aldVVnROa0UxQ2xKVGEzVnNja1JaVVVOalZF
      d3lMMGwxZDJkNWFYWTJUSFZMU0ZaMGVXb3hRbGhqVDNKWldVaGtRMEl2VHpObVZFOWFXa3h5Tm0x
      TGVpOTVNV05xWjI4S2RUQlRjbWRwTURGdlJXdHhVVm94YlU5eFRtRkRSR1ZpY1d0WlF6ZGhNbkJo
      ZDI1b2FGWTFLMXBaY21vMWJDOXNOM2x5ZVN0QlozSldTV2xtVlhGb2JBcDBOMmxPUnpGeWNXRlJV
      VEIxUjJOUGVFVXpTWHBKVVU5SFVtcEdSV1kzWlhaTE56SmFSR3BKVUROSFF6TjNkREUxT1RSYUsw
      aDFZM0JOTVVzemMza3JDa2czTUdGR2RWRkdlR05CYjJocFVYRnRXR1F2TjNabFVFdHhURGw0TVV3
      MWJHRTFiRmxyZUVNeVVGbDVkVkp4UmsxT1pIVlFaVVp5ZEhaU1pXTXphRXdLU0VkRlltNHpaR3hE
      WkZaNGFFdE5RMFZhVUdsdE5FSTJZalI2VUdGaVlUUnBUMUZTYjJseVprcEhlbTU1UmxKb05tOXNk
      VkZ5UWk5RlNXbFlla3hZTWdwbU1HRk9OREpNUzFsbVVFOTVlak5tWlc5MVNtcE9NSE15Y1ROWlJr
      c3ZhMFJoYVhOaWFEWk1aMHg2YURRd1lXVlZNbU54TDFoQ01GVllWemtyYW14SUNqbFNRM1IxZVhK
      a05TOHZNakZwVG5vNU1VUm5NVlYzU21SS1JUaFRjMjFtTURadGIwaFpOMU5vYTB4TVl6QjRhMjFM
      TjJ4Tk1VdDZTVzFhTUZCWU1Ea0tiblVyTlhsTk5XZE1NR2Q1TldOdlZUWTFWQ3RXUVdwV2RpdHdk
      RzVHU2xSWVlWVXhTVkJHTmxreVpXeFlhR2xDVmpOeWRHRlRVMGRNYTIxd1pHTnNjd28yVGpaMmVF
      OWthbUpIVGtKbFJscEZhRk40WmdvOVZWTlFNd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83357-4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_sessions
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH MaxSessions limit
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxSessions\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxSessions\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxSessions\s+
            line: MaxSessions {{ var_sshd_max_sessions }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure SSH MaxStartups is configured
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_maxstartups,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure SSH MaxStartups is configured
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_maxstartups: 10:30:60
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VTBORkF2TUhkc1JYRjZabk5hYUVSMk1YbGFSMG95WlZSa1Vsb0tWbU5rWjBWUVFXdzBjWFk1YWps
      alpYbFJkVkZrWlcxU09YUlRPRlZ6UVVkeldsbE9ObWxIYWpCbVRrNXNNSE4yV1N0TFpVMWFLelpx
      TmpoSVFtZHhkQW94UWtaRlJDdERiU3NyUjBsWWMxRmljRE50Vm5OblFqaDBPR1pKVHpaa05sQmhN
      bEJwYzJ4MGJsUnpaVTk0TmxCSlRTdHJWVlZ1Um1oeGNHaHhZMUpNQ2t0MFRHTkhZVGxpZUhSblRD
      OXBiRzVEZUdSM2J5OTBjbGh2YWpKRWExbEVhazl5TTI5bU9USlpSWEpUTjI1SFNsTjBlRE40U0Zw
      Sk5YSnBOM05SV0hBS2JITTNlRFpTVGtaeVFteHFhMjVzSzNRNGFrWnlUbWRDVUVkUmFIQnVOMjFt
      YlRkUWMyTjRWWFV4VWpsMk1FNTFLMmhWTDA4NVkyZFhaRzV5UldoR2JRcFJhWEJwTjFWd1lrcDNV
      M0UxVFZkelozVkhaVmRRY2xGc01HcEZSakl6VEhCaFNuZEVWRXhyTWxZclVXZExSRkpMYm1KcmNU
      ZGhTa2RIWmxWWGFtWkhDbWRGVEN0MlUzUlNUR0poTHl0UmJteFJjVmt3V0daRGIzQjBSMmhZWWtK
      QlJUQllUazAyZERVd1lUWmxWVEZOTWtRMlEyMUdSRTV1VFZRM1ZXdDNhbm9LUjB0dFl6UmFaWFE0
      Y21RMVVtaFRXREpyZEN0NU0zbzRZbEJSTTFWR1FUVnVZMEZqTWk4cmJERndPRlJ0VFU1UGRsSTBU
      bUoyU20xclpYRnZaV1EzUmdwbWJ6aGlNVmhPTlM4MVJ6Rk9Ta3RQV1VwRk1EWTFjbEpVWWpWTlRt
      SmtSM1IwYW1KTmFWQnJLMDkyYmpsblIybDVObVF6YVZkU01UUmxhMGRHU1VkS0NtZFZWbVZCY21j
      NFZtWlBlVTl1ZVd0b1VUUlNZVGxJVkdNd2VYSm9PVkI0ZDFGRVZHcG1aRTkwVjNkbWRYbFljV2Rp
      TW5CS04yUTFZUzl2ZFdablVYZ0tNVE5PYkRWdFFsRXJhSHBpWkUxNlVWaDJNMVZxTlVsdE1FTTJP
      R1ZKZEdoSWFqZzVSR0pGYUhWS2VYSTNUbFpoUW5aMFJVaFphMGRHWmtZM1dtSXhhd3B6WlVZMlZu
      bEpiM0E1WjNCV2RIZzRlREpFV2dvOU5taHNUZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90718-8
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_maxstartups
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure SSH MaxStartups is configured
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxStartups\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxStartups\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MaxStartups\s+
            line: MaxStartups {{ var_sshd_set_maxstartups }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Use Only FIPS 140-2 Validated Ciphers
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Use Only FIPS 140-2 Validated Ciphers
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sshd_approved_ciphers: -3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      Vk5kMUF2TVVWRWFFbHFOM3BXYW0xTlIwMTFVSEF2TUV0MU55OEtNVXRFY0M5M01rMTZTSEZqU214
      aVkybDFNMVZzWVRSU1ltUlVRV3R5TkZWVFJISlVVblUwZWxFNFZqTTVaRzlXUW10alIwOUtRMU5S
      UWtoM2JIUllMd3A0WlRGV1dTOHliR2xXUkROUVUzaE1WM0JUVml0TUszaG1XRlpWV1d0cmJrUnVi
      bHBpZGxjME1URnFTMjFHUlRKRGRrRXljMUY0TjBoQ1UzTjZORXB4Q2xCTVkwVnJkSGRpV0VSR0sz
      QjJRWEZ3VEZwSFQzZ3pURlY0Um1vNGVUbDNiRTlPT0c1SlVXYzBlVXQ2U0ZoTFpYVlBNak5RVmpW
      bldGRlhPVk5NUzA4S2RGbG5aMGx3Y25nNVRFZGpaMFV3VTJaUWJraHhhbXhLVTAxd1VERnZWVWwy
      TlRGWFpFbG9ZbE4xYUdoQlVHWXJNVlUwVnpNMlJtdzRSbmhzYzNVM2FRb3ljRTVZYldNeFlXWlJR
      blZ5WlhKVmF6UmlhbTlzVUZKWmRGUjNSR3hKZWxGdlZGcDRNV1ZITm5OS1VEaHRiV2xPY1dsUWIz
      aHpPSE5GTlZaelpEWm1DbGh1YkhsMVZsbzFhek0zTWpCaWJHcHZTV3RPZWtOQlJqVkpZMGRTZGpS
      Q1UwcE1ZMmNyZWxOU1dsZzJaV1o1VDNONFdYb3lOVUpUWlU5eVJqSkViRE1LZURGcFYyazJOakE1
      UldkVGRVNDBhREZJUkM5Q0syMHpkRWMyWlhScVNIcEtLMjlsWjFwaE1VSkViRUpRV0hsNU1UbEZW
      VFZIV1doaE1EUm1iM2xpWWdwbWEzbFFRMmxwZUdwSFR6UTFTazFNVVV0T1RVeFRXbGxUYTJVMVVV
      MXJMM2xUTVhGdEszUkZNRkp6TkhaVVJHOUZSMHBQY25wSmJVSlVUSEFyZGt0V0NtWXJVeTl2WmtK
      UmN6VkJSMUJUTVZVd2VVNWFjVlpMVlUxaGVqWklhakZKZVc5VVpVNVpRbU00VVdvMVpHaGlhVzF3
      YlhoTGRISlFOa0pHV0dWbk1tVUtRV0ppY0RGNVpEQlRlSE55U2tGWGRHRlVUbTFpTlROR1VtTXlT
      bUZXVEhKb1ltaGtaalJSZVhaaVNXaFZXR3BPV1d0S1lXZFRhVVpwTkhoQ1R6QmhVQW81TUV4RE5W
      VlJNV3RpUjI0M09GZGpiemhqWkFvOVYyVklOQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81032-5
    - CJIS-5.5.6
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.11
    - NIST-800-171-3.13.8
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_approved_ciphers
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Use Only FIPS 140-2 Validated Ciphers
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Ciphers\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Ciphers\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*Ciphers\s+
            line: Ciphers {{ sshd_approved_ciphers }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Use Only Strong Key Exchange algorithms
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_use_strong_kex,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Use Only Strong Key Exchange algorithms
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sshd_strong_kex: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      WkRWVkF2YVRkSWJWZGpTbm81VkdWWmRWWTJZbmxLYld3MGFWZ0tVazB3TURkNlMzQlBPRUV6T1hk
      R2IwUjJVVTFPZVhGaWRYb3pSbkJDUkRoM1dsRkxWMEpQWkhkTVJIaHVTRVZ3TUU5S1ZVY3hUbFk1
      TjB0VlZUQnFUZ3BEUlZKMFEzcEZTV0ZzZEN0UU5scG9SakpyTUUxS1IwRkZNMUpJVEV0cldGQndl
      RGxPU1ZSTFdsSmhWa1ZvWkZKblltOWlkM2hCZUdoNk1GWjRhalZVQ2pCTWNIVllUekpqT0dkRmRF
      eE5ObTlQWkhWdGVubElNR1J6TUZoWldqVmtURkYzTDNKQ2FrOUdaMWh4Um5sb1NtbEhiSFZrUkU4
      NGFHYzNZVFpSWXpNS1RXdHFiSEJWTjNOVVlrdHRTemhGU0dRMFJtbFNPR015SzFwbVZrTnlTM3Bu
      TjFkVldWazVLMU5hYkZoTEwwSkpWSEZOTW1WcFNISlJaRXRCSzBGcWFRcElVRVJSWVZacWEwODNV
      a3R0TVRWR2FrRnRlbWhqTWpablRYRTJWRXB3TDFSdVNGUlJjVWw0ZEhGNloxZFVVREZ5YUdobFQz
      TnFWa2x1VkVwdVJFNTZDbEIwSzBOTGRteERlRmR6TXpkT1YyUnhja1ZsTVU0NFQzazNOVlpaVjA1
      RVNIaG5ZbmREVGxGUloyOTNjR1p1U2xKSU1rNUpiVGxMUjJ4amNEbHpZVW9LTW5oWVdYZE5hVEZC
      Vms5alVEVkhWMjF3U2pkd1JIa3dNVWwxZVM5NlRIWmxjelJVWkZWNU1FVmxkakkxUlVNNFZHTXZN
      a1pLVW10c1EwTTNjMEZRY1FvNVdXOTVRMEZXYkdWWmJXZzRZV2QwUlhob2RVNDVkbXhWTmpreFdF
      TXllRTkzYmpaS2JqUlZObE51T1hveFptWmthMXAzTURkeGQwMVdkamRxYldWMkNrOUZiVzFMVkVF
      MFpEUnBkazFVYzJoT1dWZENTRVIzUms5aFExQlFabE13WlZrek1VSlVWVTVVUjJGaFQyZDFaVUkz
      VFVwVlVqSXpaMFo0V0UwcmNuRUtTRVJqVHpsbE9WUktTRFkxY3l0ak5ITlBabFJGU0VkSVYxbzBO
      emhuTjJoTE5ERjRTM2hVUVdSdWNFeE9UWFIyZDB0aGFGZG5hakJMTUZOVlNXOTROQXB6WkU5WlUw
      cEpXVzVXYjNwaFoxcFVhRGhaYndvOU5WRTBOZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86518-8
    - PCI-DSS-Req-2.3
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_strong_kex
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Use Only Strong Key Exchange algorithms
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            line: KexAlgorithms {{ sshd_strong_kex }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Use Only Strong MACs
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_use_strong_macs,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Use Only Strong MACs
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sshd_strong_macs: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      VklkMUF2VW1Gbll6ZEpWRk54Vm1oSlJWTm5PVVZzZGxOb1JYY0tVeXR6UTNaRFQyaEZSVE5tY0dS
      MmFVZGtZMHQ0VTJkVmIzaGpaelIyUkVsVFZtbExNMWRFVlhORk5XOTZXbE5CVUhsUWJVOXNUVFEw
      VW14V1FtcFJTd3BWTTAxaFZsaG9lbXRXTWxGWllUTkJMMWg2VFVneFFteFpkR001UlhSTFVqUkpW
      RFJSTTI5SGVFZHZRM1ZNZDB4U09HeFlWa1JVY0ZGSGJVSmxRVTlFQ2tsM2JWWlFWWFpOYkc5M1oy
      OTRUak4yY205WU5GaGpPWGMyZGtNMWEwVmtVa0YxV0VKS0swMDJjRGRTVEZweGJXcENOSFE0TjFv
      eE16TkdSblI0ZUdjS2VWY3lZM1pKVTFGeVNFSkZSbU0yT1dkUVUwOWllbTF0U0hKMFJrNDRhbXhr
      T1hFeFUyVktNVWhXYWt0UU1IQmlNMjVYWkdJMEwwUnNaemhGUkZkNlFRcEtaMkl6ZDBKaU5rbGlT
      V3cxZGtsNk16ZExlRVprVUVwU1puRk1UMHBTYWtJNVFXRnFlVWRyVkdONVJreEVUSFJUU1RaTE1X
      ZDJSbTkzTWpkTlRYRjFDbkJhUkhaNVRuaFBSVnBoUTFKT04wazVZazlVYUZBMmFtRnZVR3QyV0ha
      dFdXNUxkVUYwZDFrNGVtcEhRazh3YTJwVU1HZHpOazkyVG10cFVuVTJSV1VLVlhSTGNqRmFTMFYx
      VEZNNWFHb3pVSGxqSzJSRFNGY3hSR05EWVd3eE5sWnFNVzlaTkdWMFdsVjJhVzVqYkhsaFdrMXZj
      R1JSYmtzMVQxcGhXbVl6VUFwYWIwNUdhamRXV0dKeVoyTk9jM0k0UVV0WU0yTkRjRVpUTjFkWUwz
      RlNVa2wzZVdKeFpXdGljVVZqTWpocWEyRmxNMVV6TTFNMmFuaDBMMjlUUlRaNENrSkJTekpITWto
      MlVGbE9NbVZEYmtvNWNqbHdVM2RrZDJRMlYwZG5Va3gzUlVWT2NXbHdlRXhtV2xZemJ6Qnhhek5U
      ZURkMVVtVk1aR2R6T0dGM1FsZ0tkSGcyVEZGbVVHNUVkR05HZVUxRFl5OHlUalpEZFcxdVExVXZR
      VFk1YW5CVE1VcHhValZQU1hCVFpuWkRjbEpvYjAweGFYaGlNMnhvWVhVclJ6bHdSUXBUV1hscldu
      RllTbWRXV1dvck9WazRaR1poY2dvOUwxTjVhZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86504-8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_strong_macs
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Use Only Strong MACs
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            line: MACs {{ sshd_strong_macs }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_add_use_pty,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83798-9
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_use_pty
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      ZFlUVkF2VWpacWRIY3hRbGhHYVZkVlUwVjNSamhNWTBGSGQwVUtUVk5DVjNkUWFVNDVSMnRaTDNN
      NWRrbHNRbFphTlM5MVpVdzBXV0pJV0RjeGRYaHBNVVpaUlZsbFVYWkxVMXB2YlZGVk1UaHJNMUZy
      Y3k5VWRHbGxSZ3BMVVdWNlpVczFhVU0xZGxreEt5OTFTVlJyVEVjM1NURmpXbWcwZFRBeUswUXlk
      bTV3YzNrd1UyUlBaR0ZHV1hKNVZUTmFNbTFLVlZoSFoyUnpRM2c1Q21VeGNYaFdWbVJVVGtsR1NH
      SnhhRVEwYVc5TGNEQjVkRFF3U1VsNE5UaGlWM1YyVjFRd1NWcE9NM2xJV25WTFlqaExZa2x5U25G
      b1EzcDNTVWxvUjIwS0x6bFRjVEFyWm1wT1RHTnRRVUpOYTJOaFpGZG9URmR3YlVkT2FDdEhMekZx
      WlVwdWJsVm5jVUl3U0ZremMwbFNLMnQxU1cxSVNEbE1Xa2QxYWpKUlR3b3JjSFYyUXpObWNHOTZU
      WEo1ZERGek16UXZUSFlyWWxoNlEyUTVkWEUyTVdjeGJGcFNNVWRTZDNGNkszTXlhbGM0YVZKV1N6
      aHhjR2d2U2tWdFRqRkZDakZFTUZodGExSnJSUzlPUkZneVJXbDNPVTByTWpjNFZpOHlWRWMxV1ds
      ak1WZE9XQzlFUTNvMVdYcFpUVWg2VmpaalIwbzJWRWd4UWpnelZVdERXa0VLUkc5MU5XaGtOa0pE
      YkN0SmJVMXRZMDlyVUVkcWJEZ3pWVXhhVjBsUE9GZ3JTRGR3Ym1KTU1ucHBTbWgzSzJSa1RFdHFV
      R3g0Y1VwR1pqaFpPQ3RNVndwV1ZGUnVWV1JQTlU5clpGUlRNRXBYVm5Kc2EwcEVPVk5uU1hWaVpq
      aDNZazVwV2xRclZsYzFkVWxMWlRGRGEzVkdWV0oxYUZGVlUwVTFkRkJGVTJocENtOVZTVmhPYm5O
      UlZDc3JhMUJtUmtoQ1NFaDBZVXBwUlRaaFUxRklOM0ZuYzJoSlEweHVaa1J4YlRkVGJXSldXakZa
      UTNRMlpFdDNVV2xYWVVkTVRIUUtUR051V0ZFeFNHUTVWaXRJVDFCVGJ6STFXREpOWWt4TFdtSXpT
      MjVQTm1WREswZE9hV2htY2k5VVNWRXZLM3BWWkhOVGMxVlVNWEZHVVdveU5UUkpNUXBNWkVsak4y
      dGtPR2hwVTB0Sk1FNTFSekppUlFvOU1GTmthZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure use_pty is enabled in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults.*\buse_pty\b.*$
        line: Defaults use_pty
        validate: /usr/sbin/visudo -cf %s
      when: '"sudo" in ansible_facts.packages'


# Ensure Sudo Logfile Exists - sudo logfile
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_custom_logfile,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Sudo Logfile Exists - sudo logfile
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sudo_logfile: /var/log/sudo.log
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dFlkMUF2YW05VFJXZzVkeXR4YVdGdmNIUlJOMGsxY2tNMFdtRUtSMkpaWW1FMGRHNXdhVTlzWVN0
      cVltVnVZMVZEWXpCeldHTk9XR1JZU3pkUE4ySmFNbFJXWkZaNU9WUjBlakpTYmxWQmRtZGpabVpI
      TDNCd1VUQXJVQW81ZVRaelZ6ZHNNMEpPYnpacGFsbEJaREJ3UW10cEszUXlSakUzVmt4NlNsbG1V
      R3B6YUhsV0swTnlMMDVJVW1KeGNGQkVPSEZRUTBsaFlrZzJURkZ6Q21ka1FqWXhUbWg2ZFU4elpr
      SnFWRU5JUmtoTWQxQkdSelF6ZFVoWU5TOVdTVTlLV0dabWNqWlBhbVpJYUVGTFVrZEZlVWxtVG5C
      NVJFcHVOV0pZTHlzS1UxWk5SQ3RLTVVOWE1rZG5kVzFtWlZsM1RqVXhOVlZET1ZKUFlXNXZObWN2
      UmpZMWVHVnpaMDE2VW5kMFIwbERNREE1ZURGb1VIZzJVV1l3Vm1Jdk1ncFhaVEEyYzJkUlNtcFpU
      bVJTT1RCaWVtY3pWa05pUWxWbVRITTFRMEpLTlVkUVdIWkVXRFV4UWtocFVIZDFNakpVWkhWelEy
      RmlSU3QxYkRSQ1FXSmpDbk5QUTFac2EyVXpNbmxEZEhrMk5GWjNTMWd3Tm5GU1NuTXhkVEkzVkZw
      dVpYTkVhak5RV2twa0swcDNWbE5HVkd0dVJXTlBPV0pYZDNSTGJ6WmtNa1VLVFZKSWNsRk1lbkpT
      VlVoQlRUWkJiemxsVTFkMlNHeHlOVTlWUlZKalNXMXNNRTV1TVM5MWRGaE1WMk4wYlVrNFdIZzVS
      a05KTUdOSlpVZzFVRWRuVXdwbVMzYzVhMmw0UmsxQ1pTOXNWM0p5UzA5SGMwaFhPVVZaUW5wNlZt
      eEZZbE5DYzI4MlMzcExjRXh5YlVwNFZXY3dWazk1YmxKek1ISkZNMkZTU0VoVUNsVTBUbGdyU0ho
      UWJqSk9kazVUVkVKcVRXMURWV2hpTW1KaFdUZEhaRXBvTVZsR2JFOUVTekpzUm1aMWNGTjNjazlp
      Y1ZGdlUzZ3ZTVTFHUkVJdlMzWUtiRXgwTW5GQ2FXWXhZbFZqVmtKWmFUVkZOV3RJY2xsSVV5OXVO
      VEF5UTNSNVJ6QmpSVmRVVmtselNEbFNlR0ZCU1dFMVRGQnRWMm8xYzBOYVlYRjJWd29yYmtKcWN5
      dG1VMVZTYldSWkwwMXllSEkxVndvOVRUaElRUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83601-5
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?.+\b(.*)$
        line: Defaults \1logfile={{ var_sudo_logfile }}\2
        validate: /usr/sbin/visudo -cf %s
        backrefs: true
      register: edit_sudoers_logfile_option
      when: '"sudo" in ansible_facts.packages'

    - name: Enable logfile option with appropriate value in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        line: Defaults logfile={{ var_sudo_logfile }}
        validate: /usr/sbin/visudo -cf %s
      when:
        - '"sudo" in ansible_facts.packages'
        - edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed


# Ensure Users Re-Authenticate for Privilege Escalation - sudo
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_require_authentication,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Users Re-Authenticate for Privilege Escalation - sudo
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-82279-1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_authentication
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      UXdWVkF2YWpKbGRtNVdUbFp2VEdOcFRFUm9ja0ZIUlRoV1lqRUtLMHhOTmpsbVJFOHlXVlpPUmpa
      SVIzcFJhWFU1YkdGYU9UUlVkazAzZFRSaFYwcFdPVmw1V1M5WldWRmFWV1JuZVdFemVraDFTVTEx
      T0ZCa1VHODRTQXBQZGxSelNIUmxielJFT0VkTk4yOXZUalF3U0dVd1JXcEdUM1kwWlc5NE1HWk1k
      ako2T0dGdGEzbHVaVWxUYzJoeFZrbHVjMnhJTjBoV1VXZDVWbUpZQ25ZMFlrRnFkbXgyYTFoaVNU
      RmxOSFUwU205eVNWUjVRV2QzVEU0eGNrdzNVMUJUYWpGaGVYWnpOaXRTV1djeVYxaDJVVkkwWjBr
      NVIwNWFXbFkzTlc0S1NFRXZkbU5ZUTB0bGRqWXJVMU5XWW5GdVNFRTNVR0pVVGxGdE5FRlhhbXhr
      Y25WUGFUUmpibWxyZG10amMyTkxOMmM1ZEdKeFUxcDNVVXhFVDNsU0x3cHpUMDVOUjJwT1VuTkZT
      V05DWVVwUlRYRTJZMFJhUWpKcmMzZGFRblJSVWtWaVRrMTFlamhvZG10cVlqZGFXRTVrY2tOUllr
      WTVSa295U0dadmIyMUNDbVZuWTNSc056ZGtZWG94UzNsSVpYTldlalZJWkdnd2NEWlRTallyV0dS
      d1dVNWlSbWRGVVRaWlptdFVRVzAzTUVKUGRrWm9TMHREV0VWb1ZIWXdOa1VLT1d0b1JYZGlZVU5K
      TUZsblNYUmxSVXR0S3pOc2RTdDJhMGNyUW1kQ1NtVkxRamQxU1V4WlowZENRbUl3TWtWWFVHODVR
      elJhV1VWMlNqRk9NRmRwY0FwYVJXSkdlVTg1Y25Kd2MzTmxTRlZZYmpVcmVWY3pWWE0yUldOeFls
      QkxibXQzYTJoR1NXSk5Rbk5pUVZabVpuaEhVbnBLTjFabmNIVkhkbE5RWjB3NUNpdDRZVGgxUkhO
      WmFsTkNXR296VmpWa1RFMUJhbmw1YVdGVVZsQkVkVmxEUmtWaFJqZzFUa1Z1Tm1KTlptdFlNbVJN
      VEdoVldYaDVVQ3RWWTFwRlZ6WUtRbTk1UjJ4UWVtbEJPWFE0TjI4clkxRnBNRzlQTms1NFQzRlVN
      VXRoTmxaWGVqQjFOWE5DUlhsS09ITlBaU3ROT1VaUlF6VjVWREJDTkVwclMyMTNMd295U0ZCS1JI
      YzRkRWhzV0M5SlN6Vmhaa0puYlFvOU5EWlJTd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Find /etc/sudoers.d/ files
      ansible.builtin.find:
        paths:
          - /etc/sudoers.d/
      register: sudoers

    - name: Remove lines containing NOPASSWD from sudoers files
      ansible.builtin.replace:
        regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
        replace: '# \g<1>'
        path: '{{ item.path }}'
        validate: /usr/sbin/visudo -cf %s
      with_items:
        - path: /etc/sudoers
        - '{{ sudoers.files }}'

    - name: Find /etc/sudoers.d/ files
      ansible.builtin.find:
        paths:
          - /etc/sudoers.d/
      register: sudoers

    - name: Remove lines containing !authenticate from sudoers files
      ansible.builtin.replace:
        regexp: (^(?!#).*[\s]+\!authenticate.*$)
        replace: '# \g<1>'
        path: '{{ item.path }}'
        validate: /usr/sbin/visudo -cf %s
      with_items:
        - path: /etc/sudoers
        - '{{ sudoers.files }}'


# Require Re-Authentication When Using the sudo Command
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_require_reauthentication,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Require Re-Authentication When Using the sudo Command
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_sudo_timestamp_timeout: '5'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VlZZMUF2TVV4cE1HVnZWVWRrVjBGd1YxWklXakowY0ZSSGIyMEtSalp4Ums4MlZqbFBSMWxETDNC
      d1pXbEVhM0F6VURoMGJsSnpaRnA2WnpkVGNGUmxUVkJ0TW1oa1MyRXliMUZGT0Zwb1MwZDFSelZx
      UWtSemREWktNd3BHV0hkWmVIWk9hRkJoVWpGWWR6UjRRMUJMU2pobmNrbFpRbFYzTTFkV01WcFlL
      MEpIY0ZObllXbFNNSFZITUUxV2IwcFhkVzU0Vlhsb1RpdEtWazU0Q2pCSVEyZGphMXB5YkdrMVJr
      Rk1UekZMZVdJd2NHWkljV0pLTDJWcVFrVjJWMVZzT1ZaV1JHWnpTbE14YldGb1pGbFhZelJqU1dO
      bVJERjRSekU0Tkd3S1pISmlWMHRpZVZGdFkwazJiVGN4T1VGQ1kzVklXRk53VUdRclRYa3diWGM1
      VW5ZME1uVmxWRmh4VlRCUk9XWktWVE01YldGcFJrcFNVWGRETUhsQ2VncG1UVWRXVWl0WGVFSmFT
      VlZEZDJSSWFWbE5iQ3QwWkhOamFHeEViVE5LY0hvMWRXSm5TMGhhUVc1M2N6bGhkV05HTkd0NUt5
      czVWRVYzYTBGVGMyUkJDamQxZVhwQ09URjBiM1ZYWWpoR1VHdGthV1pOTmpsUkwwazNSbWN4TlhN
      M1lqaERja1ZRWXprMlpHTTJWMUIzVDFOQmJEbEhVV1pzVkZsc09WWlJNMWNLU0hVclVIZGpRbFk1
      ZW1kaVUzbDFPVEZWYUVoWU1EVk5jMHhUTUhoWE1sb3dNRVZUT0hvNFpteGFjblpsWnpRNU0wNW9W
      bVUyWkRSd2NHVkthMmcxYUFweE5sbGthV0pzYUN0YWRXaGlVVWR0TnpkdVFYTmFTRVZzUjNkaFl6
      WkViMHByWTBsNWRIZDFTM2hTT0ZoTGQwMWtRVmhJUzA5eE9WWjRkRFpLTVc4NENqbDVWV3hsT0Ro
      SmVXUldiM1ZTZG1WNFRFMHlObVpYUTNZMlJYRkxObmhsY2xCcGVIVXhaMVZRU1V4VlVGQkNRakpv
      YWpWcVVERlBXbEZLZEhWT01tNEtiakpFTjJjMGNVRXdhVUk1Y0ZSQ1JUYzVNbVJzVEZkU01XeDNV
      U3R4WW1kSEt6ZHBZVmRHWjAxblNFTXdNa3BCVEhwWUsyZFVkRTVxWlc4eVRrNVBlZ28xZERkcWRq
      bFNkR3BwZDB4aWNrVldibGxrY2dvOVozVlFNZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-87838-9
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Require Re-Authentication When Using the sudo Command - Find /etc/sudoers.d/* files containing 'Defaults timestamp_timeout'
      ansible.builtin.find:
        path: /etc/sudoers.d
        patterns: '*'
        contains: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
      register: sudoers_d_defaults_timestamp_timeout
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Remove 'Defaults timestamp_timeout' from /etc/sudoers.d/* files
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
        state: absent
      with_items: '{{ sudoers_d_defaults_timestamp_timeout.files }}'
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Ensure timestamp_timeout has the appropriate value in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s(.*)\btimestamp_timeout[\s]*=[\s]*[-]?\w+\b(.*)$
        line: Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2
        validate: /usr/sbin/visudo -cf %s
        backrefs: true
      register: edit_sudoers_timestamp_timeout_option
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Enable timestamp_timeout option with correct value in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        line: Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}
        validate: /usr/sbin/visudo -cf %s
      when:
        - '"sudo" in ansible_facts.packages'
        - |
          edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed

    - name: Require Re-Authentication When Using the sudo Command - Remove timestamp_timeout wrong values in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!{{ var_sudo_timestamp_timeout }}\b)[-]?\w+\b.*$
        state: absent
        validate: /usr/sbin/visudo -cf %s
      when: '"sudo" in ansible_facts.packages'


# Enable Randomized Layout of Virtual Address Space
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Randomized Layout of Virtual Address Space
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80916-0
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      OWpVVkZCU25GQlJWVkROREp2VlVabFMwUlhOMFp0WkRaWE1qWUtPRkZ6YjAxamNucE1WRnBHYURa
      dGNGUkxhREp1ZUVwNU5FSklTVFJ5VUVzNVRXcHNLM0J6UTJ0WFoyRlBWazlsTnpsQlEwWXdhV2x5
      WnpSdk9VOXVZUXBETldoQk5EVXlRVkp6ZUZwVWVsRlZLMEp3ZWtwWldYWjNjRVpaYzFkNFFWTXdk
      a1JMT0dkSVlWZDRVRGhNUkdWSlNVRlBVMGsyT0RSNmJ6TldabkJWQ2xseU5rNVdXaXRVU1dsRFdU
      RkpPRzVPVGxGVVdIUTBTbEJ1TUZWVWMzVkNTVkJHYlU0MlJrUnllSFZVWmxCVGRuTmpXbU5EVlhO
      aFRYSkZaRkFyUmxVS1owUTJSVFpzWkdFMVJFRTBUVXBMTVZkU1ZVaHhURkZ3UkVkQlZUZG9TWEY1
      VWpKMmJVRmFTRnBrTHpKcGJVWlBlRU5vY1hWTlRXdE9iemR1UlN0SUt3cGFWVlUwZFc5R1ZrUXhS
      VmhWUVU1UWJXTm9XRXhOVkRSc1ZGVjZXV3BKUlRZMWVDdHJiRTVwTDFCSWJVaEhSV3cwTVVkMVVr
      VkplSFU0VGpCNU4zZE9DbWxuU1RaMU5uWnBUblZFVkRFNWJWVXZUak16TUVKaE9UbFNibEVyY0U5
      YWRtZHVNVVExV1ZOdE1YWXhWak5HWkhWQ1VGbHJhRTFVZFhaSFNuVkZha1VLZEVkRFpsbElSMHhz
      ZVVaYUsydElRV0pUYWxaTlVGbFJUMEpNTTBKcVVFTk5hVFZHWWxobk16Y3ZkR1V2TXpsbk1HVmlh
      bWR1VFRWdlZIRkhVV1JqY0FvMk1VcHlLMEZXZWl0QlZVTXlaVTQyTWxkRFYzSmxaRGxIU1doTlFY
      RjFiRUUyVml0RWEzWXJSR2hJUVRSSE0waFpabEZ3Tlhvdk1VeFROVUUxYkVkdUNrdzBXRTFJVFhO
      RWEwbFNVMkZCYkVFd1oyaEplVEp2T0RFM1J6Rm9VSGRaTlZKUmFsQXhlQzlYWmxaeGJIbGpOa0ZQ
      YWtsMlpEWkZZWEJWWkdwS1pHSUtPVFV2UjJoRldUSk9Mekp4ZEVKVWRqY3paekJDUTBSYVQzUmtV
      bE5WV1hoUVRXMUZkMjl2VGt4VVZGTTFXVmc1V0VncmIwVnVTWE5ZZW1WWlVuVnRWZ3BuWTJwUFNr
      ZHFjamgzUldsRlQydGpWSFZqZGdvOWJtNVpWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*kernel.randomize_va_space.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of kernel.randomize_va_space from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*kernel.randomize_va_space
        replace: '#kernel.randomize_va_space'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl kernel.randomize_va_space is set to 2
      sysctl:
        name: kernel.randomize_va_space
        value: '2'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Restrict usage of ptrace to descendant processes
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Restrict usage of ptrace to descendant processes
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80953-3
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      c3dXVkF2TUdGQk5WbDFaMFlyVlhoMFRFaDNNMjR2UlNzdldrc0tPSGxwVm5OWmQxTkRiRE5KT0dk
      dE1UWmhObloyWjFwallUQmtORXMyVFhseloyVkhaVzQ1ZUVOSllXSlFlVlJNU1RkdFJqZHRRVmdy
      VWxnNU5uVjZaQXBIYjB3eFMwRmhhalJtVVZKdFFtNURhbk0wTW14b1IxTk1ORVV3YW1OU1VqRktV
      MWMxY25Ka2RXbzRjR3R5TVRacmQxSldTMU5QUXk5SFlXRXliRGRWQ2pCbU1rMXZjbWhMWW1sV0sy
      WklWWGhzTlN0NEswMVBiUzlKY2k5eFVuTkRVV2d3TUhwblQwOVpZekpTZG5CcGRXeHRaWGhsVWxW
      RmVFUnBZMFYzTHpVS1VtOW5TMk54YXpNM1ppOHljRGRwZDFSQmFITlpNSFV3YVcxVFZsSjVPVXBE
      WlhsTGVDdE9hM0E0TVdGMFJEbG9OQzlpYm1GUGNsRXJXRU40TnpocVRRcEJkMmc1Y2paallYUTJT
      MUZ2YzBVeFVXY3pPVXhzVURKQ2VsaHpOWHBoZFcwMU5EaDFlVnB3V1ZCcFpUVlBLMEV6ZDJONlRF
      bGFXbkJWVGs1YWFVVlpDa1pQVGxjemRubHBZWEJEV2pWSlNuaEhZM2xpUnk4eldrZDFibkZYV21G
      NFJVaFdTMDQzU1ZKeWJIVTNjVkZZYlhkUlRHSkRlRWx1YkVWNVdsQlZaa01LZDFwNFExaGlhRTF6
      VTFWa1RuZzRVR3hUVlRNMVVrWXZUVVpwUldWNE1UaEZVV0pZTTFoWlQwTjNMMnA1VmpkNVVreGhi
      M1oyUkM5UmJuUXhUa1p1YmdwTE5FcDBTRE5XV1U0M2JITnhRemxCUkc1WE9HVkJVaXRSVTI5cE1H
      dDFNVTl2TTJOSVZFaFZRV1JZUW1WMmMzRTRVVnA0TTJoTVlUUmpUMjlqUmxKMUNsaDZhRWR1VVds
      TmNraEtaVlJtZUhJMFRYSXpRV2xhU0UxemRYSTFNMk5DWVZsemJWSnlVa2dyVEVKSUwzVlBLMlpE
      YUVrck1IY3ZSR2hsVjJwVmJsVUtSRk5KY0hkTVJuWllWMlJ6Y1VWd0syMXVXbHBpTTBaQ01UTldh
      VE1yT1VzeVJVUlBTMFpQYWxOdFpIQm9kazlSZDFGSlRTOVhTMFJ4YzBwdFUxZFFNd3BtZGpsRmIx
      WXZkR0ptU0dsU1NGSlpTR1pUUndvOWN6VjVkZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*kernel.yama.ptrace_scope.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of kernel.yama.ptrace_scope from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*kernel.yama.ptrace_scope
        replace: '#kernel.yama.ptrace_scope'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl kernel.yama.ptrace_scope is set to 1
      sysctl:
        name: kernel.yama.ptrace_scope
        value: '1'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      TkZiMUF2YWpKQ2FGVXliRFppVm1jdll5OVNSVlJtWW5ZeE1ESUtibkJKZUhCTlpuRmFOV2wwTTNW
      eFdtRmhNbVJwVDBJcloyVk9TQzl0YVc1eVoxQlVXVGg0Y0VwRkx6VktaVVZVTmtsNGNGb3hWa1Z5
      WjAxc2FsbEZZUXBVV0dGSlF6WjZlVTVwVG5KUk5rSlllbVJDVTFWVGRsWmtTMFZKZUdKbFYxVkxU
      MjV2ZEhWRFFqbHpPVkZYV0hvdlpFTkZZVmQ0Y2l0bE5IUkVWRXhsQ2tkS1ZtUlBWSGRuVFZWTWVr
      OXRWWFJqTWlzNGMxbEVkRXh6Y1M5aGNWazNSVU5CZVcwMFUyVXlVbU5MZGtoR09WZzFPRnBWWjFK
      R2FpOXVUVVl5WWxRS1F6ZE5NblpoZEdKRVdUTXhjMWgyU0dGQllsSmxibEpDT0hNNVZXMDBaekJQ
      WjJwSWEwOUxaUzlzZWpCelRsSkJRalpKVlZjdk1rSnNaRFJSTm01dFlRcDJMelZXZFd0Wk1qUlZa
      RlJhTjNSRWRTdGlhbGxxUmlzMVUyTmxUVWhoWTBWa1VWSkNVRlkxVG5OaFlYcHdkM2hYZWpOM2Iw
      ZElTMnBwYVZKNFozSlRDa3h6YTIwd1pFb3ZWa05STDAxcFkyYzNZbUUxUVdaVVJXTktWbFEzUmt0
      UFUxVmpNbkJQWjNGUVRFVlpVSGxVTmtGSFFTczNOMjFWU20xT2VsbFJOM2dLYzFwcGJIcDJOWFpP
      VDI1VWRpODFPVkZJWVZkS2FIUndSM0pCVjBKaldsazNTREJLWkRCak1VVk1OMGxKYm1Ga1YyeG1T
      R2h3YUdoaGMyMUpWREZqTUFwcU9XSk9ZVUZvZUdoU05FaFJkbTgzVHpWMVZHczRUek4wYUdSMFQw
      Wllkek5VWlRWUVNWcEtVbGg2YVdkdGNteHRaMWxUY1VoMGFtZzNaM0ZNUjJ0cENubHNWRWhVZVdW
      SE4weENjMlUxYVcwMGJXcFpZamhvUjBWdlUwRlJXamxwU25wRGRreGFWMDlFYWpaT0szazNaREJ5
      UVRsNVJVbG5XRVZNTTA4eldIVUtkMGhYWkdaR1JtNWtOMEYxZGtKR1kwZzNTMnQ2YUdNM00wWm1N
      RE55TDBSWk5ESXhNRlZxV0hwdFJEaElOR0kzU21aalRrZDBZMGxuZVZjdk5pczFLd3BFYkVNeGFt
      UjFXVTloY0ZFeVZsSjFSVGxCZFFvOVNqTmFhZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80917-8
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
        replace: '#net.ipv4.conf.all.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.accept_redirects is set
      sysctl:
        name: net.ipv4.conf.all.accept_redirects
        value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_log_martians_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      TktWVkF2TTFSdGEyRllLMFp5YUU5dVkwVjNlRzVLWkZoM1JEWUtVVXBTT1ZaUGNHTTVNVEowTjIx
      RmNFSldVblZqVTBka1FtZzNlVEJqU2pCNmFqQjZZbFJhTTFFeFJIZG1VVWcyZEN0bFluTm1la1pR
      Vm1WNWRsbGxNZ28wZEZkUmVWWnBZWEY2ZUdoaVUwa3plR3MwU0ZScWJGVldRWFo0TUZCTFpFNXZO
      Mk13Ym5WelVEaDNiRkF5YzJoaWIzVkhURzVuTDB4UWQwMXJkbTFaQ21nNE5sWklkRWQ0U0hvd2FE
      ZEZibXRpZWxwcU9UQXlWRTR5WkZSdFlTczVWM1I2SzJWRGJtbEhRMUJIZDJjMWRHdEhjVk54VEU1
      aFNtdHFOV2MyYWtNS1JtZEdNR1l5YmxsNVVYSnBaemRvVjJKbFRHbFBLeTlEYUZNdlltZHpWblJt
      T1VRcmVVOVdZekpLY2tsT2VFdzRjek0yWVV3MUwwWkNWMFpKV1RSeFF3cG9XVEpZYm1kWVVWSlBi
      V2QyZVVWVU1WWk5aVE5SV2pGMGNYWTNWMjFxWkZOb2REZHRXRUphVVROalltTmFSR3RvT1RNNVFW
      WndiWGgwTW05eFVrVjFDazV5V1ZWcFJ6SlFjMnBaTDJaaE4wcDBRWFV4WlRaeU4xVkNUakJtZHps
      dU4wczJkMFpNYTFWWGQyaDBObWhWZEZkTlQzZFphSFpLTUVkcFYzQkVNMndLVVVKS04zUlNPSFZp
      ZGxkU05FNW1kR0pWWkVFdlRISnpabVl2THpKRVUyTlFVMFZvU2tSdVZHWmlSazlMVEV0UUwyeFlN
      bXQwWXpNMFIwaFphR0o1Y1FvclV6QkNNRGxWT0VzMFRucGplVk14YjIxYVJXTm5RVXRKUVV4NWFq
      QTJlbFppVnpCTWFrZGhlVllyWjBaWlQxQTBjak5UY25KYU0wUktNbTRyYTJWNENsbE5TM1kwVTBo
      eFV6Y3hhV1pQVEhvMmRuWlNUVkJsVG1oUldWRTVlVlZqVmxoRldtaEdRMWswY0V0b09XNUxNVkZo
      VGpWRVRGTjZNelZxUzNCa1RXc0tRa1p3VWxwamRGQnllR1pFUm13d01scGFiRGM1YUdaaGEwOUVk
      MVUzVmtKUVpuUkVaVmRET0ZWb01XYzFjVWh4VjBSek9HRjVZVmRpYVU5M1ZWZGlUQXBGT0U5TmEx
      aHpPRTFsYmtWMlpuTnNOVEEzYkFvOVdHcDVUd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81018-4
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.log_martians.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.log_martians from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.log_martians
        replace: '#net.ipv4.conf.all.log_martians'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.log_martians is set
      sysctl:
        name: net.ipv4.conf.all.log_martians
        value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_secure_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      QnhiMUF2TVZOVk4xY3JUbGR4TkU5ek5GSndhbkZoUjFaVWFWSUtRM05OUmtrNGRuVnhNRFpUYkUx
      SWNHeHhWbmMzVVhORWFqZHNVMjlFVW5SUWRGaHJiMFk1Ukc5blMycG5XamRKYUdsdFJVRm9jMnhR
      ZVV4clNWUmlWUXBsVDBSMkszaGtjVGh0UVdsRmEyWkJZWEZoZW5veVQyZEtUbkl5VG5kTk5UZEpO
      bkZsTldoUEwxVklkbGRvTWxONVJVbHFWM05SVGtwV1VIZEdkMDl5Q2t4NlVqVlRVMUF3U0c5eFpF
      TjJWbkJWYkdwNEwyZG5XVFlyYVdvNWFYZFdOMDlGTjBkS1oydEdkamRzU1daalNYZ3JiV28xTkhV
      NVpGQmtOa05rWldZS1psTnBZbkF3V1d4WFNDdG5iMUJwU3pGS1l6RkVOSE5uZWpKR2IyOHZOazFC
      Y3k5NGREUllNR3Q0Vm0xM1ZFRm9TRFp6Wm5sTVV5OXVZWGxPVmxVelVncHdkV1J5T1dKRlJXd3dN
      M0pGUzB0S2FFZzRZek5ZTXpWdGRWZFNhV1ZuV21SbVptZGtNM0ZVYlROQ1dFOWpOREZsWlhKbWNI
      Wm9hazFCVkVKdmFETjRDalpvYm5wUVRtNUVRelp3Tmtsc1dWYzJaVXhGYUhNMU1uaGtOeTkzWXpS
      cmFITTFUR3QzWkZSbmFWSlZRVlJqTjFKUlNUQTNjamhtWkdoU1VUTmlMME1LYUZKalIySnNUVVZF
      SzFSRVIzUXdTbkUwTHpCcmJqWjVSM2hKTTB0R1JWUjFWRTFwWTBSQlUxVnBTV0Z6U0VjNFRWTTVO
      MHd4VUc1VU9WQktjMUJhYmdvcmMwdEhOazFvY2pWamVrbzNjVEF6UkVWTFoyeExkalZaYUVSVk5u
      bHdaV05sV25oNmJYbEJTRFJ1YjJ0Q04wUkNaV1JrTW1sU1oxaHZNRTFMVkRWbUNtVlBNVXgyZFV0
      bE1WSnlhRU5UWkZsaE5EVnlUM3BzVERCVU9UVm9NM0k1YVhJclYyOTBSMWRsTTBoWFdWVXZObU5Q
      TjA1dllYVnJablZLV2xsd1FuUUtTMVJoVDNSV1dtWkVOV1J1WTJsVVdETlZTbmxMTUVSNlYwcE9N
      VkZMT1VKeWJXcHFVbVl5UmtoMWRpdHhZelZ2TW5GT2ExZEVZV0p3Y3pOelQzbG9hZ295VmtKRlZE
      QkROV1E1V2tnMGIwSkpPSEIxVmdvOVlUQkZWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81016-8
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.secure_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.secure_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.secure_redirects
        replace: '#net.ipv4.conf.all.secure_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
      sysctl:
        name: net.ipv4.conf.all.secure_redirects
        value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80918-6
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      bElPRkF2YVVGeUszVkRSR2dyU21scFRXVkNWR2MwT0dkNFprMEtUazF5VUV4QmJHVkhUbTFxYjBS
      ak5IUk5PVll3VURaNWJIcFhWazVZU1dGSFJUTnZWVTVpTmxocWJGcFNaMmhKTjA4MlFuQlFLMnhO
      VjFkYU1EVlFNZ3BTVjAxaVEwWm1Rbk5tWTBWVk1pczBiMVpYYTNoNFJtazBZWFpEUkVGMFprdHVa
      RFZoV1RJdlFWTlJXRVpQU1N0UVJ6SjJUV0ZJYzB0blVHMDJURXgxQ25GM1VtSlVSRXBaZUROWVNH
      UnRjek15Y25Sb05tcFpjalpSVEZWdWNYTlNZMnBEZWxCYU0zVllXamxxWmxFME4yNU9VRFJwVEd4
      cWFFRXhjRlV6Y0dVS1VESXZUSE5DYXpnMlUwMVdVMlJVVUZsR1IzcGpNR0poWWtoa2VGRkdWVnBo
      ZDNRemQwdFRVM1JYWkhZMmFtaHpiVTFpVVV4SFduQlZUWFZMTHpGQ0t3cHlObGgwVGtNeU1YbG1l
      RUprU25keVQzcE1NazlvY1dvdmNsUmtUV3cwTlc1S1p6RlRUVUowU1c5d1RWbHpNSFZMVEVKbVYw
      OXBNVmMxYnpkc2FXTTVDbmc0UnpZMU9IRTNPVVF4VWs1UVRHMVpVVTk2U1c1UGRERmlSV1pJWlhO
      T0wzWTJRbmR3VVZGVWVtNWpUMHRKY1djMmN6QTFiRkZ3U1hSU05YUTVRbGtLY1U0d1NHZEVURTV0
      VmtkVlluTmxOMWxNTm5adGFYRmpkalIzUWtwcmJ6QldUbUZHSzA0d1YwZEdUa1ZDYzFWdmJEZFlX
      bFZHUkhCdE9EVnNRbkJ0TlFwQ09HOUJRbWhYVmxGSVFXVm9kV1I0V0dsTGJ6TlhOelpYTUdNeVoz
      QXJhMVpKUTBzMGQzRk1hMGNyT1hST2RGWTBSM2RaYW5sNGIxaFJkVGcyTVV4NUNpdGlTbWRsVDNs
      S1lVRmxOMEU1ZUVoemMzQTBhRkZEZFRodmMzaG5ZMmRTTWpNeVFVVnVSa3BuVXpocFZUTnlaMkpp
      U3pkV01rZHZZMjF4Ym5Gb1ZYRUtObHBJVVdRNWJISmtUWEJSU1Vjd2MycHdaVGgzWVdNNU1EUmxj
      MUZTVms1NlJXUkVRV2N6V2tWMGNYcGlWVWd4T0dwUE9GTXdXSEJtWWtkV2NXOUhlZ3BqU1dKWFVG
      cHNWakZKYVdoSVRsZ3lWWHBOUmdvOWVtaFRPQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.send_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.send_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.send_redirects
        replace: '#net.ipv4.conf.all.send_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
      sysctl:
        name: net.ipv4.conf.all.send_redirects
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NHZjMUF2TWs1dFNFMW9OMEk0Wm5JeVFrWTFVRFpWV1RKMlluRUtOM0IxTVRoUFMxaERiSEJ1WXpW
      b05rWXZaemcyWld3MU1XSjFkVXcxY0c1Wk1UZEVhMDFXU2tKVkwxTjRNWEJOTWxWQ2FuUm9WRFI1
      V2xaV2QzUmxVZ3BTUWpWSVlqTjBNWFJKY1RSNVNtZGFTV0ZaYWtoWGNrRjVXRzVrUzFaYU0ybElM
      elJPYUdJemFHaEZZMHhTVkZFMFlUaDNVVFZrYkcxYVlqaDJSMFpYQ2tNclJVWnZWV2hpU1VoSU5H
      NWhjRTQwTTFZMlZWbG1kMnB3YWxGTE5qQjZZa0YxZDJKNWJYSkJkRmh2TWxNeVowbEtZM2M1SzIw
      d1ZqUmxjbTVQVlVZS09XWllTemxxU2tZeVNtcHhkbkJwVkZnNVUzVTRVamxrYTBoNlZVZElTVXhy
      Y1dsb2MyeFJWblExUWpZd1QyWklSbEUxVnpWQ0syUk5iM1ZzV2xaRk1RcFFla1ZIUjNRM2VFcHdX
      R0ZVZVU1c05UbDVha3cwVjNReU5WbGtNa05aVmxaS2NVNHhXRzVxTVhnclZ6RmpSbmQ0V2pOaE1U
      TlhkemxGUmpKVmVIZ3lDbkpxYldOeFRGcDFiV3g1VkhkemExSjRaV1JtVkhaYVNFVklkVGxCSzA5
      aVFrbHRjMUJ0YkVGQmFFdGFWbTFZTjFvME0yTjBlaXRvTDFBek5FZzBPV1VLTmpSMVJrTlZSSFps
      TVcxUk1UUk5MMlJzTldZdlMyRTNSVEZtYmxKVmVVZEtNVUpvWmtONFIxZFVUa2hYZFRCeVVFSnVM
      M0pYWlcxS2RHNVhjRzFDZWdwcWJFd3JWbVF5WmtSUWIwTk9lVmRJVWxabmIwRTJiRWxyYUhoVlEy
      bGhjMDFhUVVGSmFFcEJjelJFYm1ST1R5OXdWa0ZyTUdWV2RXcDBMMnhRVWxobENrdFBjV3RVWTJr
      dmNVTXlORWR3UjAxa2RXeGpaMjB4WlRCM00xSXJWR2t5SzJaR1JFaDFPV014Y1c5clNqZzNSV0pF
      VFc1bFlVcFZOemd2VTB0TGNUVUtWQ3N5V2xGV1MyMDBlbWhRVUVad1dXTXhNVlZ6Tm1Kck4yZHlO
      VWhHYmpOcmJ6Z3lVVGx1ZWt0SFRtSXhRWGxQV1ZSaFZFZHVUREI2T0haTFRsSlpUUXBKU0hJcmJY
      QjJjVmR1Y3pKdlZtWlRiRzVqZEFvOWIyMTViUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80919-4
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
        replace: '#net.ipv4.conf.default.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.accept_redirects is set
      sysctl:
        name: net.ipv4.conf.default.accept_redirects
        value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets By Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      dFNiMUFyZDFOWVIzZFZaams1VEZBMFQxTmlVRUZSWlhSWFZHTUtlWFZZT0VacE5FVTRZMUIxVW10
      VGFsaFdhMWRSUVhaMlFqSlNWVUpCTWpnd1prcDFRbTl0UXk5dk9FOWtOME5zUTNFek5WQlJWMjV0
      WkZjM2IycFFUUXB5UVV4MlRUaG9SV1o1VW05RmVDc3ZOSGw1TjFSalRIbFVkalJYT1dKd09XWk1T
      amsxU0VKT1pHSnRSelZKVVdaQmRuUktjVlZOVVZKRmMwUm9lVzlNQ2tabUszSnRXR0ZrYUdsbWVt
      VldNbXR3VTIxQk9XeFFLMWR2TDFwV1VqWkNjVGxNWWxKQ2VuZE5USE54U2t0T2FXRXpZV1ZYTlU1
      UVIzSnlXV2hvTTFNS00yeGlOVEZXUWpSbVMxY3JUMnhQTm1GMWVHNDJNVnB6WlVnMFFWRm1SV0Yx
      ZW1Kb1RYVmhjemRhZFU5ek1GcFpRMDVEUzBNemNqVXlNVE5TUVd3eVRRb3dZMW8zU1dodmJWTlFS
      bU5PUTBwVk9VOVdXR3ROYlZBeVZVbDJOR1IyZFdwcWJIa3pkWGxxVG1OSmJXeEpjR0l3Y2xSWU5Y
      Tk9RVVF2WVZSNGJXWlVDbGhGWmtSMVJFUk1jMlprTTA4M1JWbENRak5rZVZCRk5IRmFaV2RMWTBO
      TFV6VlpjRGRKYWpBMU4zbDJWSGRRZDBjeFZqWnJjR1k1VmtoUlltdDBaRFVLYlcxcVIwSlRRbTF0
      U1hrMVpra3llbWh4SzJwcU4xVnpXRFEyUmxCb1psUlVWbVkyVmtoRk5IZzFTM1EyVmpjNVVtc3da
      MUpwTUV0VFdFcEdVMVpzWndwT2RERkliaXRuYzJneGVXOXJSVzFDUTJSb1dVTlZTRXhsT1VodFUy
      bGpNVGcyYlZwWFpIcEhWM0JzUm1welVtRlZhM1ZoTkZKRE1FRk5LelpGVlZkMUNtSTBVbTVwUTBO
      M01EWlNjRzB2V0hodkwyOXZObXBWWWpOUGFIcGtTVWg2YTBWaU1Fb3JhMEpWWm5ncmRFdEZPV2hO
      YzJwSmVHWjNXaTl5U21Wc1RqUUtNRkYyUlU5dGVsZFdNbEpPZGswMFJGbE9ZVTFzVm14Uk4waGhi
      bVYyVEM5TVdGUnlVVnBDWjI1R04zbElVRnBWWkhSamRrOXVNR3AxYUVsUWEzZFpZd3B3TkZWVVZu
      RXlka1p3YlV4S2QyTjFjVU5sYUFvOWNEa3plUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80920-2
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
        replace: '#net.ipv4.conf.default.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.accept_source_route is set
      sysctl:
        name: net.ipv4.conf.default.accept_source_route
        value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_log_martians_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      ZHRORkF2YVhCSVZrMWlRV1pOY0ZaTWFtdGhhRUZsYURBellVOEtVMk5rUTNKRk1GRnNlV3AyVW5F
      MmFFUnBReXRLVEVKaWRISnFlR0ZDZEM5d1YzRkVORXBVTVRaU2J6bEthM2c1U2taS1kwSk9PV0ZE
      VkVKUGNGTktjZ3BDUVVSUFNYTlNhMjFwWjFvNVVYRlBWMHAwVUVkTWMwOW5SVUZ4TkdOblRHUkRN
      bk5FY0hWTFRqbHZUMjE0ZVdGTVdWRmtibmxYTmtKTVVsZEhZVWxwQ2xWbFdFeHpWRk5WYm1WV2Mw
      MHhOeTh6VW1ocFV6WXZhMGh3U0M5a2QySk1TbHB6TmxGclJ5c3JNMFpGU2tKVk9HSktRaXR0SzFS
      clVUTmxaMUJ0Y3pVS2IwUjZlWHBDV1dkdmNGWnVLelJyZWpSNVZ6SXpaakZUTWxob1prNXhUMnRL
      WjNwdU9HaFZXRFpGYUdoSWF6Vk9LMlU1ZEdkUE1uWXhiRmxVVEVwSFNncEZUM2N2UVVOTVkxcGha
      M0JLVDFVMVNEY3lSVVJvVUVKQlMwdHpZV1ZpY1dOU09UWkxRV3M1YjIwM1pHRkxlbVZuVGpKWmVF
      SktabmRZUmtNMmVGSnpDbXRTUzNSc2Jrb3dNbWxHWkZFeFkzTXdiR2RCUjAxRlJFSnVaRmN2WjA1
      RGFUWlRXSEY0TjJaQ2NYZ3pURWRYYWpaNVlVTkpRMFpuU0RnMlRGYzRhMmdLWWxoS1UzZzFjVU1y
      VTB4cE5uRmlhaXRqVHpKMmNHdHRValkxUkZZeWNWTk5hVVZDYVdReWFrUTNLM0pDUWtZM09EVlRk
      RGRrZDJVeFRFaE5iMGx2VVFwMGFWQktOMHd2VTAxUlJpOXdLeTk0TVdZMVJ6ZzJTbVZRYUV4c09F
      OVVkV3N5VDFCVFRVWlNUVlZ1TVdKVVZFZGplVTB3VG5kWmFXSlpVMGszVjBSUUNsUlZlRlEyTDBs
      aFpHWlNVakZWVUdSUGJFcFJLekZ2VEdKUVJXNTBhRU5TZW1KNVZUSkVWVzgzUVdOSGJtUkpMMVph
      UzBkWFFrMHlNelkxY0RsSU1Xa0tiazFzU1Vzd09WTlFjblZDWlU0eVVsWktZM3BYUjJrMFRYRlFh
      M3BrVm1OQll5OVFlWFZFYVdaRmFGbG9OamxEYzJFNVpsSllNVGRGVDNWcGRsVlpOUXB2U2xoaWRs
      TkZaVzl2YkhSdVdIQnRhazFPVmdvOVZuZ3pVQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81020-0
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.log_martians.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.log_martians from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.log_martians
        replace: '#net.ipv4.conf.default.log_martians'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.log_martians is set
      sysctl:
        name: net.ipv4.conf.default.log_martians
        value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Use Reverse Path Filtering by Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_rp_filter_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      TnVRVkF2VW1weloySlFjVUp4UVZCTFNYWnhhRUYxV0ZkeFFVY0tTWE40SzFoMllUTktRVTkzWVhW
      dGRFdDJMM0pLVGpoNVdIbEZWWGMwVDBoT05YY3lMMHQwZG1nMFduSnJVM0kzY20xYVdsRnNUSFZK
      WlRsTFpFRjRkZ3BLZFZNek9XcGFURkI2WkhGTVRsaG1iMXBuZFZJMlRrVXpaamhJV0hoRVNUUkhO
      SFJTVTJvMGVrOHdXRXRPWkhVMFJXbHlaMU0xUldkRVNXZzVkME5pQ204MlQyUXhaRzlwVEdFMUwy
      UnlVbkprYW5kTU1WRlhWekU1WlZkRFNWWkxSRUZ1WW10eEwxbERLMmhUWkZCbVIyYzFSVXRCTWpC
      cVRXTjJiRTFpVEc0S1l6Qm5WM2RaTDBaMVJrTTBiU3N3U204eU1WVk1jREEyU1ZZM2FXVkNNV1Z5
      ZFZsblpsUXpkMmxMVUhFck5GbHJSRUkxYW5OR1EyUkxSMGRuTjBObFRncE1hbHBxS3pCWllrWkpl
      QzkwWm1WMlRtRklkVXhSVlhVM00wOUpWM2hxTjFaMWNGSjBkSEJCVUhCc2EwWktNVlJ0YmxSeVVF
      dG9hMDVZWlRsRVRVMXJDbFE1U0dwTGNTOXdka1E1VkcwdlQzcDNiR1JuVFRsdmFGSkpMMGRoVGtz
      MFpWTkJVakZyZFhaeFdYSkdhMFpYWmtNM1MwVmhOaXRKTlV4UVZIVTFablFLY25reVIyaHRkbGgw
      ZEN0UEt6UTVVelZETkZZclREQjVPVW8wZDIwMFNpOXBZVGREYzNCWU9YRkhlRTh4V1dreVQzaHdj
      M2RJSzJ0NVZEWmxWMlJxVUFvclltcDNXbVJVU0hoaFFtRnFkWGRXTUhSYVdqWmxSa0pUVTJnME9F
      RklVbk5CWXpCc1ZYTlNiWG81VWxWNlREVjFRM0ZaVVRkNFdUbGFOMWNyV2taNENqUmtNa0ZHYkV4
      eFJFVlZRalZ2UzBVM1dEQTJObUo1VVdkSVpsbFFWbk5zWjNFelJIQTNSVkpYZVhGaWNGTnBOU3RO
      Y1RWcFEycFpkVXRVY1ZsaVpUSUtiMkY0V0RGUmRXVTBhbTR5VEROR2JqWm5SM2wyVUhaNGNtVlhU
      elZIUm1Gd1RHNVNSV2xKT1RKM1FYSTNabGR5VVd0VE1UTlhiRFZxYVhCbmRTdFRaUXB1UjBRM01r
      OTNRVkJsUWtGS2VubGlNSFJYTWdvOVJVczFlZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81022-6
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.rp_filter.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.rp_filter from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.rp_filter
        replace: '#net.ipv4.conf.default.rp_filter'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
      sysctl:
        name: net.ipv4.conf.default.rp_filter
        value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Configure Kernel Parameter for Accepting Secure Redirects By Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Configure Kernel Parameter for Accepting Secure Redirects By Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_secure_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      QkNNRkF2TWxORFNHRTNPRGRvVG1SVWNXWlZNa1F3VHpKRFNUQUtVbUpRZW0wMGFISk1ZVlo2VTJ0
      Rk1rUldlbUY1YUZkWmVqTlFTVnBoZWpkbVNtdEJPRXMzVUVzMFQzcGFlR1YxV0V4aWVtWjVNakpx
      ZG5OdWVWUklNZ3BYSzNFMFNqVXdTMHgzWWxCdmFVTm5jR0ZLVWxWdFFVdHRTa2R2UVhWTksxQnFV
      SGN3YjJWeGJFOWlhRlJuUmxWTlpGZEdVaTlaTmt0RFpGYzJSaTlqQ25CamJ6aFdabTlUVGs5cGVr
      aGtOM2xGZVV4bWRVSkxhWEpCVjFGM2VVOU5VVFpvV1doSmVHeFVaMkpuYVd0RllpdEJhbWxpTTI1
      eVkxZDNZaTgyV0dvS2FuUTFSVWN5VkZKNE5URmFXVkozVFZObFRtZ3llbWRNV1c5Rk4yWktkQ3RT
      UVhZMlVIRXhRM2t5YTFseGJHdHhhVUYwUVhGTU1XMXZaRWgyTnpkcmR3cEhOMXBqYXpCeFZYbFFV
      VmxxZGxGRmMwdEJTRGRIVVVSVGJFcEdla2QxTWpoU1JUa3lWRm9yUms5VlZXZFlTVVkzTkV0Nk0z
      Qk5VWFJSVERWNFpHNVNDbkJhVTNoUWQwODVUMVk1VkZsaFdqQlBjMWsyYTFwSVUxUXpUMFJpVDFK
      NWJWSkhRMGd6Tkd3MVFWQmhNWEIxTjFCdWFrNVZWVXAxT1Rkek1ubHphRTRLWlU1c1ZHa3hUU3RF
      ZHpCaVF6WlRVVGxCVTNkUFNra3hUWFY2YVU5UWREWjRhREZ5YVc5UU4yTktkakJWZFhaWU1GQTJh
      R3RIVG1sdFRqVm1jRzlQU2dwaU0ydFRaR2RwVHpCTGNEaHllSFpHWVdGeFdXaE9jSEp5VEhOWlVD
      dFpTUzlQTVN0c1FYVTRibTluYXlzelUwZGthWGhNTVdKcWRFbGlMMEpJV1ZoRUNrbFRUbVJWV0RW
      WGVqbExVMmxqY2swM1RrNHhPRVZ3UjJ3MVlVTTRMMlkzY2xSc01UQk5lVzlPTWpab2RrZEJiRkZv
      WmxZeVZXdFFkak5SYlZFelREY0tMM2RWYkROaWFISkdaemhDY0hoUVkxWkNTWFJxUjNoVloyWXdP
      Q3RyV1ZoUVRFMVZaMlpwVGxZeWREQlZaVGRKV2psUVIzcDFTMDR3U1N0aGQxSkdOd28zTUhGTEsx
      WTVNSHBoTm5ac1dqQlFNakpQVFFvOU5HOVVaUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81017-6
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.secure_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.secure_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.secure_redirects
        replace: '#net.ipv4.conf.default.secure_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
      sysctl:
        name: net.ipv4.conf.default.secure_redirects
        value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-80921-0
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      aHRjMUF2TTB0TGMzaGxkbmxDVGxSQlR6UmpLemhZUm5OVE5rVUtjWFJPWjJKRFNUWnBNWEoyVFc5
      d1V6SnpTRVZ6U2xoTWEyUklTbHBXUzFBMWNXeEJWbnBNYnpOdUszVlVla3ByWlVweE5ERnNhVmhT
      WkdSdlNVOXBZUXB3VUM5TlZtdE5SRTVRYURKNVRsUnNjMFZ3ZEZWdGFFWlJOMnhIWWtGYVRVcGFj
      Uzk1VVZRd0wyNXRXVTB2YmpSUU1YaGpXRkJGUjB4c1VDOWhXVVZaQ21rNVlrTmhlQzlqTDNSVVVH
      eERaREE1UjAxcVFsVnFhVXczWkZkc09EZGtUVmh6Y1VNeVkyWlJUMkZpVTNOT2VFaFZRMFo1Y1VO
      dk0zbFNPRTFTWjJrS1ZWRnNkamRWUlhkU1ZITTFPWGw2TDB4NVEzRkhPWGg1SzAxS2FWZzNOVkpC
      TjNabVVsaFBUbUpXWTNCdU1rSXJVbTF1T0d4Wk1TdFdjMUpxVUdOV1RRcFJkRXRCVUdvMGNYRlpk
      MEZRYm1SVmRIaGhaMjlUYUVKWlFqTjZheXRoV25FemNtNUpURGR5TldsNlIxRnBOVkl4VjJvemNT
      OWtkek5GYkVsRGEyVkdDbWxMZGxnelpsSlNkMUY0Y0VOblpVUlRWbTFQWlZSU1pEaDBkems1TWtO
      SmVrYzFNVFJCU1dOVVF6bE1ibW8xT0hkQ1N6RnZOMDVISzFkemNqQXJiakVLYzJwbFVIQm1lR2xC
      Y1RSU1F6TTNObEo2Wm5oTGNtcHVhbEZxVTIxb2NuSXdiakpXV1ZKaVJ6VktObFZPZDFkV01WWjVi
      RU14WkdKM1UzUndTeXRVZVFwTFRFcG5hV2R1ZG5WNWVFcHhPRlpoYW1sUlptOTZTMDVXTUd4cVpr
      cEZUR2hrUjFCek9TOWlUMDFTV1ZaemNGcE1iRmN2YURVMFEydExSRmxpUml0NkNtdHpVblpqTjNw
      dGFTOUNhakJLVnpsRlprVk9PRUZzVTJ3M2FGQkhjVWN5Ym5KMmNXVjZPVE5RTTNGbE1WbFphMVJh
      WmxVdlJEUlpNU3Q2Wm1scmVHa0tUak4zUXpsdVowdDZOa1pUTjJOSFJYcE5Mekp5U0Uxd1lVaEZh
      bFpyTVRoVU1EWkhabFpKY1RKM2VHRnpOMGRHVFVwTmJHUXJhR1I1WVZreFFUbHVSUXBVVEM4emIz
      aFFSMHR2WVhoSkwxcFdUVmhKUndvOVZHMTFOd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.send_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.send_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.send_redirects
        replace: '#net.ipv4.conf.default.send_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
      sysctl:
        name: net.ipv4.conf.default.send_redirects
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      SnpNRkF2VWpFeU1rOUphVzVFVjBjeFN6VmtNR3hFV0VGemJtMEtOVGhuT1hwcVFUaDBVVEpuVkhk
      NVkyYzVSR1J0Y1hWS1UzazJNbnBJV25aUFlYaFlZMUZvVm05WFJIaHFOMHB4YldwcU1raG9aVUZY
      WkVaQ1JISnhaUXAyYkd4bVlVcHBia1F3SzAxSE5DdG5PVXN6WTFWS1FtaEZSblk1Wm5sSksyVlVW
      Mnh3UmtoT1dHbGxVMVZvV0hsbVZXbEhTVkI0YzFJeVkyVkZOV05rQ21KYWFHcFVTME4xU1RWTmFX
      TjVVVFZZZW1SYVltSllWbVFySzB0Mk4wSlRaSHBJY0VZd2EwZHNSbEpqVFU4eGJUWlpTMHBGV0RO
      YVMwdFJMelJFVFVNS1JEUTJLMDlLUzNWSmFFMUhjeTkwVDIwelVFSnBRM1ZzVWxVMU5rRlZkRzla
      VDFaVVNYZ3dhVEpyUVVoSFIwcEVPSGRoV0c5NlJrbGpXbkZSZUVOM1Z3cEVRekZ6TVZaUVJsSjJT
      VFZSTW5Wc2NsbEZjMnhxZFcxTFl6QjRkbmRZWW5rNWJEUTJjM0ZHYUVORGNHVkJVMDF0UWpsalRt
      eFRObU5pY1RWUk1rMXFDa2x3VTB4SFRGTTBPVmRqVUVSU1ZTOUhiR2RLU21sRmVFWTJSMFF6WkdG
      bVRFZFdia0pHU0ZCaFZtNDVOVE5FY2psNlJUQTVkVmdyUzB0MGNHaEZSV0lLU0c5NllXUm9UVGd3
      WkZkNE5Fa3libTVIYjJoMVVXaHdPRkZ1T1d4SFdFcG5abnBVUlVjdkwyOUdOazVKZDBKMWJFWjZW
      RXhTTkU1d05IbHVXVWd3U3dvNWRYSTJURmt2TldndmNtZFFNSEpVYkVzeU9YZE9kMGhZUnpaNFIy
      ZDJXVlpQZVRobFJqSkZNM2N2Y21odGNFdEtSMDlrWWs4dk5tb3lURmRKVlRCbUNtVmpNbGx0Um1o
      dlRGTk9hR3BRV0U4NWRtWkliV1VyTVc5SmVuZE1TbTV6UTJ4dFdEQldRVkpuYVZKQmFHUmpMM0Z5
      YzBkQk1qQnlVQzhyVTFSelZHSUtSRTVETTJjMmRtVkdaRkZYU1ZWT1EwTkdSM29yYlhSUWFrVkxZ
      bGhuZVRCRFpVdDNjRTVtTm5KcFpXTmhZVXBEU0Zsdk5WQlFLMVJvVGxoTWFtMUVjUXAwVWtoNVZH
      RXpVRUYwU1ZVMlRsVlRNelZ3Y0FvOUwxTk5WUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80922-8
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
        replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
      sysctl:
        name: net.ipv4.icmp_echo_ignore_broadcasts
        value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VjRPRkZCU2sxNlVrOU1URTVyYUdKWVMxTlhhWE5YT1ZWUVVuUUtaemRWYUdSV1ZUWnRUSEpzZDBj
      MVNEWk9ZakExTWtsNE5HbFRjVGhzVW1nNE5GTk9ZVlJ0TW1aRk4zcEJNRlZ6VjFOVlFtcE9PRTkw
      VFhadlNYSnVZZ3AyZWpRelkyY3ZWV0pLUTA5aUwxQXpZMjU1Y1RFM1lrMVBSRVZWZHpJNGFWTXZj
      MDQyUTFSV0x6aDJiMUZtYzBndlMyRXdRVkpwTVdKcFl6ZzJjRGsxQ2tWdFMxQXliSGgwU0RkSFRI
      SXljWGxHYTIxRWVDOVFOalZqUXpKc1RVcEZZVEJJYlhKYWMzaExRVXhuU1dWQlZEbFBjR0pRTjI1
      dlMzZE9XSGhyV25NS1lWTm1SMjVRUmprd2JsZzFhVEJSVERBeFdpOXFaa2xwTkhJek9ITjVZa3RR
      Ylc5UmIzUkZNMkZ3ZW14T1NVaG5NRUZUV0U1ME15dHBNMDVLWTFkb1NBcFlaR3NyTHpsMmRGaE5k
      MXBzYW1Od1ozb3dUVVJ1VFV0WkwwdGpRVnBtVTNsWVZVOXpjamwyVjBrck9ERTJabVY0Y0c5VFJX
      NVllVGQ0T0VadFRFVTBDazgyTW5Nd01uUnpWbU55Y2poQ1dWb3dRVWhDTTJsWmRqQkZaMVJ1YkVZ
      NVQzTmxNMDF1YUhSTmMzbFdUamczWWxkVU5DOUVOVmt3YzBGc2IyVnhkMVFLVkZKclNUUk9WV00w
      ZDNoQlVEUjFXbmx6TjIxR1VrOVFSV0pYZGpNMk5FcEpTbTVQZGs4eVZVeGxkbTlxVlRGS1J6SkhT
      a2xxU0VwMFNtMDJObmxZTUFwbmIxQXZiRTVuVTB0TVQyd3paMnA1WlZKUGEwSkVWRWtyU1dGTGQy
      Rk5RMFZoYVRaSGRYQnFVbGhxYlVGMFVHSldNRWxhWkc1eFRFNW9Obkl5Y2k4ekNuZzBiV3BHVmtJ
      dk5Fa3lZekZZTm14b1ZFbHRRMk16ZWtSM0szZGFVREZOTlZsbGRGcEZjaXR4WTJ0NE9YaHFkMlkz
      Um1WclIyTjZUekp4SzA5UlZGTUtXSEJpTkRsUWF6ZDJOeXRuTVN0a1V6UkpNRFJtV21wWVZrZDRN
      V1JRUTJsNWVVTlZWR1JvT1VKQ1FuSm5VVWhpWW01bmMyODFhRGMxTUhVNGNGbG1UQXByT1ZGMGJr
      aDBSV0p2Y2xFeVFUUnVjemw0YWdvOWExQlFPQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81023-4
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses
        replace: '#net.ipv4.icmp_ignore_bogus_error_responses'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
      sysctl:
        name: net.ipv4.icmp_ignore_bogus_error_responses
        value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-81024-2
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.3.1
    - PCI-DSS-Req-1.3.2
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      aERVVkF2TWxoa2JWb3hXU3RRZERnclJrbG5iMHBST1ZWeE1Ua0tXalZLYlhCeldHdHRiVTlIUmta
      UE1tMWhiSGhSWWpST1pHZ3lZaXRrYUc0dmRFZzJTV2QxTVdSSVNUUXpNUzlSZDBoMWJuSTBaa2xQ
      U2paTVkwSlRNZ3BuV21wMGQzVlJlWE4yWVVKS1QwRXpWa292WTJKcWFrWkhSWFZxTldKeU1XZ3hU
      bTFZWlRGNk5HTnBWRzVRUzJ4dFdURnZkVlpMYjBsbVJsaEdkVXB6Q2tkdGNYSjRkbTVrVGtSM1NF
      bFFXVzVOVXk5bmQydGpaSFozVjFod05XUnVjbEJUTDNoRVlYZE9PVGRxZUdVNVZXZDBWM0J3TTA5
      NlJqQk1Oek5KV0VFS1JtZExaa3hyWTNCdVUwSXhiVXN2UmxWa00wOVNXbWRXZFdReFIzTlFhWFpw
      VlhGdGMxVXpTalJXWlZSNlZXOTRTbWh5TWsxRFdtbzNUWHBaTjBRNGJncDJXVWhsSzBORFlYaFpi
      bEpzTUdoMFdWaEJVSEZxTkZFdk1rTnZTbTF1UkhGdE5VNWpWbkV6ZFN0eE5ERmtXVGxuUW5VNGFX
      UnRlSHBDVXpsU1dsQTVDbWgxVnpoRWIxWnBVbU5LVFRoclJrdExRbFI1VVhoRVRIaG9SR3g1T0d0
      TlpUaFBkWGR2VVhVdmNtWmxOVkJoV2xSMWQzUjNSbXRRVmtSTFkwa3JRV3dLVlZoMWEybFVhVzFz
      U1RaMVJXWTNSVVJUV2xKSk5HTlRNVlkzZEZGWVJ6QmtSVzFLUnpjNGMwVklSM1FyU2pWdlRVUXlW
      R1k0T1dsRWVuTk9ZVE14Y2dwV09FWkJObEJ3UkhaSmQwdG1WV1I0Umt4dFlVaDNlRTV6ZDNCdVN6
      QmhVVEJ2YlRkWWFTdG1UVGhSTHl0VGNtbGhLMDlUVG0xcWVVMVhTVEkzTXpsaUNpOWFVa293Y0RK
      RWJtMU1aaTkzUTFoWVZIQm9iSGQ1VVU1TGJXRldjV2MyWW5CR1VqVXJPRzE2U2xwdlR6SnRTRXRD
      VkRkUWJqQXlTRkpwUjFGR01rMEtlazB6TVhoNFZGTjNUbTVpVERoM1JIRlhkMVZ6SzNNeVprWnRS
      VTAxZHpWRFZtNDFWRlpRVGxCdE9FdE5Zbmd2TUd3eVUzcDZWVUZzVUZCSldGZE9OQXAwUlRkcVZs
      SjVTekpwZVZvMVJqbERUazVFTXdvOU5qTkROQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.ip_forward.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.ip_forward from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.ip_forward
        replace: '#net.ipv4.ip_forward'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.ip_forward is set to 0
      sysctl:
        name: net.ipv4.ip_forward
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Enable Kernel Parameter to Use TCP Syncookies
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_tcp_syncookies_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      UlNNRkF2YVhGck4xUnNSblJhU1RWNFF5OXZabEo1U1VsaWRuTUtXR1UwZEM5M2R6bENZbGhETDNs
      T1dVMHpabVYwUkdOcU5UTk5WVTVvWlZkRVlrdFBPVk5TV25kNWExTk1WVGhRV1RCUGVtZG5NQ3RF
      UWpWMk5teG5TZ296V1hsbFdUY3pWVll4SzFjeVIwSnVOalkzYzBGTVVWQm1kemxpTmxKVFJ6TjRj
      V0ZMTlZWWFQycHdTalJFYTA1UVQwMXhZWEJwYjAxQldWSlVNMUZLQ2xGdGFVOVlRbEp6SzIwelZG
      aE1NVlY1ZFROQmJUUlpOVXhKYmpSVWNVMHhSR05HTjBGc2JsUXpWSFE1ZUZGS1VTOXdTbUprTDFG
      clZrWlNZMDQwTVZZS1RtWjRjRTAyTDNkcFRXMUxhVEJ0YVhselpGSkpaRFJ5SzFKTVZEUXlSQ3Q1
      TTJGSFdFeHVlbVpoYzFRd05HOTNTM3BhTVROTlVscDNWbkpLZEcxeVF3cDNLMHBGTTJ0WU5ESXZN
      Mk5WV0dGUFoyZFFTVEVyU0hoUWExbzNXWGhqVFcxSlRXRlFSMjV0TTJSUlpsWTRjRGt3T0U1S1Mw
      RkhPRGsxTmtKd2RpczVDalJTYlM5alVERkVUV1ZPTDBkcVVtNXpMMnhLWVU5R1kzaENjbThyZDI0
      eVZtRkRPVWQwTUdkVUwzUnpTVFpyTDJGaVNWQktTMVZhTTFBMFVsZ3dkMlFLY1hNcmExbHlkMlUz
      VkdKd2JHeHFibVZpY1RGRE9UWmlZMDVqTW5SVGJqUjNiVUpKV0ZWVFlVTlpaekptTXpKMFIwSjVT
      Mk5hWjJ0WWIxRTBkVzUwVlFwbFNIVjJiVzVyTVRoMWJXUklhM0JrVlVselpUQmxaMkkxVjFoWk9G
      b3JZVEoyYVhGUFpsVlFRMjVzVEVsallVWlRUREJ2SzA5cFJVdFRaMlpaVTJkb0NsQmtLM2M0Ylds
      WVdXVktlbXRYUjJwYVYwTmpMMDVHT1V4UVZWaG9TMHBRYW5GM1RXdFlRamxoTkZoeWIyZzBkSFpS
      VlROaVZFSldkV0pQYTBrd1ZsUUtaMlpZUTJZdmEwZDZaVmxNYjJGSmRYSlhSRkZMVDBOMVVtZFhW
      bmxoU25sWE56aEpPRXMyY1ZSaVNIVjRjWGxrTlhaRmEyaFdRMGRqVlhaRGJGRTVPQXBuUzAxUldW
      aDZhVmh0TURGeGNWZDBWalpOZGdvOVpsZ3hUUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-80923-6
    - CJIS-5.10.1.1
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - PCI-DSS-Req-1.4.1
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.tcp_syncookies.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.tcp_syncookies from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.tcp_syncookies
        replace: '#net.ipv4.tcp_syncookies'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.tcp_syncookies is set
      sysctl:
        name: net.ipv4.tcp_syncookies
        value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Configure Accepting Router Advertisements on All IPv6 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Configure Accepting Router Advertisements on All IPv6 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_ra_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ZzJSVkF2TXprdkwwcGhhRzFGYkRsQ1dIWXJjM1UxZERkTVNUZ0tXRkJTWmtab1FXUkVWbFowYzBZ
      MEwzTjNiMng1YlRsek4yZG9SV0oxUzFoTldEWnpVRWxOU3psUE1rRjBVamw1YkVSelUwaHlUMFpV
      VUZnMlF6WmxWd3BNVkhVelJqWklVR3hOU1RCUWRWazFiMlo0U0hOUVUyZDVUVEozUVVsSWREUjJh
      RXBUTTBodVVYaFBNRzVUYjI1SmFFZHJLMVo1YzJwaE1XbGlTRXMyQ2psSmJrRnBka3RLVWxKM1VE
      aEdhV3REVTJkUVl6aEhZMkk0UVhOSldrNTRiMGx1TlhSVVEzbENabmh3TVN0VFFsbHJiMHRJZUVO
      aFRGZFFiMVJWU0djS1NsQXdVMUZ4VWs1UFEyaFZVV3BTYlVkNmJWQjZaa1J1WkZNNWRUbGhOemQz
      TnprMFJ5dFNabGRJT1dnNVRUaElhV0Z6UjNkTmJFMDNWa0ZOUldOUU5ncDJVMVZSV25GdE1XNU1U
      MjVNZG05TlEyWmFObVIwWWtWa2NXaHRTVmQ1YUVwRFZqaHpTWFJwTlRGS1ZWVk1kVzEzWWxWeWRG
      ZDBlVkp4UjFBMFFrcFFDbVZZTjA0M1MzYzNhMGxDVlRKb01WazRVREE0U0ZORU1tMXVOMmx2TUhC
      c2RIWlJhR2t2ZHpWUGVrRk5NbFYxY2xGQlVGWktkWE56TkV0SmVWTk1ZMW9LWkZneFpGWmlWV281
      ZGxaWWRVNTZhREJKYTNnNVFXaDVRbkpVZFU1MmNFeFllSFkwTTNaWE9GWnJaakY0TjJORGNucDNi
      alZwU21sYVRGVTFWMlIwTWdwYWVFd3ZaWEJLVG05bE1uQjJjbkpEWlZZMldtSkJVR2g0TUVWRE4z
      UXdOMVUzYkc5VWFqTkpjQzlFV1RkeGJIaFFUbHBUVERRNFZtTnFTRFpHWlRSekNsRXlhVFJPY2tk
      RmQwWnhUMlJqWldVMVkwUjRTRkpJTTFkTGVXUlNVVzl1VmpkdFZWWmpiV1IzVUc1WFkxTmthRFpy
      WlhGNWMwbGhhSGhIY2tnclUyb0tRWFZFVXpGRGFuWkhVVkZ4T0VaUVJEVTFURTVuYjJWVlRscGxR
      amx2VjBNNWFrdHZRMjF2YXpsQ2JtNXNjVWhFYjJ4R1NGb3dLMlpxYjNkTmJFVlFWZ294WTFKNlow
      RTBlWEF5ZFV4NUx6WlFkR3MzWXdvOVVWcE5WQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81006-9
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_ra.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_ra from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_ra
        replace: '#net.ipv6.conf.all.accept_ra'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_ra is set
      sysctl:
        name: net.ipv6.conf.all.accept_ra
        value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Accepting ICMP Redirects for All IPv6 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      dHRUVkF2YW00M1UxbFdRM2MxUml0U0szWllXbnAwVVVOTFlYSUtNbGRFUzNJNEsyaExaSGhzTjBa
      Sk0zSXpLek51UzNaYU16WXhNVWxxTXpKaU1rSnhWbGhTVjNSVlVHUTVOVVUyUkRGd0wycEtjV2hR
      UlN0c2JXWk9RUXBOU1doSlpEQktRMGxyYTBoelYzQnpkMlZZV0ZJMmN6UkpWM0pNVGpnelUyNUlU
      MnRUWTFkb056aGFXa2xaZDNCQ1FXZE1aMWd5T1VKS2IzRXdjR2RLQ2poTVpVRmxWMDVFU1VKVWNq
      ZFBNWE16VjFkd1ZIbHdhbVpoVW1ZMmFtcHpNRlZQU2twMWVHNDFia2ROUzJsdGFXcG1VRVp2ZGtn
      elptTTVjRVZ4WVhZS1R5OVpWRmhITnpNNEsxWkVOVFJCZVZFeGNXZEtjRUZUZEhjMVNWSXJRbVZW
      S3l0blJVOVRjbUpNUVhKWVREaFlOaTlLZGtWV2FVbFFlVUpNVm1KamVRcFFWR05yTlhsVmFETnVh
      a2xpWkdoT2RUVkRVWGMySzNWMVZUQklURFJvYTJWdVMwWlBkMlZzVUVGdVN6TlJTSGN3TlROMFJV
      OXZXa2RFTUVGS1pWUkNDbVZIVkc4eGNWZHVMMGxyTW1GNGVWbHNlVGhMYkV0cFVUWkNVMHA1WlZO
      T1RscGlOVmRJVEd4SlVEQmpWek5QVmpBd2F6WjNNM0J0UTFVM1RuaFlLMU1LTVN0bEswZEdXRXRJ
      UTJFNWNDOVBZWFpvTUZKNGVuUk1abU5GTjJzclpEZDRibEZ2Y2pBeWNXOVRibTVqY0ZOeWMyMVlO
      VWw0VldWRldXTmpTRlJwZEFwVlFrZG5OR1kxZGpSSVdubDBVRzh5WkZOVWVVVlhkWEJzVFcwMVMz
      RllhRkpQVm13M2NsSjRiVzVIU0V4VFowOXNNbkpYUkdoVGRDdEdTRkJSYVV0M0NqQjJUbkJJTTJk
      VFpEUk1aR0ZDWkVkVlpqQkxXbWN6UlhCc2JVVXZjV2h3TDFaQ2RVcEhWR1JST0doTldqVmFZVkV4
      UldSM04waHpjRTV1TkV4MWJqUUtTbVZUTTIwM1NtbDJaR3BMYURkWk9WVkRhakJqUkdnd09VSTBa
      MDlxSzNscVFrNU5hMGhLYjJOSlNFeHVWazh2ZVhoS01qUk1aR2xEY2tsblFXUmlRUXBZYlRoclZG
      cHNNSFJ4ZGtsNVlsTjFRamhGTUFvOVVVb3paUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81009-3
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
        replace: '#net.ipv6.conf.all.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_redirects is set
      sysctl:
        name: net.ipv6.conf.all.accept_redirects
        value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      azJjMUF2TUdsd2RHWkZiMGx2YUhVd1psVjZSamxSWTBWaU0xTUtjVTR6YW5GVGVEVnpjWGRPWW0x
      RFYzbzBjRFJ5TlRST1YybHdiazVaU2tOblNYWTJMMnR4WTJ4UFdXOWpUbVZrYWtnekx6aExXRGxT
      WjBoalVrcG1XUXAwTmpoT1owNXpZVzUyTDBSdGRXeFVZa1IwVUZaS1duWlVUVkU1T1UxUk0weHdh
      U3R5WTNKR2IxaHBaVXhqWjNGaU9HcFZhVFY1UVU5WGFUbFlOWHBLQ2sxMmRsSk9XQ3N3ZDBwT1dp
      c3JSV3R3Y0RsdlptdG1Sa3hMVG13eWFrdHJNM2w1UVZaeGFVTm1hMGx3UkV4a2RWZDRPSHByV2l0
      UWMxUkVlbUZSTmpjS2JXMDBSemRMYjNOV1dUVlBWRUpQZFc1YUwzSkpiVXBHZFUxUVVHRm9ZVWcz
      Um5oek1XOWlZV3hvZFU1alRsbzRWVGgyVm5KTGREZDJNVWxCYnpOQmFBcHpOU3R2UzIxeFowZGtS
      RkJ4WXpsdUsxTmxWM1ZOTTBjMVZVZGxhM0ZDY21GVlJWcDVORUp2TkdwaFlUVkRlVXMyVTBoSFdV
      aDBNVk5UTVZSU1ZWaG9Da05sVVVGeVVTOUJVa3RIUW5WTVNWbFZXamxzVEVabmQzRjNVR2xqZUZv
      eWRuUmljak41YWpSbFVGWkZkMVZwVDA5WFNHa3pXbnAwYzNOcFkzaDFka1FLYzJvelJHNHlXazhy
      YzBOU05HNW9XRWh5V2xkV1dIRnBSakJCV2xWSGRqTjVlRTV1TjBOcGFHUlpkRVoyT0hkYWNuWTNk
      MUowSzBKclptMUlaR1o2TXdwaVp6WmphVUk0U25OTWNHbE1Oa28yZEhnNVltMUxPSGQzT1RoeGJX
      SXpNelJZZVc0NWNFTmxRWGR4TWxONFVGWmtWRVlyY25OQlpHVnZSa1JJU1ZaUkNqaGhMM1pXV2l0
      M2VXdGhkSGN6WnpGeVlXc3ZiMEU1UlZZNVFuZHJkMVZqUW1Jck5GTnhRbEJETkZaemFrMWxUbEpY
      Ynl0R2NuZ3hVbWhDYXk4elpESUtlRzE1VXpSQlIxRjJPRkpDYldNekt5OU9lalkxUTI1SVVEUjJO
      RkZ1V2pOV1NWaERSR056Vm1GdVMxaGhObU5rVDA1RWJVMW1TbFJ4VFdsR2JFNU1hZ3BOUlhVdlNF
      YzNZVE5pWlV4M1EzSkZka1JqVlFvOVJsWlJNd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81013-5
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
        replace: '#net.ipv6.conf.all.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_source_route is set
      sysctl:
        name: net.ipv6.conf.all.accept_source_route
        value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for IPv6 Forwarding
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for IPv6 Forwarding
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_forwarding_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      cDJVVkZCU2t4cVYybE9VRXdyVVhFMk4ydEVTblYxTkZwMWRYa0tXR2hTY1RsQ2NEbDJWa2xuTjJ0
      RWRXdFZkMWwwWlRCeVZYRndiMmxoTm5sMWRFVlhjV3B5VTNKb1VTOU1iV05zU1dRMGNqbDFTVlZu
      WVRWdlEyZFBaQXBQV0ZkT01Fa3ZSMkZEZEdoV1YwNU1XSEZvU0hNMFpVeGliRkJJUkhJdlJsQkVX
      RTlOVldwTVUyVkNiSEEzTDFaMU4ydE5OR0ZXZGxSMmJFY3daVTVZQ2xWbU1YQkdiMUJSUTFOb1JT
      OTNZazlNUVRSeGVXMXlUM0p0TDFwTGFVZzJka2RWUkhFeWEyUnRiMFpuVEc0cmF6SXdNUzlzUmtk
      VlpEZHVUMGhKVEVFS1kzSndkbnBFWkVWd1NqVkJORWhOYUVKeFNYTkdVMUpsTTNkWFNVd3JXREpL
      ZDJOaWFuRjRjVmhUVldKdWRtaG5lbGg2ZFM5VmJFWXdjbWdyWVVkNVFncHBRbFVyU25aTlpXcFJO
      MGRuU0hGb1JEQlFaV3h3ZUhSUlEza3hhV2dyVFdoNWFrOWhkbnByVUZwUFRETjBkMkZWYWpkS1ZE
      aHdha1Z2VkdOck4wMVdDa1JYWkdoaE5YQlBlRVZpVlVSM2J6RkZURU5aYUM4d1MxQm5WWEZXVkU1
      b1pqTlhhMDlLVG5sdVQyMUlkRTFJWlhONVFYZFRTbGhaUnpjeFYzTmhlbW9LTHpSUWJua3hNSGhI
      ZGxsdVQycHZPVWhKYlZoSFRHUlBlV0ZCUzA5UlVsbGtNakZvTURkVU1GQnFLMUE1VnpVMGJXYzNN
      bEZSWTNONmFXbHdWVmRyVlFwUGRUSm9SRGhGYVVSSk4yaDZkREk1UW1aYVRuQXdXWGRoZHpKbE1Y
      WktWRTl4YUZsdWJpOVdMMjlJUVhGdlEyWmpUazFQY21ZMVNtUXdkbWxLWm05bkNuWkhRWEp2TWtw
      MU1VUldVamhGTDIwdldqWm9TM2R6WTJOM2JWZGthMHRWY0VGVVJYaDJVWGcyYURjMFNYTkJOSEYz
      VEhKVFVuVTVUbE50TDFWNE1YTUtOM1pZZVdWT2FGWmFhWGQ0UjJGa2FHMU1hRVZZVTJadU9DdEdj
      MUYyVUZweFQzazJhMVoxU2t0WFJIa3dkM1F5T0doVU4ydzNVVmhNYmprelkxcDFTQXBMTjBKcmNt
      Y3JVbVJFWjI4eWFtWkdlbVJOZVFvOVRHaFdWUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-82863-2
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.forwarding.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.forwarding from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.forwarding
        replace: '#net.ipv6.conf.all.forwarding'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.forwarding is set
      sysctl:
        name: net.ipv6.conf.all.forwarding
        value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_ra_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      SlRXVkF2TUdKc09Fc3hOelEwU1dkRmFVZGFRU3Q2VTAxNFRqRUtVM05QUlhWRmRXNDFSWFJKZFZs
      TVdtbHJXWEk0VmtWUWFHazNSVEUxUlRsdVQwRlhVeTlvYm5scU5DdFpaVEI1TVhkUFRtczViRmxw
      UVRGalVqTmhXUXBxTjBsNlVFWnFZeko2YTB0c1owcHhkWFpxZEVoSlIyZHlhRFkwY2xVNFJsTjFi
      R3d6ZUhwNGVreHFZVTlvZEVNek5IVlhhVzh2VDFWMFZ6WnpjamRNQ25VMFRWUjFjUzgyY1hKa2Rr
      SlRaWEJJWVVGdWF6UTVhbFpXUWs5aFNrUmpMMFZ3U1RSaFF6azRXV2wzYldsMFRETjZOVVY1WTJG
      eWJXaHNkbnBMVWpZS2VtRkpRa1ptVEVkdVlYcENkVXRxVWtJeVFuTTFSM0IyTTNSTFZISktSSEpz
      UW5GSFdrVnJlRzV2YXpnMGJXNVRWMFJrZFVodVpIQnFVMFpIU21Nd1dnbzBPV0pOV1RVd2RITkZO
      bmMxV2xWM1drUk5jV013U0hadGRsbEVRbVV4ZGxnMGRFaFFiMlZXUVZSNFZrbENNMHN6VkhsMlpD
      OW9ObGhTU1ZBMVVFZ3hDamRrY0V0b2FWWnlSRTVsYUZoeGIwdDFhSFYyWXpSTFpIbE5TWEZJV0c1
      V1pIVndOalphTTJ3eFpXZHRWRXRKVkhKVVIweGpZa1ZrVFU1MGEwa3ZNRllLYVV0UWVWZDVZbTF0
      UTFWd1RFSm1TV0pxV1RoeVZFWkxValppYjA1dGNYbGlhV1F6UlhadlRTODFlQ3Q0UjJnMGMzZHph
      M0E0UTNoMlRVcGFXWGw0WlFwdGIxaFhXbUprU1hCUmJWVm5TVFpMVGpacGMxQktaSEl5TDJOTUsy
      dHZTM1JTYjJKaWMwNUlSbmN3ZVdjeFkyMHlSMnRxY1hSNk1UbHRNbVpCTW1GTkNtUnBVazFqTjBS
      TWFUTTJXVTVFWTNGNmRsTlNZblZ3YjFkUmNFSlNlRWsxZGxGd1ZVRk1OVzkySzJ3d1RDdFlTV1Uy
      VjJwbGFHeEdUWEZSVEM5Nlp5OEtlWEZTTjBjeGJFYzVSa3RqTjJNM05GVkxjV2d2UzA1S1JFdElR
      V3hCYTNwa2ExaGxkWHBYYVhFcmRGbDZLMHRXUkhOYWRVaG5TVk40ZWxSbmFWWnpTd3BpU214aFNt
      NUxPWGw1ZVZaSmRYUnBVamN3UkFvOVVFNTFkd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81007-7
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_ra.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_ra from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_ra
        replace: '#net.ipv6.conf.default.accept_ra'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
      sysctl:
        name: net.ipv6.conf.default.accept_ra
        value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaFpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WkpRVkF2TXpGaU4zbHBUa1ZtYlUwcksyZHpiek5CYVV3d2RIVUtZMHhuWTFWWk1XVkRSV2R4TUVs
      SmVEZ3lka05GTjI5YVlVVnlOWEJwV1UwM1VtOUhOV28yYm1STU4weFRMMjlRY2k4NFZHSlRjMVpw
      Um1KbE1EZDNVQXBSTm5jeGJFbDFaWEJNUmsxVE9VeFRhV2RMWlN0YWNrdHRjakJWUmtoT09GRkhi
      RkJ1ZFM5b1ZHSTRaVFl2YzJ4R09GcHRjMkZUU1hkUWJWWm1NekpOQ2pCSU1tMXdOREpqYkRKSWVV
      OWFjVWRsTUVkaGVFNXJOV05WVUhsUlNtVnNkRk5uU0VFMFVHVXhhWEZ4SzI4MWIwbFRWaTkzTUZO
      VFZVSmxTVUZqYkRBS09IbzRhSGhsWTNGclFuTTVWWEpOU1N0aVNsQXJOa0l2VFRSUk1IbHVPV3hH
      T1dOMFpIaFZRM0JOVEVWRUx6RXJPVGhrU1ROMVJHMUJSa3N3TlU4MU1BcDFkMnR6VFhCcVpYTktk
      V1JMUW1rMGFrazBhRUp2WmxJclZVSlhVMmN2YkRsV2JXdzBPRU4yVTNOc1Uzb3JlWFJGYjJSeVlX
      eHZSa0ZUZWtSMFVsbHpDbTU1ZVVwQ2NqVnlLMXBYZWtOM1VtWTBiazFWYkU5b0t6UkdZMHRqTUZo
      NGMyeE5ia0l4U0V4R05YQjFObkZGTkM5Qk1qaERlakJ1VGpOSGMwSXdSRElLVVNzMmQwRnpSMHg1
      VTFoYVlYUjZhRlZGTjJkT1dVaHFSSFZ5VmpoaFQyWkZSbVZoVW10RWFXVkpXRWd6SzJkUGRrVnJZ
      a2w1WWtRclYxaEtka3BLZVFwRVFYRlBjSEZwUTNwMWIyZFpWMmN3VHpsalVXZFBVVzR4TTNSck5u
      ZGxlakJTYW14eGFYUjFaVEpETjB4a2FFWmhRV0V3VTNKdEswWjJRakpTWXpFdkNrWmtXR3RqYm5w
      YVRXazFVbTV5TjJOeVJtdDNhMDlJZEdVNFNHUk5abk4xT0V4NlYxRllOelZrYlZkT056Z3dibEpR
      YVdkVmVXaDRWMDVNVXpZNUszY0tiMEYwUlRVM01sTkdiSE0zUjNOM2RraHlTMHB5YUVFNWFGaFdk
      R0Z5Ulc5bU9WWXpNbmxCTTFWTU4wODBRekpvYVdwNmNWazBPWEkzTkhSb05USlRUQW96YjBGME9H
      eE1lWGxOWWl0bE4zTTFWbHBvY0FvOVpWUjJiQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81010-1
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
        replace: '#net.ipv6.conf.default.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
      sysctl:
        name: net.ipv6.conf.default.accept_redirects
        value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaGFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      cHRVVkF2TURRd0wyRm9NV2tyVVhWeVEyNDFUWGxpYmxwUVNVb0taVXMwY2xsTGRXRTNVV2xFTVdj
      eWRra3pkMEp6WVdwVUwxUlJRM1JHTkVWR2VIQTNkbTE2WWxwVVlUbDFNakJwYTNOMFdVWnRPRWRD
      YVhWRFl6VklSd3A1Um14VVVDODRhMkZtVldkSWFEUXZSRzl2YnpVeFUzVlViakZaZEVRd1NUbFVO
      SEJCZDFJMGIyRnFSRTlFTkdOMVltbG9RbmxOU2xnelYyaFVNVTlGQ2tsbFVYQXlaWGMxTDBaeVRY
      TjBhV2xXV0dZeFVrY3djVFJtYURkdmIwWXdTbTFxUkhadmRqa3JRVzg0U2tsa2QySXJWR3hJTW01
      T2VUWm1XRVpzV0dRS1dtdE9kalkyVVZkSloyRTBkVGxUYkd0WE4wTkRhVzQ0UmtNeVUzWlpkREJQ
      Y1VNek1GSlNUMVoxU3pWbVJ5OXFORk56VTBJM2NXOWFPV1ZEZVZGelNRcGFaRFF6WWxsYU5VbHZL
      MklyYVdGTWJubHVhMUZPU1RaNGVuWk5Xa2RDUXpVeEswZHFaRFo0VW0xR2VHcG9NbVY0TUV0WmJX
      NTFSRzVYUlN0a2JIZFJDblJuVFRCYVkzSnFWR2hZWlUxbVdETk5SM0pVWlRSamFIWkthVE52YURG
      bVlqSndjRzFhUjAwNFlrZElNMng0T1M5elpGazROVkpQZW10QlNraHhiRmNLY0hCa09YZEhZbGQ1
      TTNWdWREaFlOSGRhWlRWb1VHbzFXamhZZUd4WWJIbDZSVFJyVkRsR1lVTkVZekkwZEZsWGNtTk1l
      VTlEUVhwUkwxcHRXVkowUXdwRWNuTTNVWGgyUW01M2NUTnFZbEI1VVU1alpIVnZSMHRaVkZGTWJX
      Vm5jWEp0ZVV4U2F6Sk1WbFZyUmxORlJETXpSelk0ZGxWcmQwTm5VelpuVURZdkNrZDFkVEpTU0dV
      NGJUbHBVbWRyWkVSblkzWm9ZV2xtVUVKQ1UzTmxZMWRISzFGNk1uaHFjaXQyTDBrelRsQlJWa3c0
      TUVSWmVqWnRaRXczYlZKNVJrY0thMDlPZFVReVdFMUhLMnQwVUZVNVZVTkhkV1V3TTNkTVZEVjNN
      VUZ4UXpBdmEweHBZMDUzWjJ3eGQzRXhVV3RCVGpkRlVGRlJNMmRRTkhFeE9EQkNVZ281VVdweE9I
      cG9VMVY2ZFhaVU9GWTJPRzVpU3dvOVJsUjJTZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-81015-0
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
        replace: '#net.ipv6.conf.default.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_source_route is set
      sysctl:
        name: net.ipv6.conf.default.accept_source_route
        value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enforce Usage of pam_wheel with Group Parameter for su Authentication
# Identifier: (ssg:rhel8|cis_server_l1|xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  hosts: 'tupelo-rhel8-0.rhc.home.arpa'
  become: true
  vars:
    var_pam_wheel_group_for_su: sugroup
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IxaGFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      TnNSVkF2YVdWS2VVUTBWSGRvYlhwb1pGZHdOV2xuYzNCVFduQUtWSFJMVm5Gd1dFeG5RalpCTkhS
      QmMySjZialpZU0RFd1kzWjVaemRHZVdKdWFFb3pRV2RSVnpSSE1VVjFUME52TUd3NFIyNHdaVkpD
      Y0U5d2RETm5aQXAzVDNSRVZYQllVM2hVVm5GdlMxRnhkVFVyWkhaRFpHcEJPVmRyWkVab1JEVnpk
      VFozWlVGQk0wbzFRVnBuYmxKRk0zbEphblpUVWtSV1dXcFROVkoyQ2sxTVlYZHVWVkp0Ym5wYWNY
      Sk5OR0ZTZVZrd1YxTjBZMUJ1UjBoV2NuTllMM2RSTWxscVMzbHViRkpOWlRnd1NVeEhTM0ZvYmpj
      MllTOWlUWFpLVXpVS1kzSXhNM1Y2YW5Cb1dIWkJLM0IyUzBaaVVtOTVhWFEwZDJSbFFpdGtiMmxN
      VVVkbWNHNVhWbE5OVEc5YWIwUlRTelF3ZWtzNU5VaHBXbHA2VHpabE13cE1VMFVyWVZWclVIZElV
      amhuY21oVmN6QXlTazEyTjFVemMyTlNSMWRCUW5SUFZtZFJPR0U0YWpWc2FHeEtkMWdyY2twVGQy
      OVpaV0pCWjJGMldtbGlDbWxMVUZNclowWkJOakV6TXpjd1RTdHdkVTR5VFVJeE5EZ3ljV1ptY3pa
      T2NYTlJXbWhaVGxaM2NHUmhaRGw0Wm5RNEt5OXNOQ3MwYVM5ck16QlFVVFlLV1VrMFNpOUNWMHBI
      VGpGdWNUVjBlRmRNUzI1cFp5dGlNVEZ0Y1hwWGMxazRkWGRRY0haQ2NFRTBlV05KT1c1VVZHbEZO
      VVV5TkN0SVdVRkNSM1pOS3dwQk5sbEZWSFJwYzBreVIxWTJSMXB5VjFaWmJESXdWUzlDWVRodFJ6
      aEdSa1oxYjNwV04wVXlOMHh5Tm5CNlp5dE5ZbHBhTTBGNVpubE5UbFZGUjNaeENsZHdjRmxYVVRS
      RFFsUkZkWFphSzBReGIyMVlZbmRsUlM5dVpXUm5SVUU0TkV0VmJWRllZVEYwU0ZSWmRsbzFRVVpE
      TlV0c01tTXdORFF5YmtvdlVHSUtSR3h3UldvNVZYaHJZakpzU1ZaT1FuUjFRME5TV0VOMVJFWmlW
      MGhKYlhNeGNtbGhRMHhtUlZkVmIyY3hRMWhEVGtsVFRrUlVjemRDTmpSdlpEQklSQXBqUWxCVlJY
      aE9lRXBFUmpablNVZFdiRXB4UXdvOVJXUjZOQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86064-3
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - use_pam_wheel_group_for_su
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enforce Usage of pam_wheel with Group Parameter for su Authentication - Add the group to the /etc/pam.d/su file
      ansible.builtin.lineinfile:
        path: /etc/pam.d/su
        state: present
        regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid group=$
        line: auth             required        pam_wheel.so use_uid group={{ var_pam_wheel_group_for_su }}
      when: '"pam" in ansible_facts.packages'


- name: generate Compliance report
  hosts: "tupelo-rhel8-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU213elMyZFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      a3djMUZCU1dwWVVsWklhUzh5WkdRclFrdzRhRnBCVXlzNGJrd0tjbUp5WkhobWRra3ZhM1p3TWxj
      eGNrMWtNbkJ0YmpsV1owOURXVll6YzI5Nk1FNURjRTVKZUhsUFFuZFpXVmhOYkdwYU5XcGhOSE5F
      TkZVME5HbzFRUXBQUmxWTE1IQmxaR3QwVTJseVVsbDJhbTFsVm1oU1YyRnhURzE0VnpJeFFVdDNN
      bmR5YTBRM1EwNVRjM1JtYmxWMlRtUkJabU5LYjFGV2NHODJOM2RyQ2sxUFNUaFJZMlo2ZFdJMWNu
      aHlTSFV3ZUM5eFZqVnROa3RPZVZORFptaFlLelo0SzFkMWFqQk1ibEZqYTJ4WVYyVkZVM2hQV1N0
      blRrMUJNMFkxYkU4S1dXcHdSMmhVU25oeFkzSXpTRWh0TURsV1RWTk1aeTkwTjNFNGRqaERWMlp1
      Wms1M2VVcDBOazVsYVV0MGFVYzVUa2hKV1d0M1NFZ3lOMFZZTlhORk9Rb3pSakEyWWs5NlpsQkdT
      RWRaUzBzeFlYTmplamhvTDNOMVRtMDRiWFJ4Ym5CQmIycHNkM1JZVDNKWmFVaG1hV1JsTWtSaWEz
      VjNOUzl0ZDBGSFFXZFVDbGhtTWtJMGMybFBVSHBpWWxvMVUzUjJSbFk0YzBaMVVrMTFjWEpHVTJj
      M2FsSkpkbkpQT1ZjeE5YQTBiV04xUnpkSWVDOVJRMVpvUmpkb1FuUkZUMG9LVFhCdmFYVjBOVlpx
      ZGxsVFkwcEJUM05tTUdsYU5FaFlRWEZtVEVWWWVtdzFja1ZzUmtoek1GSnlWRkJsWVZoSmRqTmti
      bkpUV0dkNFNUZFVTVUpUYVFwYWJtTkNZalpMVUdkNWFVSXJibWRQV0ZCbFEyMUhNbmRMVm5CSGVI
      ZDFkV0pXTWtScE5FdGxhWHB0V25KcWNtMVFPRlJLWjJWb2QyRktSMmt5TlZwakNrcFpVMlpGTVU5
      T1pucDVaR2gxVmxscVltSnhabkppZGxKWU4zaExlV1JNTVhWQlRucG9Ua05wY2pSRk0xcHRaRloy
      UlVSd04wNVNhalIwTmpReldrY0tTVGxSYnpGRldEazNlR001YmtwYU0wMDVWME5zYVhSa2MwUTJh
      V1JQWlhCU1FuRlBhSFJIU0hoRlkxVkJUMHgxWkUwelNVNDNNM1pDVlRCa1dsbFVXQXByYVhwNVRV
      VXJibGxEUmxKSk9XWjFaemx2ZGdvOVVtcGxWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:
    - name: generate Compliance report
      command: insights-client --compliance
      changed_when: false

# Reboots a system if any of the preceeding plays sets the 'insights_needs_reboot' variable to true.
# The variable can be overridden to suppress this behavior.
- name: Reboot system (if applicable)
  hosts: "tupelo-rhel8-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTVlpCZDFWQldVaHBRMVk0ZG5jMU9FUXJhalZ3VGtGUmFrMUVRa0ZCYTJOeE1W
      WlhVbEF3VUVoMGRIRjBWMGt4UkZSdU4zcE1kbFUyU0hKd2QxSUtUbkJ3Um5SWGJWRktiM2xxYm1w
      bE5XUmFSemMxUTNCU1kzZGFPRU5XVW5sRlRVRXpVREExZW1Kc1UzSnFWbTUxVW5oNlpVeG1SbTFy
      YW1SRVJWcHdjZ3ByWTJ0d2FFazJSVUpIYWtJemEyaGFUalJ5YTNwUWRWQm1PR1pMUVdsSE1ESmxk
      SGhXVFZWV01tZHRkV3c0UjBJMmRIcEpkRk5uVFRGQlFYQkdORTFRQ2s1NFRDOUpUMlY2ZFdRMGFt
      VlFaV05KZWpGS1dtMTVkVGgzWTNoVFZqWkpTbTVPU1VGSGVHYzVWRUpVYzNNMFEwbHVaVlZXY0RG
      VWRrUlFPUzlHVXk4S2VGaFlaMFphWlM5VlZuQjBaRzA1ZDJkbmRVOXRiR2hvWVZCTVZHNU5Tbkoy
      UVRsV2FVUnZRVzV2WWt0b1VIbEtZMHBSYjJOTFdrRlRjVTF6ZWs1VWNncHVNek5JYlRoUk9IQnRW
      VTFLYldobU9VRnZkM2x4VW5GWVVHeHpXVGwzT0UxRU1WQkZjR3htY2pJeVlYTjFMMHhvYjNGNlIz
      TmtOMUUxTTJwdFMyNXBDaXM1Y0VjeWEzVkNSVXhpVVhoblRHcERiVlZsUzFCdmJuaFhjM0JuVFZs
      M2VYQjFaVFJvYnl0dmFsZG5WRGR2ZG1GbFRFNVRTMkV2UkZOS2JEWldRaThLZEd4YUwxUXJPRFZr
      Ym5ZclNWb3phbEJTZFM5bVpuZFBkVVpVV2xoNmVGTkJUalZSV1M5ak15c3hhbUZSTDBKeFdYTmhi
      M2RpUkZreGRXUXZVeXRsYVFwa2FEa3JWRkV5TlVKa1NYa3hibGh3ZWpoV1JHbHpjbEp3Y0VrNWFs
      SldWakkwTVVVelRVWkhka1ZaTm1aVFYzSlZWMWMzY0RKbFpUbGphelpOVlUweUNrNUZjRXBLWm5G
      UFNFdHBjRXRPZVRKdVFVRTJURmcxTHpNeGFWSk9VSEZZVXpKRVdqSlpkbVZTUTJOMmVDOHZPVTlo
      UzFWd1FsZElZVmxYYW5STU4wWUtSWFJWVEZGeFZESkJPVTF3WjFSU1RtOU5WbEZ4Y1haQ01GUlBP
      WE00TmxoTmRuUkdRa1IzYW5SbWIxSm9NRnBEYlUwME1FRlhRMHBxT0RKNlduTlRZUXBCYXpkUEsy
      UkpkMFl5VVQwS1BWcEtiallLTFMwdExTMUZUa1FnVUVkUUlGTkpSMDVCVkZWU1JTMHRMUzB0Q2c9
      PQ==
  tasks:
    - when:
        - insights_needs_reboot is defined
        - insights_needs_reboot
      block:
        - name: Reboot system
          shell: sleep 2 && shutdown -r now "Ansible triggered reboot"
          async: 1
          poll: 0
          ignore_errors: true

        - name: Wait for system to boot up
          local_action:
            module: wait_for
            host: "{{ hostvars[inventory_hostname]['ansible_host'] | default(hostvars[inventory_hostname]['ansible_ssh_host'], true) | default(inventory_hostname, true) }}"
            port: "{{ hostvars[inventory_hostname]['ansible_port'] | default(hostvars[inventory_hostname]['ansible_ssh_port'], true) | default('22', true) }}"
            delay: 15
            search_regex: OpenSSH
            timeout: 300
          become: false

- name: run insights
  hosts: "tupelo-rhel8-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTVlpCZDFWQldVaHBRaXR6ZG5jMU9FUXJhalZ3VGtGUmFXdDRaeTh2WmtaRFoz
      QXlTblIxVEd0UU5qQnNTa3BZYm1GU1JGTjVjVVYwU0ZSNlRGY0tOVlZSVlc5MWEyUmpVRFJVUlZn
      d01EaDFhRkJHUzFaSmVrdFVTR2RsYTFOaU1UUXlkMjlQYm5sR2VUUnpRbEJrZEZoaGREVlliWEp0
      VGxsR1EwaEVWZ28xYVhSdlNrcDBPVzg1UWtkQlJVaDVZMFJ3SzBoNVNqWXphM0paZVRGUk1rOXVU
      azF3VjJaSmNtYzJUakJXVTJoa1JtVk1lR0ppTjBaMlpFaEpjbFo2Q2pJNGFrdHhOemx1Tm13eUx6
      aDZZVkJSTDFkWVZIWkNaMDVhUkVWTFJ6TmhSSFl3WVRkbWIyUnlPRWhEZGxseE5tNUhNRkZOY1RO
      U1ZFOXBkbFZtTTFnS1JuQnlhVTh2TDNKSlRDOVlSelE1TTA1NGFWSjBRakVyZEhSUk0wZHNhM1ZE
      ZFVwck1EQkdaREp0ZDNZNFprRnZaR2xUUW5aelQydEpZekZyV25adFN3cEJjR3BEY1ZKMWVHaExU
      MDgzYWxZM1FYSnRTV0p6TkhobVJrUkJVMkZaV2t4R01VMHZhME42ZWs1d1MwTjFhbE5hVUUxRlVt
      WlhhV2RHVGpGMWRqRjNDalpQSzB0b1pTdFJVRU5hUm5CV1kwVndSbTFSTVdwcWFrOVFPV2haSzNW
      alZWSnhSVEkyTlhGTWRuWnFSWE4wUW5WQk4xQkZNRVZ3UkRsaU5VaFZSM1lLTkZKemJXc3pNbFpC
      Vnl0WE5IWk1VRWQwZG1sQ00wSXpUbE0wZUhCdVIzSmlObGs1Y1cwNFZuVTJSRUZIV2xOYWRsbFlk
      bWQwTm1WR2N6RTVTVFZZUWdvMGVtcFVSRUlyTW1sT2NrcE9jM2d5YURoU1VGVnJMMmhZUzFKMGEy
      WnZZMlpKZVRkcGNWY3hiMGRsTlZSMmFqTTFSbXRqUld0YU9VRnpSMjl6WXpWMENuUlZkVlZJWWpS
      ME5EVTFSSE5EWlZWc1ZEZFNOakJDTTB4d1Z6TmlTRTF0YzFCMEx6RktNRFEwYm1KS2RFTkhUM1Jy
      UVVWWVRsVTJlbGxUTDNBMFFqSUtaSFYxY2tZdlNHUnFWWFJNVDNSdlNFTnlZVWd2WkZwaFRVNTZk
      MVZpZUc1VFZXUkdZU3R6TTBaNFJHczFVVkU0VVRaMVVucFpRbWw0WkcxeWREZGpUQXBKYTA1NlEy
      aHBRMDlrY3owS1BVMVZOMk1LTFMwdExTMUZUa1FnVUVkUUlGTkpSMDVCVkZWU1JTMHRMUzB0Q2c9
      PQ==
  tasks:
    - name: run insights
      command: insights-client
      changed_when: false