---
# Red Hat Insights has recommended one or more actions for you, a system administrator, to review and if you
# deem appropriate, deploy on your systems running Red Hat software. Based on the analysis, we have automatically
# generated an Ansible Playbook for you. Please review and test the recommended actions and the Playbook as
# they may contain configuration changes, updates, reboots and/or other changes to your systems. Red Hat is not
# responsible for any adverse outcomes related to these recommendations or Playbooks.
#
# jaudet-rhel9
# https://console.redhat.com/insights/remediations/f0b3db04-83e5-4257-ae40-45b8aa46b944
# Generated by Red Hat Insights on Fri, 21 Mar 2025 17:10:15 GMT
# Created by insights-qa

# Set Account Expiration Following Inactivity
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Account Expiration Following Inactivity
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_account_disable_post_pw_expiration: '45'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      MVVNRkF2TTA1TFNFdHNSMXBTVkhORVIzZGlNa3R2UkdsSVVuVUtPWE5QWkZwblZrdHhZalVyWTJo
      SVpIZElLMDV4YkdObWNFUmFVbW80WTBsME5USlNNeTlhTDJGYWRtMW1NekI0YlRkd01XNXJRMHBT
      UkVGSE5HTXZNUW92VW1kemJqaE5LemRGZW1KR1lrZFJMMUJ5VGt0R1ZHcEJabE5CTDJOR2NYcENX
      RFJRVEM5M2NVRnpNRGxKVWtSbFdEVTJXbWhNVW5SQ05VeElXVVYwQ21SU1ZXRlBNVEJEZUVKMk5r
      Sm1hM2MwWlRBM00yUlpkMUJqVG10Tk5WQkdTVTloYTNvM1MyRnljek5tU0dGSk5Wb3dVbTAyU2ta
      blNXcFRlbHBWTUhNS1pVNVplakpuV0dKcU1YSmxXVlppZVhWSFRURnFWMmxpWjBkU1lqRlZiR1Zv
      VWtGd05sRkVaVE5ZYVRaSVprd3dRM2RhZEdkSVRUZzVTMjh2Wm5KR2FRbzRjMkpzYVhKeE5FRmFi
      a1ZDTW1GaVNuWXJNMlZIYUZOek9UTXpNazFGU200dlVHZ3ZNV3RwTWpSTldXTXJjbU40U2tkWlFV
      OVhjbmxvUmxKRWJtb3ZDa2RLWTJ0dVoyUlVZbFp2TmxCSVltNDBlVXQzTlVkcFFtY3hhRGwwTVhr
      Mk1YWlNSV3RZUW1SeUwwdDRhVVJLYm5KR1oyRTVZMWhWY1ZoYWFUQnlXaThLT0hwdlYwdGFjMWt4
      WjJaQ1MxSjZaMU15Vkd4a1RFY3hjMDF6U0ZWRE9Xd3dOSE0zWlZCM1prVkliVEphYTNoMk1rZzRU
      VzFYWmt4aFdqTXpaMGhzZVFwWllreHZlamxXZEhKWVNuVkJSalo0ZDNkaFRYTklNMlp3WkhFMWFI
      bFJValJsVDBoNFYzUm1SR05XZG5rd1NIQTFVWEpOYW1wTmVrVkJhbmxJYjJOaENtWk9SWFp0ZUdK
      aWRrVTNTbHA1VERaWU5WWkNRMDVuTjNwNGRIZEhRekJwU1RaWFRUbHFUWGhyUkZCNmNXdDNPVU51
      UzNGNVNXNVNkV1JJZUhkMk5Fb0tjVTAxYjJkT04yTkVVVTE0YjNaeGVsSkliR3czWW5KeGNDdHZS
      MEZ5TmpZeGEwOXRjWFJFVjA1M05HSXhVMU5RUjI5d1ZXaGlhRzFvWm1SS1lVeDBZd3BFVVhoa0sx
      SlhOazhyTVZCMlpGcGtiVUYyVGdvOU0wcDRWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83627-0
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-09-411050
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.6
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Account Expiration Following Inactivity
      lineinfile:
        create: true
        dest: /etc/default/useradd
        regexp: ^INACTIVE
        line: INACTIVE={{ var_account_disable_post_pw_expiration }}
      when: '"shadow-utils" in ansible_facts.packages'


# Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_account_password_pam_faillock_password_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File.
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86932-1
    - DISA-STIG-RHEL-09-611035
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      QnVZMUZCU1hKaWVtNTRWemR6ZFZkR05WTkpXbEJGYjNKNGR5c0tVVVJJUkVKbE5TdG1NRTR2TWpa
      NU1IbEhZakZGVFhoaE16UkdhM1pCTVVGaU1tRnhNMVIzVkRRcmVraEVhR3A0VDFjeVFuRXhaRU4y
      U0hCdlJtTXZNUXBITW1wa1kyOVBWbUpCVFdKWlZsQk9NREpzYWxrNGNYWXphemRCVkZsb1psRnJX
      blJSUTFwS1NVcFVMMUFyYjBFM1NYTldUM0pxTlhveVFUQjFkRkUxQ2tWUlEydFNXbXhVYm05TldU
      ZFlXa2RGWkZGR1JWcFFla2RzUVRCNE0waDNNbGRzT0RCU2VuVnVVbFZ4VjAwMFRVbzVUbmRCZEZR
      MlJ6TnZWRUl6WW5nS1RIQmlaSFZ2V1hscFVEZFZlRUowZWt0MmNtVlZXVXBQUldwcFQyWmliMkpF
      TVhad2FuWmpaMmRhT0dSQldURjRSWEp6UVc5U1Nub3hSV0p6VTBaaVVRcFVWR1kwVWtrd00wMTJa
      bXMzWTNkeGNtaEJTbTlSYURBck5FSkJia015TlVNMlIxTjFXVXRhYkhsRVlVSlVTeXQwY1dOWU5G
      UnBMek00UzNwVldtbE9Da05zWkV0NVRsZHBZVkk1Um1sWFJreDZlblo0YmpKNWFrRnRXVzVST0V4
      WWVXNTNkVTVXUjIxNmFTOTBVVlZEY1ZOVVQzZEpZMnh3VEdvM1dEQnFWWGtLU1ZwR2NUZHRVbWcz
      ZFZsdFppOUlXVWRaUzJ4VE9UQlpSbHA1YmtKTmJrb3dUamM0UjJrNFJIRnhOVGxKV2paM1kwZERX
      WFJCV2psTE0xRTBWMlJOTndwTWIybFNaekpDWmpNek1tVmtOSE5uVlZwck9YaEpOMWgxVWl0WFF5
      OVpPVWMwWlhrd2VEVmpabFpKYlROSFRUQklPVEV4ZUU5Vk9XUkpWVlpsUVUxbkNtNDJRbTR6VFRO
      TFZUUlZNRlI0YmxoVlZtaFZjVXA1UlRCcGQySjBkVzVsZVhOVlpIWkZiRmMyVFVwMVFqSnJPSGxX
      UXpZNGJteG5ObXc0TDJKUlRuUUtTVUZyVFRsMFNsbElPSEZhZFhaTmJuQlVWVUZ0WlVWYWRFaEVR
      MVpzUzA4NVRVeFViRVZWVDJ0SlowbGhObE00ZFhOTVlVSmxZekJZTnpSdGNHUnRVZ3BqV1dKT2Vr
      OXRVbEIwV21wTWRETTFXa1ZJUWdvOVdWTkhjd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Remediation where authselect tool is present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when: result_authselect_present.stat.exists

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Remediation where authselect tool is not present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth File. - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when: not result_authselect_present.stat.exists


# Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_account_password_pam_faillock_system_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File.
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86917-2
    - DISA-STIG-RHEL-09-611030
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_system_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeExRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      Z3dTVkF2VW0xMFZXcHZkelY0UzJoWlkwODVVM0ZqUjIxMmVIb0tRMnQwU1c5dU5UbEZVR0Z2VDNC
      S1NVeHdhRmhOZG1acU16Vm9aWEF5VlhoeFQyRkxhRkJTVTA5VE1tTmxiMnQ2ZFZkT2FERXZNSGhy
      TDNOSFdsTXdTUXB6Y1VoU05HcFhORXB6SzFkc05UVjZNR1J3Y2t3MGJYY3dMMGd6U1VoYWJXUnVO
      azF4U2xwNVN5OHZPVEJQUWk5S2VYWmxObTR3U25kRVVtTm5hMDU0Q2pCSUwzTXpTMnRRTlN0V09Y
      TldXQ3NyTjJrdlRuZHVUelJ2UjNGTlMzSkxWMVY0SzBWbGRtVTJTR2x0WVZVdmIwRkdkM1F2SzFC
      WlJWcHNSblkwT1VnS09GRlBZalI0YmxJMmVsWmhPWGhhZWxwRFowcDROVnBKYzNNMk4xSkNjVlox
      U2xGQ055dHJhVWhZZUhrMlIyMVZOMmRIYnl0a2JHa3dValp3UzAwMWVnb3dSMnBYTDFGaFExQm9X
      SFZFVFRZelFtOVlMMFpPUmtKeFVreHhUMVYzY0hsYWVGSjRjbEppTm1sUVoyeG1OMGQ0V2xGa1Vr
      eHpabVZHVDNVMlpYUlZDalp1WVdwVFYyRmpjRFpOU1hSTmFHOXNlVWx6U2tWU01GUnZkMFoxYmpa
      SFZuWlhZMFpCT0d0Mk9XaGtaVkV5TlRoT05saHdVRlJZZWt4cEx6QnFjM0VLVjNwcVRqUnlVMDAz
      V21scU1EUjJTRU54V2xZMk9VdFBiVWxZTHpkaWNXczFOVmxXU1ZoYWNWQk1TMEUzVlhOWk1YRktT
      MGRTUnpGRGNYUlVUazAzTlFveFVFUnFUa2hUVkRNMU4wTnJURzFwVVdkcFNEVkJOV05ZYldzck1X
      TmxlbG8yTVRGc2NYVlFZM2RUUVdSR1VVZHFURkU1VFV4UGQyTllXVlJ3T0dWbUNqUk5TRWRhWlVk
      UU1qZEJaSFJIWTAxSVdGcEdjMHcxU0ZWc1owZHljMDFKYWtGaWEweFBjRXgzWWxJNFQzaDNkbWxZ
      WldocFNYTkxOVmx1TDNsRmVYa0tRVWhNYmtWMGFtNHdSRFZFUVZWMmMwRkxUakpTV1hac1RYTkxO
      bkZEVDNoSFRHTXliVnBzT1RWbmFsZ3ZZMHN6ZDNCS09FOXRSelJVUkd4UlpHdEVUQXB1TkROR2RW
      WjVjMnRNYnpKdFdXUjVWMWczU1FvOWNURkhSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Remediation where authselect tool is present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when: result_authselect_present.stat.exists

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Remediation where authselect tool is not present
      block:

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth File. - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when: not result_authselect_present.stat.exists


# Set Password Maximum Age
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_slmicro,multi_platform_debian
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Password Maximum Age
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_maximum_age_login_defs: '365'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      VjFhMUF2VWxodlJIZHphVzA0WkZvdmVGbzNTakJKYTJ0TlpHd0tXRkl4YjNCQlpqazFkRWR3TkU0
      NGMwWnRSa0ZwYmpoamFGQmxLMHhRYTNJNVJ6ZEdTSGRHU201SWREQnhhMlZhVVdKaWFDdFJNak52
      UjFGSGVHMTNaUXB2YjJseVUyZGFkRFJoZDFsVFJUZHFjRkZzY1RWbllucDNTbWhCWnpOVlRqbDRi
      VWx0UkZGNE56TlBPWE5wWW5kcWJWZFJVRlEyWkRoSldqZGpiMHB1Q2tWa2FrdE9OV2t5TDNOdFRX
      UnlRWHBPU2xOMlExbDBSVzl6ZUZKMFYxZHhhRmRFT1hwUFpsbDNjRUpEWjNkVVkyOVNkMmhxTVho
      U01rVnhVbWMyZW1vS1owSk5SRXN2YkcwMU9HNWhSbVowU2xaRVRYSTNhblZPUTJ0eWNHSTNWelZK
      ZDFSTlpFaFRXazFDZFVzeGJGQktTMGM0UzNoS016VXdPVEZZYWpSNVVRcGxjVGxWV1hObWMyZ3JT
      U3NyWTJjeVVuUkNRMHBDZWtOVVdWTlpSMnMwYW5wRldWRXlSbkJsWm5aWVUwSjBURmxTZEZOWk1H
      UTJTRE15TjBaMUwxWnpDbFpVTWpocVZ6UnRVMmhVWXpSaFZtNUtNV2QwU0hOa1YxQndSM0pzVG1O
      T2JFeFpiMnROZFVOV1ZYazVhbGtyVVdwMllVNVFlV05ZVlhKMmFVNUVUeklLU0dsSVQwUllaVE0x
      ZGxabmVVTTJjekphU2tKTFZFMXdRUzlDZWpsSVJVcElWMkZaUVU5eVJqaEJPWEZrU1hnNVRFdHNV
      SHAxUm1zd1ZUSjRUako0VEFwRk9HRjBNM0UzVEZaS1FsbEdUMjlNV25GSFZXOUZMM0pNVGpKWFlu
      aFpXazVYWVd4Skt6WkxlbVpJTjBsRk4xUmtkMWw0Tm1acVRrSnliRTltWmtSTUNtbEhaMjVtYzFB
      Mk1HRk9OR1V3Y200MWEySm1aVzVuZW5KdWExTlRRbkZYTHk5bE4wZG1SakZGT1ZOb2VFaHNNRE4w
      S3paR1FtVjVWbWR4UlhKT09GRUtObXhVWVU1UmN6VTBSalZaVFV3MVdubFphbmhUVkRaT09UTklR
      VkJCVXpOTEsyRjNRVVY2TWtrNU5sazJaa0UwV0RGMVRFdG9LMmxZWjFWb1l5OUNid3AzYVhad1ZW
      VjRjVk5RUjFjemNFMXRkWFZqY1FvOVRtMTJSZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83606-4
    - CJIS-5.6.2.1
    - DISA-STIG-RHEL-09-411010
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.9
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Password Maximum Age
      lineinfile:
        create: true
        dest: /etc/login.defs
        regexp: ^#?PASS_MAX_DAYS
        line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
      when: '"shadow-utils" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_dictcheck,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_dictcheck: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WTBORkF2UVRSM2N6aHViRmhQWTBzMllsbGtVVnBKWkRsWVlrVUtNSFJPV1c1VVVsb3dTMVZzY0VO
      VlFtOXlkbkUyYUdSdVF6WkZORkJsYlZCV2R6SnNjRXgxV0ZsVVltMXhhMmt3Y0VGSWJVZFBVRVZp
      TW01aEszVlhUQXBuVjNFelJrUk9iWEJOWlRkdU5FcGpZVVJ0ZEhsR1ZFRXJkMDlJWmpNeGREQjRT
      bTR6VGxOTU5EZGlkbVYzTlVsRmJtRnVTblpuZFVOR1kxYzBlRVZ3Q2pCNVkyRnBObWxEU1d0UVRt
      bDNkM2xtY1VsNVZsbEtkV3B1VlRJMGFIcHhiRGxKYkd4a2EwbExZVzVDWTFoa1pqUjRkRVY1VTFa
      dlQzZ3hSVWxOTTBRS1ZqUjRZWHBsVFhsWVNtMURhRkpMZHpObE1VVlJjWFJZYjBKTmJFcFBOVkpZ
      YVdobVRFSXlkRlZFVG5sbGIzSllSa2RKSzJvNGJtWkdjRWQxVFU5T013cHllVTU2YjIxNVJXRlZh
      bTFxTXpsMk5VNXlTMHBVVVhFdlVrMXpRMWswVTNacFQwTllhMHhvVmtkMlFUWmpRVEJCWkZSWFNI
      VjNiaTlMT0ROV1puVm9Dbmg0WTB0YVdqRk5UVk5OV0N0b1FUUTBWbTFqVld0WlprOVphVm95YlZW
      dlp6WTVTV0puT1RGcGRXOW9iRkpXYTFZNVNIWkhNR3RaTHpKcFJGRnZVQzhLTm01a1VtbExhM0JO
      VlVWMWR6ZFFZblJTWmxoRE9IcHZPV0UwZWt4bWNtNVNjVk4zUzJ4WFF5dFViMkZQWWsxdFVVSTVV
      VU5DTW1saGVXeFVRVXRuU3dwelJVOVJVU3N5VUhCcU5YZFJaWG8xVlZSemNIaFpSVWxvVW5ZeGEw
      c3dTVFZMZHk5WU9XMDVLMEpRUVZwR2RrUk1ja1ZQVWs0ek1sSXhNSFl5U205b0NtSkJTbXBFTUZO
      T1RWSXlPVlJUY3pKWmVEQm1lbEJVZVdNMFVtNTZiMHh4VVd0eVlUQjZSMlJTUm5SSVJIVjBNbUpD
      V0cwM1dXZENPRlpUV1dsck4ySUtabFpOVXpCUGQzRnRSelZ0ZUd0V2RFeG5iSFZ2WlRSMVNFVkdZ
      VWhwWVdaRlVXWklhRUoxY1haS1QwTk9LM1F3Y0RsS1dXbGtSWEYxY0VwRVpqbHBVd3BKVkZrNVIw
      cEhaVkUwSzJwaVdteExPRlZxTlFvOVYyWmtiZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-88413-0
    - DISA-STIG-RHEL-09-611105
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_dictcheck
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words - Ensure PAM variable dictcheck is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*dictcheck
        line: dictcheck = {{ var_password_pam_dictcheck }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Different Characters
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_difok,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_difok: '2'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      eFRTVkFyZDFaMldFeFphWEpsTlN0TVFYQjJlbGhHTVVWdFFXa0tSM2RaSzNWV1pDczFjWEpqZUV4
      dlRpczNaRWxqZUd0aU9HTjJUazluUVhoUVRVbzRNM2xOTkV0Nk1ta3JOMG95U0cxbmFVMTJPWGxx
      VkZwSlJFSTJhd3BIUkc5b1JFbzBXRXRVYW5oWlFrWnVSRTR3TmxKTmRtTjBiRXRrZDJReVZrVmxZ
      VkZYTjFodVJWbHhZV3BSZFhreFFWQlZOMlJKVFU1ekwwODJXRmRXQ2xoVGNsVk5kV2hFYkRsUE9U
      aFZjMEpNVWxWeGJFTkJXbXBoVkVVclNuWjFSVE00YkhOb2VVNUZjVU5CWVhsbU5sWnlVRmgwTVVw
      RlRtSm1hR0p2Vmt3S01XdDBObFZ3ZUU1eE1VdEdaQzlXTXpkVWVqTk9RMHBzTUhwdVREWlpkREY0
      Tm5FeFN6ZEdRekJFYTBKcFZsbHhTVkpwV1NzM2RXaHZjRlJDVjNSbGJRcGpkMDlRYjNNNVNXMVhX
      RTEzV1hoS1RWVkNRbWhyZW5BMlJtY3lSMUZwWVhkR01VTlNOVWROZEZKalIweHZMMWR0V0U0ME9H
      cG9hRU16VTNRMFEwNUdDbGgyZDBSc1NXMUdNelZMTDFrMmFWRkZSRFpSYVVwRWExSTFZV296WkdR
      dlZUSmFaa2xoWjJWR1JuQlVZVlVyZVcweVZsRmtSamhxTjBSMGNWcENUazRLYWpaa2F6UndlVUZN
      YkZOT1ZTdGlNVWxETVVkeWVtMHJjalJhT0RVd1dHaFNUek5vYlZsTWNtRkxZa3N2TkVSdEwyVjJT
      VzlrVlRkNFpFVkhablkzT1FwMlpqZDROWHBUYWxGWFRuQnVUekkzSzBOUFVUZExTU3RRU2xsM2VX
      TkdWQzg0TlVkdE5tOVlkRkJRUTAwclZXOXFUMVJ4WWs1dGVGWXhiRGMwT0ZORENsTkdhSGNyWVRW
      MlNtRnRaelpEUkZOTlpVSjJRamhKZDBkaFlpOVFkRmc0WTA5Q01tWjRXV2RSVmpSclRIcHFWMG80
      VmtSSU5GTXdjMkp1YWtoWE0wb0tXRE5KWjJOWWNGZHhhaXRhTldsUGJFSkpPRkJFV1RkdlJIbFVZ
      MFpXUjJVM01HUXhNbkJJUWtzdmJXWlViSFUzUkROMFRDdHNVRkZpT0VSRmJFcGlZZ3BDZUdSeFZt
      Uk5MMWhXYnpCallXUkdOa1F5ZFFvOWFYTkVXUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83564-5
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-09-611115
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters - Ensure PAM variable difok is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*difok
        line: difok = {{ var_password_pam_difok }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Enforce for root User
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Enforce for root User
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86356-3
    - DISA-STIG-RHEL-09-611060
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_enforce_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NXdkMUF2UVRBM2JrNDRUMm96V0cweWJWVklVVEZ3WWpOMk9VY0tkM3B0UXpobFExSmxiVGQxUVM5
      RU5XOTJNa0Y2T0VSVk1IaElWRTVZWTFGQ2QxSm1TaTlNWXpKS09VdHdWV05VTjJ0cWVrZHFZMjk2
      V0hSMlZDdHdOZ3BPTWlzME5IWjVlazVwTm1kWVZGWmFhbXBpWjJOalMzSTBaVlJGVFRaWVoxZE1W
      aXR0VEVReVlWUmpWV2xyYkUxbU0zTnpkVk5aV20xa09XOXJSV0ZIQ2pSTWFGa3ZjWEZCWWpoWlIz
      WnBOWEpqWVRJNVFYTk9RMDFMTkZaNU9VaGtaRGxMVXk5VVMweFJiSE5UVTJjM2IweE9jVUpQVTJn
      MlFVOVZTbTVCTDBNS2VFbFVVMmxJUTBKWVMzUXZaamhVY1RsM1QySmhNRm93Y0hNM04zaElSMXBz
      VW1rNVRXTkpORzE2VEVoSVVtVlRlaTlIYUd3NVRGTkhSWFpJTVROSVpRcGhRVXBsUTA1eGNYRjJa
      WFZGYmk5eE1YVlZNazlEUlVWTU5sUTFlWFIzTW1odlYxVm5iMUJyVEVZeWNUSXlWM2cyTlUxa09Y
      azNZbnBQUkRSTlEwbFNDbFowUXpSdldHb3JVVUptUzNSYVQydFlVR1ZFTkVaMFZqVnNPVE55TkZO
      U1VrMVhlVVI2YzJ0UlFrZGlMMkpFV0RBd1NTOXNVVm80U2pjclQyd3lNVGdLT1VOaGMxaFBlazFp
      UjNKeGNHWTJVMHRzVmpWS1QyRTRNMkZIYVZsRGNuRkJRM2hXUVdKdWNsbFJiekZyUkZoRE5TOVBV
      MjVvWm5ObmVXNVJXakZCZEFwdGFEaFdSVlpMUW1OS1JIUnFNM2QzVFZGd2FHaDBUbXhxZVZOMVVr
      Z3dWbmRJYTI1cFNWRTFkVWQyWlVGSldtZFFTVkJTVFVrek4yUTNOblp4VW10UUNqaEVSRXBVZGt0
      NVlXeGpTelZoWjI1QlZXVmhhSEJEYTFSRllVRklTMDlsUVhGSlIweElPVXhUUmt4dWFGaEpObmhs
      VkVWVWJ6ZGhNVXhQZWsxb1QwNEtaazkyVHpWTVJ6RjZNRms0YlhKWVRGQkJjR2N4UjJWUFZGbHNk
      RUkyZW1aelNWSkJabEU1TW5BMmNXSlFiamx4S3pkQk5rTlNkR1ZPTkN0WFJUZE1hQXA2TTA5eWJE
      RjRkVlY2ZWxReE4xcEJWMFpQYkFvOVkybGhNZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Enforce for root User
      lineinfile:
        path: /etc/security/pwquality.conf
        create: true
        regexp: ''
        line: enforce_for_root
        state: present
      when: '"pam" in ansible_facts.packages'


# Set Password Maximum Consecutive Repeating Characters
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_maxrepeat,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Password Maximum Consecutive Repeating Characters
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_maxrepeat: '3'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2Iyc3lRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      SlhORkF2VW10clJWZGxSMVJ4UkVzNVEyWndRelpYV1RVck9YZ0tlRFJhYzJSSWFGSlZhVE5KWTFo
      RE1ITkdWVEFyZVZsQlNtbG9abUZHZDNOTVZrUnZPVUY0U25OdWRIWTJTRU5ZVVV4blRUbFVXRWc1
      Y1RGQlMyMU5Ud3BRYTFSb09GWnhNWFZNZEhkNVRISnhibmQwUW5KeFZtdFVjRVpCU0ZScE0wSXZV
      MnBUVFV0VGFrUmphV2RtYkZJeU1XSmhjRWd4ZDAxUFZrOVFhV1JLQ2tob1NEWXpUbWxpUTNWMU1V
      WkJkRVoyU2toTFoyNUJabXhXTWpWTFMycHdNMFZXUldNMUswWjBVamRxT1hoV2EwVmhLM1ExUm5o
      d2VsWXhiWEpNVGxBS05uZHlaVFJhVURFM2EyMW1XVll2VFZKemVVOUljQzlOVFc1UFZGcDJabWxo
      ZGpFMGEwTndObkZNYld4Wkx6VmFkSFVyVldaWlp6WldObUpaWWxvMVZRcFVUa1JwZGxCc2RFUkJS
      RmxxVTBzM2NsSklWRzlTVERoYVUwRnhRMnh2UlhoeVIycDNURTl6VVdodGJtMVllSFpwWldaa2RX
      Wm5VRVpoUldNeFFWbEZDa0l6UmxZdldITktZak5EVm1FeWFEVlBPR2xoYzFKWGQyd3dXV2hWYlhG
      c05HNUxURmszTlZwek9HUlhNVVpZUVZkb1VsTTFjMHB4VG01c1YweGtRMjRLUkdSNFUydHpkRFpN
      V0RsdFpqZzNjUzlYWm1aMlZuRlRlRFozUjFSRlR6UnZURTVIYjNvek9UWTJWRTlWVjB0UmJYVkNP
      RlJaUVhSRFZFRjRNQzl4WWdweFkwaHhObmRVYUZoclVtNXlURXhOTVU5YVNXeHNPWEZNTTNWNlFX
      dzJOMkpvWkVOS1RtWXlNelJaTUU0M2JUUnNOV3AyWlVwTE1WZFVia2xoUVdjeUNtaFpOMVZMVmta
      U1ZFUktaM1JhTDBoM1RHSmphRVpGYms1eFpGUTBRVkpDUTBrMmVteEZkbkJyUXl0M05HeE1Memhs
      Y0RoMFJVaFdSMjVOVVN0M1QzSUthVmhpY2swNWVrNHdiRVkxU0ZGcmVHVnhPRE5aYUc0dmIzaGpW
      bUZPVDFCdVZFWkhkbGRJTmtZNFJFaHVTVVYxYUdGNE1qRkhPRWt3WTB4emMyUk9kZ3BKVms5Q2Rs
      TnVSM0I2TWxaR2NuZFpUVmRYTUFvOVVHMW9NQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83567-8
    - DISA-STIG-RHEL-09-611125
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Password Maximum Consecutive Repeating Characters - Ensure PAM variable maxrepeat is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*maxrepeat
        line: maxrepeat = {{ var_password_pam_maxrepeat }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Different Categories
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_minclass: '4'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VlNhMUF2TTBjeEwwcFJkRGtyV2pocGNXNU1LMmt2T1dsWFRIVUtja1U1YUcxdWVYcEZWazB3TVRO
      NlUweFhkSGxHYkZOdmF6WmhRM2hzWjFabVFtd3dSVTVyWlRGT0t6Tk9WVFZLYldNM1JtdFZiRXMw
      VUc1dk1XdFpNZ3BYUzFoeGNURlpLM2hhUmtSdmVuaHpPRlJYVUV4dU9VcHVVMnRqUW14ME9VaEdX
      ak15TlhCQlRsVkVhazVvV25OeVdsaG9jekoyVUhGSU4wcHlWM2t4Q2pKQ2EzUXhNVmhWTUhObVQy
      RktjV0U1WVVwVmVUYzJURzVHUlVjMVJ6RXhObnB2T1ZZMmRVY3ZTVEZ3TDJWTmJGZDZiemxxWWxw
      aWJWSkdVRTFuVlVNS0wybExVblZ6ZFVsSlJrOXFSMUJxYUd4WFdDOUlNazB4Y0haTFZGcDRZWGRP
      U25wMGEyaFVZVTV5T1ZrelN6UlRlVGxQVWxwSldVOVhNa2RsZWpONVJ3cG9NVE01TkdWU2JERkZM
      MXAxYjNCT1IzVndhakZQVVdjckwwZHZkVFJJVG5GM1ltVnJZbTF5ZFZaRVp6UTJWR1p6YnpaTk9U
      QktRVGhGTlZVdldGUllDblJZY205ME5XdG5aUzlNUVROVVVIUlBORWhCZGxrMmRqRTJWRnB2U0dF
      NFZWSldUa0o2ZG1KVGNUWmpUbEl4V1VacmNFdEtTV3AwWVdzMWJsQjZhMElLUzIxUmRWUnNZVlZp
      SzJKQlQxSnBRazVTT0hWNk1HbDVOblJZU2pKQmJYbzNWMmxxWkhCNU5sTXpMMWd6U0UxWGVYZDFZ
      aXN4WlUwNU9XZGpkV2RxUXdwR2EycG1WbnBWV0VsR04wTnZTblJvZVhoSU1GbG5NRVlyWjBJdmEy
      dDZWekpSWVRnNU4yUmFjbVZ5VjBOYU56VnpUVGxwYjBzeWNFUkpTMDR4VDJsU0NpOW9lVTAyTWpa
      aVZXMW1iRTVIVlV0NEwzQTNUemcxWkhoeE5YVnlkR0ZDTUdKeVFsbGFUV0ZzTldORVJHeFRUbk50
      Y0doWFJ5dHVlazVrVDI5TmNGRUtOMjlXWmk5WVIyVnJjRXRXUmpSa2VrY3liVkpYT1VaQ1YydHVO
      bXcwYVVaRVdIZElLMHhsVXpsYWNUUjVlREpqVXpOT2VHaEJWMGhNYVVWQ2RrSlVjQXByTVhSaVVE
      Uk9NR1pTTTJveVRWcGFhRlozVVFvOVJ6aDRZd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83563-7
    - DISA-STIG-RHEL-09-611130
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories - Ensure PAM variable minclass is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*minclass
        line: minclass = {{ var_password_pam_minclass }}
      when: '"pam" in ansible_facts.packages'


# Ensure PAM Enforces Password Requirements - Minimum Length
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure PAM Enforces Password Requirements - Minimum Length
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_minlen: '14'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDBRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      VnJORkF2YWsxT1R6ZFBTVlkwTkhCUU9HSmtPRmhVUzNaR1VGSUtia1JaTUN0clJVc3hOamhvZHps
      a1EzQnhUMFJaYlhaQ01GQm1TUzl3UTJaWlIzcENXa05OTms5R1NFRTNlVVIxVEcxTU1IaElOU3RW
      TjJoNUsyZFlTUXBhUlhsWFkyTkhXbEZqYjB0bFZYUlNLME5JV1hodEwyWlBXVmdyTlhjeFFrOXRV
      VFptU0dkemFWcERRMDFNWTJ0WlkyOVdUREUzTlV4QmVVbDZXa1JMQ2xWS1VrSlBOR1paWW5WR1dX
      RXlkVms0UTJoWGIzSmpNbk0zU0hOd2N5OHZaMDg1TjA5WWIyZ3hSV2RDVFZveGJrMTRTV1paU1dk
      Sk1sRXlRbUZGTkhJS01XNWlielZPWVU5T1VrSXZNVXRHTkRKWWNuUkVaR1pYWkZwR1VESTNORXh6
      VDNOeVlTdDZlV3h2ZW5SR1ZHbFNTM1ZpVkV4SlpuVlVRMGR4WVhZclpBcEhlbWRHV0ZWS2VEWjVM
      MUJuWVRSM01qUkhkR1ZOUTBsM1lVUlJSWFJYZDBzeU9FUXpabkZxU1ZaTmEzYzNkVWg2VERrdmRs
      VTNla05pUVRNemFGa3hDbUl3VG0wNE1WaFVjakE0TkVGeWRWZDZVbXRPUzBzelNGWjBkRzU0TkU5
      YWFsTkhMM2hWZVVwalNFMVpNak5CWkc5Sk9HZE9hM2MxU1RSRFpWTldUa1lLZEUxWU9FdHdSR1pt
      YUcxUlZFMDFRbWx6YzNkWWRrUnNOakV2Wm5WSlYwNUViVmc1TDA4NGFsRkVVVkF4Y21SNFNETlVi
      VnBDTWtjcmVtVmtkVEJyVEFwdVQzWm5NbVEzY214QmIyRkNkSEppVVhOeGVrMVpjamRaU1RNeE1W
      STFPVkk0UldVM1MxaE9hSFl6YzFWeFVqRXZkemM1Wlc5a1EyVm5WRVJUV0ZockNpdEpXbWhITVZO
      aVlqVnlNMU5zSzJscVdtazBNMXBIVkN0d1JrTXdTbkZpY0ZrNFRVTlRVMU5EYlhKM1dGUmhaVmhE
      Ums5dk5VUjBOV28xU21oU2RWVUtPRWhyVDFsMWVrRk9ObW8yV0NzclZuSnZVV1JyT0dkeVUyRlJV
      WFJKT1ZoRmFuYzBhQ3RSYzFWR2VWRjVkazFwTTFsaVYweDVSMGRqWVdwdmNrbE9lQXBDVlRkelQx
      cGFaVEl3U0hjMlptTk1iaXRET1FvOVZIVjFPUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83579-3
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-09-611090
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.6
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM variable minlen is set accordingly
      ansible.builtin.lineinfile:
        create: true
        dest: /etc/security/pwquality.conf
        regexp: ^#?\s*minlen
        line: minlen = {{ var_password_pam_minlen }}
      when: '"pam" in ansible_facts.packages'


# Limit Password Reuse: password-auth
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: 'Limit Password Reuse: password-auth'
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_remember: '24'
    var_password_pam_remember_control_flag: requisite,required
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      aHFWVkZCU21GYU9VcDJXbXRGVFZCS2JWQjJNbEpUU1M5cFYya0tlbGRyVTFwS2RWTmxSRlpyUm5o
      NGNIQlllbmRKVDFGbWNVUnBVR05YYzAxWllXa3dZVVZXWVdWNFIzTnpaV05MVTFwdmRIazFPRFJY
      UmtocGFrTm5iZ3BZTkdwRlFXZFFhSFY2WTB0TGNUbDNkbm93Wml0c1owcHJhVTlOZWxSdWNXbHli
      MEZCY0ZaV2JGVjJhazVWT0c4eWNURkRXR3Q1V1RsblFWbHdORXROQ2xReGNtd3lWelJtVkZSV05X
      Um1hMmQxTVhkYWQwUkVNR1ZzZEhKSkswaE5OM0pOTVcwNVExcFpSbkJVWTB4SVkyaFFMM1pWU1Rk
      aEswcE1lVmh5UWpZS2FFdE9iWFZTVVM4emVFaHNWVzlhZVVWSFIzVXpUVk15Y2pWMFZta3ZXblZQ
      YVVsdU9GWk9MM2xDTTBnMFpqaGlSbFZxWkUxYVZtTjJiRUZXY1ZoNVpRcEdVVXBFVWxKQk5XTTVS
      SE54Y0daTlUwaFpkMjVWWXpBd2NqVkxielpSUzIwck9HNXFXVXRQVDNoNGMwbDNMM1pvZFc4Mlpq
      QTNZVEl5VFRWcmNXODBDbEI0V1hvNVFuUm5PVTFoY1dkcWRDOVROeTltUjBWcVVFNUphME5QYzB4
      VU1XcGllbVo2VkV4SFUydFJMMFl2ZHpReGVscEhhaXR0TWt0aE4ySlhlWGtLY0ZCbE1IQkRWMDg0
      Y2tJdlVuWm5Wa05oWkhBMmMzZHhZMU5GYW1WcWNYbDVTRUpQU0hOa2JFTlFNa0ZMYnpaRlF6SlNl
      bFppY2s1cVEzQnBhbXA1WndwM2JVUnRURFphVWxVMWRVSktibmhuWW1aNmNERTFkWHA1WlVreFMw
      dEdTMUZPY1dKQlNrSnJNMU5FTjB3ME1rTjZlVkZYTWk5NWQyTTNUakZ2TDJ3dkNuQm9LMVI0Ymtw
      TE9EQkpkSEI0TjBKcWJUWjBSVXhqTlhod1VtWjJiV3BEYW5CaFpVSkplREZhWTFsU1YwdzJZekJD
      TkVoM1NXWlRjRlp1TUhwTVJFMEtkRGQyV21FM2QxVlVSVGwzYXpsM0sySjRiVXN6ZDB4aFJXZzJh
      VUZGTVVJd0wxVldMMVp4YW1OcGVuWnhXR3hsTWtscU5XUkViems1UTJWbmRXbEpVUXBZWlZWWFNW
      bGhOM1ozVlZKblZIUldjWFFyYlFvOWVYbEVOQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86354-8
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.7
    - accounts_password_pam_pwhistory_remember_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: password-auth - Collect the available authselect features'
      ansible.builtin.command:
        cmd: authselect list-features sssd
      register: result_authselect_available_features
      changed_when: false
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so using authselect feature'
      block:

        - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: 'Limit Password Reuse: password-auth - Get authselect current features'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: password-auth - Ensure "with-pwhistory" feature is enabled using authselect tool'
          ansible.builtin.command:
            cmd: authselect enable-feature with-pwhistory
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-pwhistory")

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists
        - result_authselect_available_features.stdout is search("with-pwhistory")

    - name: 'Limit Password Reuse: password-auth - Enable pam_pwhistory.so in appropriate PAM files'
      block:

        - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/password-auth

        - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0] }}'

        - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: password-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: password-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                insertafter: ^password.*requisite.*pam_pwquality\.so
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - |
          (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined

    - name: 'Limit Password Reuse: password-auth - Check the presence of /etc/security/pwhistory.conf file'
      ansible.builtin.stat:
        path: /etc/security/pwhistory.conf
      register: result_pwhistory_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured in /etc/security/pwhistory.conf file'
      block:

        - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember parameter in /etc/security/pwhistory.conf'
          ansible.builtin.lineinfile:
            path: /etc/security/pwhistory.conf
            regexp: ^\s*remember\s*=
            line: remember = {{ var_password_pam_remember }}
            state: present

        - name: 'Limit Password Reuse: password-auth - Ensure the pam_pwhistory.so remember parameter is removed from PAM files'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if /etc/pam.d/password-auth file is present'
              ansible.builtin.stat:
                path: /etc/pam.d/password-auth
              register: result_pam_file_present

            - name: 'Limit Password Reuse: password-auth - Check the proper remediation for the system'
              block:

                - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/pam.d/password-auth

                - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
                  ansible.builtin.stat:
                    path: /usr/bin/authselect
                  register: result_authselect_present

                - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
                  block:

                    - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
                      ansible.builtin.command:
                        cmd: authselect check
                      register: result_authselect_check_cmd
                      changed_when: false
                      failed_when: false

                    - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
                      ansible.builtin.assert:
                        that:
                          - result_authselect_check_cmd.rc == 0
                        fail_msg:
                          - authselect integrity check failed. Remediation aborted!
                          - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                          - It is not recommended to manually edit the PAM files when authselect tool is available.
                          - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                        success_msg:
                          - authselect integrity check passed

                    - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
                      ansible.builtin.shell:
                        cmd: authselect current -r | awk '{ print $1 }'
                      register: result_authselect_profile
                      changed_when: false
                      when:
                        - result_authselect_check_cmd is success

                    - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: custom/hardening
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
                      ansible.builtin.shell:
                        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                      register: result_authselect_features
                      changed_when: false
                      when:
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
                      ansible.builtin.stat:
                        path: /etc/authselect/{{ authselect_custom_profile }}
                      register: result_authselect_custom_profile_present
                      changed_when: false
                      when:
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
                      ansible.builtin.command:
                        cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                      when:
                        - result_authselect_check_cmd is success
                        - authselect_current_profile is not match("custom/")
                        - not result_authselect_custom_profile_present.stat.exists

                    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
                      ansible.builtin.command:
                        cmd: authselect select {{ authselect_custom_profile }}
                      register: result_pam_authselect_select_profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
                      ansible.builtin.command:
                        cmd: authselect enable-feature {{ item }}
                      loop: '{{ result_authselect_features.stdout_lines }}'
                      register: result_pam_authselect_restore_features
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_features is not skipped
                        - result_pam_authselect_select_profile is not skipped

                    - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - result_pam_authselect_restore_features is not skipped

                    - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
                      ansible.builtin.set_fact:
                        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
                  when:
                    - result_authselect_present.stat.exists

                - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
                  ansible.builtin.set_fact:
                    pam_module_control: ''

                - name: 'Limit Password Reuse: password-auth - Ensure the "remember" option from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
                  ansible.builtin.replace:
                    dest: '{{ pam_file_path }}'
                    regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
                    replace: \1\2
                  register: result_pam_option_removal

                - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b
                  when:
                    - result_authselect_present.stat.exists
                    - result_pam_option_removal is changed
              when:
                - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_pwhistory_conf_check.stat.exists

    - name: 'Limit Password Reuse: password-auth - pam_pwhistory.so parameters are configured in PAM files'
      block:

        - name: 'Limit Password Reuse: password-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/password-auth

        - name: 'Limit Password Reuse: password-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: password-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: password-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: password-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: password-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: password-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: password-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: password-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: password-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: password-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: password-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: password-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: password-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: password-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0

        - name: 'Limit Password Reuse: password-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: password-auth - Check if the required PAM module option is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present

        - name: 'Limit Password Reuse: password-auth - Ensure the "remember" PAM option for "pam_pwhistory.so" is included in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
            line: \1 remember={{ var_password_pam_remember }}
            state: present
          register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_add
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found == 0

        - name: 'Limit Password Reuse: password-auth - Ensure the required value for "remember" PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
            line: \1\2={{ var_password_pam_remember }} \3
          register: result_pam_accounts_password_pam_pwhistory_remember_password_auth_edit
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_password_auth_option_present.found > 0

        - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_present.stat.exists
            - (result_pam_remember_add is defined and result_pam_remember_add.changed) or (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
      when:
        - '"pam" in ansible_facts.packages'
        - not result_pwhistory_conf_check.stat.exists


# Limit Password Reuse: system-auth
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: 'Limit Password Reuse: system-auth'
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_password_pam_remember: '24'
    var_password_pam_remember_control_flag: requisite,required
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      TTRjMUF2TVN0TU9HdzJiVkJOY0hwUFVuUjVXR1ZuVFVSSkx6TUtOMFpJVTA1d2VXRkxjRWt4WTBk
      R2JYaEJiRXMyTTFFeU9WUXJjWFF6ZG5aSGNFRndOelpJZDNSSlJETkRNQzloZGpGRU9XOWpRVFZI
      Ym10M1duTjZhZ3BQYm5Sc01XdFBVR0pFUTFweEt6ZE1WemhsZFdsNE5YQkNXSFV2WjFkSGNEZzRj
      aXR1WTAxWk5scENNblZIWkRBcmFXazRVV2R3TjBwMVptMXVObkkzQ2padGNFcEJXamhvTm14eU0y
      NDBkazlaV2psMU9ETlRibk5oZWpsa00zbHJWMjlWZGpaUmNWVnlXamxpU2xjd1JXRkxkMlJwU1VG
      SFpVTTROM2gwTnpJS1dXOW1NR1Z4YW1OcFUzTTBNalZxVTB4Uk0yUkdiWEl6YXpSQkwwNUVSR1pq
      YUdOVFpHeFZkVVEyVnpNMFFqSjRRbmxaWVZKcFJURTNlRTR3VUZkcFNBbzBVM0ZCT0N0dVZFMXFk
      a1pLVG14TlJtYzNLM2h3TTJoSFdqWnBRV0k1U3psWlZHZDRUREp5ZFhscU5tOVhNamhFUkhkalFt
      OVpUSGRKWkM5ellYbHNDbG92VjBkeE1VYzBRbWxCTlhSVU0yWlZaamRpTWsxUVRFZFZVRTg0VnpV
      eFJ6SkVWREJaWkd0bmVVRlhUVUpMYkUxSVp6Um9SelJMV1RNNE5sTnFTbEVLU0dGbWJtVjFTR1JY
      YW1sVVJEbFZSMFZRUVhSM2JuTkNjMnhZZDFwdFNucElUMHMwZFZkS01GTlJhR2hZY0RZMVdYZ3li
      MnAwYldVNFNscDFNekp6YXdvek5HRnROMHhCTkRkeGFtVXJWMmRYWkV4Mk5XNHZZazB5YUVKQ2J6
      RlpNbTF5WTNSd2IyZExSVEZ0UzFWbGNERlpTa2R1SzBGblR6RkdWbEpSYTFSVENrVlhUamx0TkZa
      Q1VITmxWRXRTZVdkaWJFTk9WVTlRUWxsNGJVcERaSGN4WTFNMVFuVTJOVXh6YXpaNE1XTjViMDE2
      ZUZKbFVVSndibmRqUlN0V1owMEtSRk5WUlVoeVNXNTRWRVJGT0ZOSmNWcHhaM2cwZFZsSmJ6TmhZ
      MlY0Ykc1VmJreExOM1ZQVEU1VlpVcDZlbWhCV1c1dllUYzVRMHhWY3pNeVduUXdhUW8yVVVoWVdW
      QnZWMUFyTkhJNWVHWTFibmx5UXdvOVIxZE9RZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-89176-2
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.7
    - accounts_password_pam_pwhistory_remember_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: system-auth - Collect the available authselect features'
      ansible.builtin.command:
        cmd: authselect list-features sssd
      register: result_authselect_available_features
      changed_when: false
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so using authselect feature'
      block:

        - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: 'Limit Password Reuse: system-auth - Get authselect current features'
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: 'Limit Password Reuse: system-auth - Ensure "with-pwhistory" feature is enabled using authselect tool'
          ansible.builtin.command:
            cmd: authselect enable-feature with-pwhistory
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-pwhistory")

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists
        - result_authselect_available_features.stdout is search("with-pwhistory")

    - name: 'Limit Password Reuse: system-auth - Enable pam_pwhistory.so in appropriate PAM files'
      block:

        - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/system-auth

        - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: '{{ var_password_pam_remember_control_flag.split(",")[0] }}'

        - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                insertafter: ^password.*requisite.*pam_pwquality\.so
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - |
          (result_authselect_available_features.stdout is defined and result_authselect_available_features.stdout is not search("with-pwhistory")) or result_authselect_available_features is not defined

    - name: 'Limit Password Reuse: system-auth - Check the presence of /etc/security/pwhistory.conf file'
      ansible.builtin.stat:
        path: /etc/security/pwhistory.conf
      register: result_pwhistory_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured in /etc/security/pwhistory.conf file'
      block:

        - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember parameter in /etc/security/pwhistory.conf'
          ansible.builtin.lineinfile:
            path: /etc/security/pwhistory.conf
            regexp: ^\s*remember\s*=
            line: remember = {{ var_password_pam_remember }}
            state: present

        - name: 'Limit Password Reuse: system-auth - Ensure the pam_pwhistory.so remember parameter is removed from PAM files'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if /etc/pam.d/system-auth file is present'
              ansible.builtin.stat:
                path: /etc/pam.d/system-auth
              register: result_pam_file_present

            - name: 'Limit Password Reuse: system-auth - Check the proper remediation for the system'
              block:

                - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/pam.d/system-auth

                - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
                  ansible.builtin.stat:
                    path: /usr/bin/authselect
                  register: result_authselect_present

                - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
                  block:

                    - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
                      ansible.builtin.command:
                        cmd: authselect check
                      register: result_authselect_check_cmd
                      changed_when: false
                      failed_when: false

                    - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
                      ansible.builtin.assert:
                        that:
                          - result_authselect_check_cmd.rc == 0
                        fail_msg:
                          - authselect integrity check failed. Remediation aborted!
                          - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                          - It is not recommended to manually edit the PAM files when authselect tool is available.
                          - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                        success_msg:
                          - authselect integrity check passed

                    - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
                      ansible.builtin.shell:
                        cmd: authselect current -r | awk '{ print $1 }'
                      register: result_authselect_profile
                      changed_when: false
                      when:
                        - result_authselect_check_cmd is success

                    - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
                      ansible.builtin.set_fact:
                        authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                        authselect_custom_profile: custom/hardening
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_profile.stdout is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
                      ansible.builtin.shell:
                        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                      register: result_authselect_features
                      changed_when: false
                      when:
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
                      ansible.builtin.stat:
                        path: /etc/authselect/{{ authselect_custom_profile }}
                      register: result_authselect_custom_profile_present
                      changed_when: false
                      when:
                        - authselect_current_profile is not match("custom/")

                    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
                      ansible.builtin.command:
                        cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                      when:
                        - result_authselect_check_cmd is success
                        - authselect_current_profile is not match("custom/")
                        - not result_authselect_custom_profile_present.stat.exists

                    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
                      ansible.builtin.command:
                        cmd: authselect select {{ authselect_custom_profile }}
                      register: result_pam_authselect_select_profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - authselect_current_profile is not match("custom/")
                        - authselect_custom_profile is not match(authselect_current_profile)

                    - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
                      ansible.builtin.command:
                        cmd: authselect enable-feature {{ item }}
                      loop: '{{ result_authselect_features.stdout_lines }}'
                      register: result_pam_authselect_restore_features
                      when:
                        - result_authselect_profile is not skipped
                        - result_authselect_features is not skipped
                        - result_pam_authselect_select_profile is not skipped

                    - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                      ansible.builtin.command:
                        cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                      when:
                        - result_authselect_check_cmd is success
                        - result_authselect_profile is not skipped
                        - result_pam_authselect_restore_features is not skipped

                    - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
                      ansible.builtin.set_fact:
                        pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
                  when:
                    - result_authselect_present.stat.exists

                - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
                  ansible.builtin.set_fact:
                    pam_module_control: ''

                - name: 'Limit Password Reuse: system-auth - Ensure the "remember" option from "pam_pwhistory.so" is not present in {{ pam_file_path }}'
                  ansible.builtin.replace:
                    dest: '{{ pam_file_path }}'
                    regexp: (.*password.*pam_pwhistory.so.*)\bremember\b=?[0-9a-zA-Z]*(.*)
                    replace: \1\2
                  register: result_pam_option_removal

                - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b
                  when:
                    - result_authselect_present.stat.exists
                    - result_pam_option_removal is changed
              when:
                - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_pwhistory_conf_check.stat.exists

    - name: 'Limit Password Reuse: system-auth - pam_pwhistory.so parameters are configured in PAM files'
      block:

        - name: 'Limit Password Reuse: system-auth - Define the PAM file to be edited as a local fact'
          ansible.builtin.set_fact:
            pam_file_path: /etc/pam.d/system-auth

        - name: 'Limit Password Reuse: system-auth - Check if system relies on authselect tool'
          ansible.builtin.stat:
            path: /usr/bin/authselect
          register: result_authselect_present

        - name: 'Limit Password Reuse: system-auth - Ensure authselect custom profile is used if authselect is present'
          block:

            - name: 'Limit Password Reuse: system-auth - Check integrity of authselect current profile'
              ansible.builtin.command:
                cmd: authselect check
              register: result_authselect_check_cmd
              changed_when: false
              failed_when: false

            - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect integrity check result'
              ansible.builtin.assert:
                that:
                  - result_authselect_check_cmd.rc == 0
                fail_msg:
                  - authselect integrity check failed. Remediation aborted!
                  - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                  - It is not recommended to manually edit the PAM files when authselect tool is available.
                  - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                success_msg:
                  - authselect integrity check passed

            - name: 'Limit Password Reuse: system-auth - Get authselect current profile'
              ansible.builtin.shell:
                cmd: authselect current -r | awk '{ print $1 }'
              register: result_authselect_profile
              changed_when: false
              when:
                - result_authselect_check_cmd is success

            - name: 'Limit Password Reuse: system-auth - Define the current authselect profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is match("custom/")

            - name: 'Limit Password Reuse: system-auth - Define the new authselect custom profile as a local fact'
              ansible.builtin.set_fact:
                authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                authselect_custom_profile: custom/hardening
              when:
                - result_authselect_profile is not skipped
                - result_authselect_profile.stdout is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Get authselect current features to also enable them in the custom profile'
              ansible.builtin.shell:
                cmd: authselect current | tail -n+3 | awk '{ print $2 }'
              register: result_authselect_features
              changed_when: false
              when:
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Check if any custom profile with the same name was already created'
              ansible.builtin.stat:
                path: /etc/authselect/{{ authselect_custom_profile }}
              register: result_authselect_custom_profile_present
              changed_when: false
              when:
                - authselect_current_profile is not match("custom/")

            - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile based on the current profile'
              ansible.builtin.command:
                cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
              when:
                - result_authselect_check_cmd is success
                - authselect_current_profile is not match("custom/")
                - not result_authselect_custom_profile_present.stat.exists

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Ensure the authselect custom profile is selected'
              ansible.builtin.command:
                cmd: authselect select {{ authselect_custom_profile }}
              register: result_pam_authselect_select_profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - authselect_current_profile is not match("custom/")
                - authselect_custom_profile is not match(authselect_current_profile)

            - name: 'Limit Password Reuse: system-auth - Restore the authselect features in the custom profile'
              ansible.builtin.command:
                cmd: authselect enable-feature {{ item }}
              loop: '{{ result_authselect_features.stdout_lines }}'
              register: result_pam_authselect_restore_features
              when:
                - result_authselect_profile is not skipped
                - result_authselect_features is not skipped
                - result_pam_authselect_select_profile is not skipped

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
              when:
                - result_authselect_check_cmd is success
                - result_authselect_profile is not skipped
                - result_pam_authselect_restore_features is not skipped

            - name: 'Limit Password Reuse: system-auth - Change the PAM file to be edited according to the custom authselect profile'
              ansible.builtin.set_fact:
                pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
          when:
            - result_authselect_present.stat.exists

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: system-auth - Check if expected PAM module line is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_line_present

        - name: 'Limit Password Reuse: system-auth - Include or update the PAM module line in {{ pam_file_path }}'
          block:

            - name: 'Limit Password Reuse: system-auth - Check if required PAM module line is present in {{ pam_file_path }} with different control'
              ansible.builtin.lineinfile:
                path: '{{ pam_file_path }}'
                regexp: ^\s*password\s+.*\s+pam_pwhistory.so\s*
                state: absent
              check_mode: true
              changed_when: false
              register: result_pam_line_other_control_present

            - name: 'Limit Password Reuse: system-auth - Ensure the correct control for the required PAM module line in {{ pam_file_path }}'
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: ^(\s*password\s+).*(\bpam_pwhistory.so.*)
                replace: \1{{ pam_module_control }} \2
              register: result_pam_module_edit
              when:
                - result_pam_line_other_control_present.found == 1

            - name: 'Limit Password Reuse: system-auth - Ensure the required PAM module line is included in {{ pam_file_path }}'
              ansible.builtin.lineinfile:
                dest: '{{ pam_file_path }}'
                line: password    {{ pam_module_control }}    pam_pwhistory.so
              register: result_pam_module_add
              when:
                - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found > 1

            - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present is defined
                - result_authselect_present.stat.exists
                - |-
                  (result_pam_module_add is defined and result_pam_module_add.changed)
                   or (result_pam_module_edit is defined and result_pam_module_edit.changed)
          when:
            - result_pam_line_present.found is defined
            - result_pam_line_present.found == 0

        - name: 'Limit Password Reuse: system-auth - Define a fact for control already filtered in case filters are used'
          ansible.builtin.set_fact:
            pam_module_control: requisite

        - name: 'Limit Password Reuse: system-auth - Check if the required PAM module option is present in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s*.*\sremember\b
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present

        - name: 'Limit Password Reuse: system-auth - Ensure the "remember" PAM option for "pam_pwhistory.so" is included in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so.*)
            line: \1 remember={{ var_password_pam_remember }}
            state: present
          register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_add
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found == 0

        - name: 'Limit Password Reuse: system-auth - Ensure the required value for "remember" PAM option from "pam_pwhistory.so" in {{ pam_file_path }}'
          ansible.builtin.lineinfile:
            path: '{{ pam_file_path }}'
            backrefs: true
            regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwhistory.so\s+.*)(remember)=[0-9a-zA-Z]+\s*(.*)
            line: \1\2={{ var_password_pam_remember }} \3
          register: result_pam_accounts_password_pam_pwhistory_remember_system_auth_edit
          when:
            - result_pam_module_accounts_password_pam_pwhistory_remember_system_auth_option_present.found > 0

        - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_present.stat.exists
            - (result_pam_remember_add is defined and result_pam_remember_add.changed) or (result_pam_remember_edit is defined and result_pam_remember_edit.changed)
      when:
        - '"pam" in ansible_facts.packages'
        - not result_pwhistory_conf_check.stat.exists


# Lock Accounts After Failed Password Attempts
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Lock Accounts After Failed Password Attempts
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_passwords_pam_faillock_deny: '5'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      VlZSVkZCU1hGVUwwa3lZbU5sWmxSUWMwbGFRbkJSUVc1RGJWVUtSM2hpTUVRMVUxSTVXWFp1ZVZK
      VFIySkRRVE5FYldabFNsbG1UVVpxVFRoNlZWUlBSMUo1VTBwRVZHUXZWblJPVmtkME4wOHZUbGR1
      U0RKemQzWnhXUXBvZGxZd2NHdEtRV1pvYW01V1VtTXpkM2wyWVU1U1VHSnNTVE5UWnpobWJUWkxk
      VmR6ZVRsU2IwVnNPRzlEZDJWUlNucElXazlvWVVwVVZFVk1SSGxVQ2xJclUzRXZaM0JTTDJneVNF
      RlVVVlkwYkdaTUsweG5XSGxRVDNNMFpFTk9WVEZpTDNKUVZtSXpkaXRWTTB4T04ya3JiRUl4V0ZG
      bGVpdEJRbFl4U0d3S01pdHVjRGh0U2xCNlp5OTVUMnBaYkZCRlJHOXZPVElyY0VGYU1UbE5iRVZC
      YUdKUmFtMW1SRVpUTkdwMmFpdDJNV0ZPSzJJcloxRjRiMHBRUjNweE1BcFZUMDFDTTJreU5rbFFR
      azlpVHl0Rk5VRkViMEpsY21aSE5WWkJWVVk0WkRkM1V5OHhNV05tUjJjeVJFRklOWEV3U3psM01Y
      cFljR1ZCZGxOV2NHRklDblkxTTBaQ2JrOHZZeTlKZUZGcllXNXlTVUkzZEM5a2R6ZEViRUZwUjA5
      MlkzVkRWblV2YUhKelpEa3pkV3BOTUVSeVNEbGlMMnd5UzB4Q1RqRXdRV1lLU25RMU5WaHBZelZJ
      YjNSTFRHRm9jR2hHTVVSTFFtb3pjRFp1Unl0cGQwZzFPRGhzYkZGRmNpOW1UazR2YjJZMldYUlFl
      R055Ymk5SmR6SktPSEZqU3dwWVJWSnBkbEZWUW5CVGJYVnlNRnBNYlc5bGFFNU5XSFV3ZW5aVmVF
      MWtiV3hvWXpOc1ZHNWhUbkIzWlM5eGMwNXBNSFZPZDNGdUswZFVUV3RaWVUxQ0Nsa3lWMm95WTNo
      b01YbHRSVTFKYlVGT0sxaDFaVGRMYVdkWVpUWnJka2xNVjJ0bmRDOUZaWFIxTkRGemJtbERTbTQz
      TkdOblIwdG1jMGwwVjNsV2JWTUtaelJ1UVRSb1FqTkRUMk55WWpWWGIzQlBibkpFWlRaR1NWUjJV
      SGRQUWtkWmREZHFZbTlaWjBOamRtdERPVUkzTkVZd0wyVTVkVGt4WTJWVlNUQjZOZ3BQWkd0dFJY
      RXhaVzlhVWxsRmFXWnljSFp5ZEFvOVRHOHljd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83587-6
    - CJIS-5.5.3
    - DISA-STIG-RHEL-09-411075
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: Lock Accounts After Failed Password Attempts - Remediation where authselect tool is present
      block:

        - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Lock Accounts After Failed Password Attempts - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Lock Accounts After Failed Password Attempts - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Remediation where authselect tool is not present
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_authselect_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf file
      ansible.builtin.stat:
        path: /etc/security/faillock.conf
      register: result_faillock_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter in /etc/security/faillock.conf
      ansible.builtin.lineinfile:
        path: /etc/security/faillock.conf
        regexp: ^\s*deny\s*=
        line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter not in PAM files
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/system-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/system-auth
          register: result_pam_file_present

        - name: Lock Accounts After Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Lock Accounts After Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/system-auth

            - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Lock Accounts After Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Lock Accounts After Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Lock Accounts After Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Lock Accounts After Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/password-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/password-auth
          register: result_pam_file_present

        - name: Lock Accounts After Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Lock Accounts After Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/password-auth

            - name: Lock Accounts After Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Lock Accounts After Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Lock Accounts After Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Lock Accounts After Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Lock Accounts After Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Lock Accounts After Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Lock Accounts After Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Lock Accounts After Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Lock Accounts After Failed Password Attempts - Ensure the "deny" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so deny parameter in PAM files
      block:

        - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so deny parameter is already enabled in pam files
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail).*deny
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_deny_parameter_is_present

        - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so preauth deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
            line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found == 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of pam_faillock.so authfail deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
            line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found == 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the desired value for pam_faillock.so preauth deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found > 0

        - name: Lock Accounts After Failed Password Attempts - Ensure the desired value for pam_faillock.so authfail deny parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_deny_parameter_is_present.found > 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_faillock_conf_check.stat.exists


# Set Lockout Time For Failed Password Attempts
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Lockout Time for Failed Password Attempts
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_passwords_pam_faillock_unlock_time: '900'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      eElRVkZCU1ZCbkt6ZFFOVTlxZWpkSVYzRklSamxWUjNvNVZWTUtTVmxqWlhOVlZFNU1jWGcwTUds
      aE4wWXhUVlJWY1dkbVFUaEZlRXRXVGl0cllpOVJlbGcyU2padVlVSktPVXRMYzFWVGNtVkdSakpR
      TTBWMGQwNVhhd3BRU21OVWNGUnRUREJJY25CaE1sWklRbkp3TVRWelNYa3ZObGRtSzBWTk1tbHVh
      R3RaYUdOUGRrSk5lRVpSZHpsV01XTmxXV1pwZUZsd1ZEbE1SMU5JQ2xkSFoyWmlNekYzYlZKT1Ft
      MXVNelptWXpkVWQzWm5RVXhrVDJaUldWaEtka2s1T0VkT2VqTlBNSFprYlRCT1RFeFFhWEF2TDFo
      Tk9WUnZTV1EwVW1VS1UxVXphM0UyUjI5bkx6TnVkMjFKV0hvNU0wVkVabGhqVUdwNGFVcHRkMUJV
      VUdKUUwyMHdjMHBpZDBwWVkwMHZVbmRJV2xWcWRUY3pVMjF6SzNoS1V3cHRTVTFZYVZWNGNHSkxk
      bXB2VkhVdlNHcGliVWg2YmxGRVEwRjBLMk4yT1ZVNVNTOU9kVk5hWTNGaVowVXJRMWxwVml0WFJt
      NTRhMUZNTDNCbE56QTRDbnBNY25BMU9Ua3hUMVJCVkZBeVptcGxXRVV6U3pOaVFXeEZkM2MzVkhR
      emNIQm9PWEJQUmpsNlNXOW9OM2xEV2toTVUzRm1iMHBUZFROUGJtNXdaMmdLY1ZaemJITnpLMlJW
      Vkd4aE5pdFJXV0pLVFVSQk5HVk1TVk5aVDNORlYxaDBhelYwTjNaWk1IWXpWa3RWWnpaSU9FUkpU
      SFJXY0ZWMk9YUjNNamxpVGdwTEx6STNhRFpQZEhOekswaDJVakZ4VnpKVk9WbENXbGxhUjI1bE5X
      bHRNMnhVV1hkRFlrUkNTMEp1TVhocFNHeHljVVl2TWtWb1R6Tk9hVkZ5VVhKckNrNTZVamhFY1ha
      dFlXWXJTVVJzY2t4YWExRjNNMmxPWTJ0Q1kweHVTbmhQYVV0cFRXRllka3Q2ZDNwbWMzQmhiRUl3
      VEZSVVRFVlhkV0pxUTFNcmRIb0tTSE01UldoSWVrOWFkV1JsYUM5V1MxVlBUVnBCYVhCWFdFdEtR
      MDFTUm1GWmFTOVdNbUZOTDNOblJuaDBZamswVlhKUGJrdEdhMHhMVjFNdmVrUkpVd3B0UTNoUE9I
      cEZkR0ZEY1VjeVVERk1ORzFVWndvOVpVVjVWd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83588-4
    - CJIS-5.5.3
    - DISA-STIG-RHEL-09-411090
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"pam" in ansible_facts.packages'

    - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect tool is present
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Set Lockout Time for Failed Password Attempts - Ensure "with-faillock" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature with-faillock
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("with-faillock")

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"pam" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect tool is not present
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so is already enabled
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail)
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_is_enabled

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so preauth editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so preauth
            insertbefore: ^auth.*sufficient.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so authfail editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: auth        required      pam_faillock.so authfail
            insertbefore: ^auth.*required.*pam_deny\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so account section editing PAM files
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            line: account     required      pam_faillock.so
            insertbefore: ^account.*required.*pam_unix\.so.*
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_is_enabled.found == 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_authselect_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf file
      ansible.builtin.stat:
        path: /etc/security/faillock.conf
      register: result_faillock_conf_check
      when: '"pam" in ansible_facts.packages'

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter in /etc/security/faillock.conf
      ansible.builtin.lineinfile:
        path: /etc/security/faillock.conf
        regexp: ^\s*unlock_time\s*=
        line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
        state: present
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter not in PAM files
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/system-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/system-auth
          register: result_pam_file_present

        - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/system-auth

            - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Set Lockout Time for Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Set Lockout Time for Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/password-auth file is present
          ansible.builtin.stat:
            path: /etc/pam.d/password-auth
          register: result_pam_file_present

        - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation for the system
          block:

            - name: Set Lockout Time for Failed Password Attempts - Define the PAM file to be edited as a local fact
              ansible.builtin.set_fact:
                pam_file_path: /etc/pam.d/password-auth

            - name: Set Lockout Time for Failed Password Attempts - Check if system relies on authselect tool
              ansible.builtin.stat:
                path: /usr/bin/authselect
              register: result_authselect_present

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom profile is used if authselect is present
              block:

                - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect current profile
                  ansible.builtin.command:
                    cmd: authselect check
                  register: result_authselect_check_cmd
                  changed_when: false
                  failed_when: false

                - name: Set Lockout Time for Failed Password Attempts - Informative message based on the authselect integrity check result
                  ansible.builtin.assert:
                    that:
                      - result_authselect_check_cmd.rc == 0
                    fail_msg:
                      - authselect integrity check failed. Remediation aborted!
                      - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
                      - It is not recommended to manually edit the PAM files when authselect tool is available.
                      - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
                    success_msg:
                      - authselect integrity check passed

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current profile
                  ansible.builtin.shell:
                    cmd: authselect current -r | awk '{ print $1 }'
                  register: result_authselect_profile
                  changed_when: false
                  when:
                    - result_authselect_check_cmd is success

                - name: Set Lockout Time for Failed Password Attempts - Define the current authselect profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Define the new authselect custom profile as a local fact
                  ansible.builtin.set_fact:
                    authselect_current_profile: '{{ result_authselect_profile.stdout }}'
                    authselect_custom_profile: custom/hardening
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_profile.stdout is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Get authselect current features to also enable them in the custom profile
                  ansible.builtin.shell:
                    cmd: authselect current | tail -n+3 | awk '{ print $2 }'
                  register: result_authselect_features
                  changed_when: false
                  when:
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Check if any custom profile with the same name was already created
                  ansible.builtin.stat:
                    path: /etc/authselect/{{ authselect_custom_profile }}
                  register: result_authselect_custom_profile_present
                  changed_when: false
                  when:
                    - authselect_current_profile is not match("custom/")

                - name: Set Lockout Time for Failed Password Attempts - Create an authselect custom profile based on the current profile
                  ansible.builtin.command:
                    cmd: authselect create-profile hardening -b {{ authselect_current_profile }}
                  when:
                    - result_authselect_check_cmd is success
                    - authselect_current_profile is not match("custom/")
                    - not result_authselect_custom_profile_present.stat.exists

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect custom profile is selected
                  ansible.builtin.command:
                    cmd: authselect select {{ authselect_custom_profile }}
                  register: result_pam_authselect_select_profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - authselect_current_profile is not match("custom/")
                    - authselect_custom_profile is not match(authselect_current_profile)

                - name: Set Lockout Time for Failed Password Attempts - Restore the authselect features in the custom profile
                  ansible.builtin.command:
                    cmd: authselect enable-feature {{ item }}
                  loop: '{{ result_authselect_features.stdout_lines }}'
                  register: result_pam_authselect_restore_features
                  when:
                    - result_authselect_profile is not skipped
                    - result_authselect_features is not skipped
                    - result_pam_authselect_select_profile is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
                  ansible.builtin.command:
                    cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
                  when:
                    - result_authselect_check_cmd is success
                    - result_authselect_profile is not skipped
                    - result_pam_authselect_restore_features is not skipped

                - name: Set Lockout Time for Failed Password Attempts - Change the PAM file to be edited according to the custom authselect profile
                  ansible.builtin.set_fact:
                    pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path | basename }}
              when:
                - result_authselect_present.stat.exists

            - name: Set Lockout Time for Failed Password Attempts - Define a fact for control already filtered in case filters are used
              ansible.builtin.set_fact:
                pam_module_control: ''

            - name: Set Lockout Time for Failed Password Attempts - Ensure the "unlock_time" option from "pam_faillock.so" is not present in {{ pam_file_path }}
              ansible.builtin.replace:
                dest: '{{ pam_file_path }}'
                regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
                replace: \1\2
              register: result_pam_option_removal

            - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes are applied
              ansible.builtin.command:
                cmd: authselect apply-changes -b
              when:
                - result_authselect_present.stat.exists
                - result_pam_option_removal is changed
          when:
            - result_pam_file_present.stat.exists
      when:
        - '"pam" in ansible_facts.packages'
        - result_faillock_conf_check.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so unlock_time parameter in PAM files
      block:

        - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so unlock_time parameter is already enabled in pam files
          ansible.builtin.lineinfile:
            path: /etc/pam.d/system-auth
            regexp: .*auth.*pam_faillock\.so (preauth|authfail).*unlock_time
            state: absent
          check_mode: true
          changed_when: false
          register: result_pam_faillock_unlock_time_parameter_is_present

        - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of pam_faillock.so preauth unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
            line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of pam_faillock.so authfail unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
            line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time }}
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found == 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value for pam_faillock.so preauth unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found > 0

        - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value for pam_faillock.so authfail unlock_time parameter in auth section
          ansible.builtin.lineinfile:
            path: '{{ item }}'
            backrefs: true
            regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
            line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
            state: present
          loop:
            - /etc/pam.d/system-auth
            - /etc/pam.d/password-auth
          when:
            - result_pam_faillock_unlock_time_parameter_is_present.found > 0
      when:
        - '"pam" in ansible_facts.packages'
        - not result_faillock_conf_check.stat.exists


# Set Interactive Session Timeout
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_tmout,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set Interactive Session Timeout
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_tmout: '900'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      a3ZNRkF2YWpWQk5YaFNRVk4zUmtWMGRVSndVR1IwVGt0U1VIY0tOVUV3YzBrMGJWSjVZMkZGWmpk
      dFltZHBSR042Y0Rkb1JGQkVNbW80ZGxoaWVrSlVSVzVVVjJ3cmVWTklhRGRGTjNCRllrdENSM0Zy
      WVZWMGFYSkphUXA0VFdwWVdGVXlNRTVVVTA1VGFVSTRPWE5EVUc5RFYycDZRVXhYVTJWVGIzcDFi
      WE56VVZwUVVIQXdVbFI1YWpWTWFUWnZTRE5EWVV3M1pXUlVXa1JMQ2xNd1RYaFVjbkZSYWxnckt5
      OXZhSGg2Vm1SVlVYUm9WV3RvT0hZd2FXWkVhamhwYmtjMFVVRkRjbmt2YjBkWWEzSkJhMGhQVTBG
      eFNVWktRWFZXYkhVS2RqWTBZbE5aZWl0RVdrbFRVVk5UWjBsWVlqZ3daa2hwYlVWbU9VUmtZbFJE
      WWpSNGJ6RXhUWFJVYWpsRlVtTjZTMWRQTDNKdmFtcHhUM1prV2tFeFpnb3hTMlV3ZUdwMlZVNUxj
      RXBrZWsxak5HTmhNMlZKT1VsdWQxUm5XREIwYUZab1lsaHNOVkpRTUhoeVprNVFhV0ZLVFcxeVRY
      QlJjRGcwUkVsNGQwNDNDbEF6V2xocFlVNVBTR051YUZwamF5dHhOM2hZTDJsQ2NEbEdPVFJMTUd0
      VVEwRlBhV2xLUzJsT2NYZzFWWEV2TUROR05ETmtkWGw1UWtONWNqSmhTWGtLU3pRM1UyTkdjVFp1
      WTBkRFZUa3lMM0k1Y0ZoeWNHMVVMMjFEUlZaM1pWbHlWMUI1VTNoRFZGaG1NRU00TVZCVFpteHZR
      blV5TTNFNWVqTm9UR3hMTmdvMlkzWm1VRmxvY0VoWGRTdGlWR2hGWkhsS2RsTjFUMXBUUW5BME56
      TTNUa28zYkVobWNWRTFXRGRKYzNobWRVVkxjMlJOVDFGMVRIRm5MekpNTlVaaUNrUk5RV1ZUWm5K
      dE5IRnROR1p4WVRaSE9YWndWelEwYTJOT2JrNW1la2t6VEU5UVIxa3JlVlJ2Y1hveE1rUnFOVkpK
      Um1wSWJqSm9aSE5pVkZWVFRFc0tiVGxXVUdKcVlXVTBLM2hHWkdNMlNEWjFTbEZaTW1rNVVFZExj
      SHB0VXprM1VUaHhhbWhRVVV4MlZXMXpNazFIZWpKRlRpczNNRGs0ZGt4eVQwWk9OZ296YldaTVRX
      SnBMelJtWW5kMkwxZGFja2QyWWdvOWJHVnBWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83633-8
    - DISA-STIG-RHEL-09-412035
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSSv4-8.6
    - PCI-DSSv4-8.6.1
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Correct any occurrence of TMOUT in /etc/profile
      replace:
        path: /etc/profile
        regexp: ^[^#].*TMOUT=.*
        replace: typeset -xr TMOUT={{ var_accounts_tmout }}
      register: profile_replaced
      when: '"kernel" in ansible_facts.packages'

    - name: Set Interactive Session Timeout
      lineinfile:
        path: /etc/profile.d/tmout.sh
        create: true
        regexp: TMOUT=
        line: typeset -xr TMOUT={{ var_accounts_tmout }}
        state: present
      when: '"kernel" in ansible_facts.packages'


# Ensure the Default Bash Umask is Set Correctly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Bash Umask is Set Correctly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      QjVaMUZCU1hjM1NFcGlhbWQyZFZVd01qZHdSazF0YlZCblFWVUtPQ3M1WkVkelIwcHZPWEpGWldG
      Q1VYVjNWemxJUVU0eGRUUlFSbkYxU3pacGRrbHpWMm92ZVRObVRWcFRSa0l6WlVoMFVUVmFWa3B4
      TlZKRGIwRjROd3BNTjAxaVVVbE5RWFE1UW1keFFqVkxkWFJZU0dSMVNGRnhOM3BHT0ZGa01IcDZS
      MjFUYzA1MmFrRnRSa2hXY0d4eWJHRm1TWFpPVkdacVNtUjZUa0kwQ2k5TlZHczFabEpCVjIwMlEw
      cFBlRmRZWkdOR1JHNUxVSGRYWVhod1NUUjNNMjR2VEZveGR6bFdRVTlpUkVSeU1UaFhXRW93TVdN
      MWVWSnliVFpsZHpnS2VITlhiVGxsTDBsS1FuRndaRGxoUkM5WWMzbFdia2RzWml0M1QwaEJkbEYw
      V1dSblJXOW5TMnB0Y2tkNmRqaGFLMmg0VDJrMlVuQkVUbkJ4Tnl0Q1pBb3lia05MY2s5UE1WSlRW
      M2dyYzA5VWNsbDRhRUpvYTNOM2VUTkpMMVpzVGpRMlYweFpjVkZSTUZWcFFVNVJjR2RsVERaR2Ez
      aE5aVnBaVkVJck1rRjFDakJ3YnpKaFdtdHRNVVIyUzBsSVFUSlpPRVJ0SzNVMWNVMVRhM1ZPVkdo
      MGJqUlJOMUoxUlc1bE1FeFBVMWQ1WWtndk5tczBVVmMwS3pCMlJWQXZSbWtLUTFsbWRHdEhXa0V5
      ZUZJMk5HSk1aVEZ0UlZKbU5tVmpNRGhOV1d3eUwwOXVabmt4V0U5VlJ6QkRjMmRxVEhRMFRFRllj
      MmwwV0RReU5HeFROVFpEVUFwd2Qwa3lUazVaVFRsSlJtd3JUMFZCWWxSSVMwUjZVbFU0ZDB4VGQy
      NXhaMWR3TWxSeWFWTlJkazlGV1ZKR2NGWllRbk40WjFwc1MyNUVjM0ZoWlZCNENqSldLeXRLWW5o
      WGMwZExNbGN3ZDJkV1ozUk9jRXhtT1VRNE9IUllTR1ZGYldZck9GSmtTRGhFYzFaYVNpOWlWaloz
      TURSTU1WTmtPV1puYmxONGFERUtkWGRMTDJKWlJWVlJTbnBuVEcxVlVtZEJZMVpRUTBSWFdGbFpW
      MVpKUVZsWldsRjRkVTFVV0VGdFZubzJPSE40V1dwU1F5OXFSV2hTZVVNMVpGZDRlQXBVVVVaTVUz
      QkxRa3hqTjFrMVpYcFZVbEV5WVFvOWNWTjNkQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83644-5
    - DISA-STIG-RHEL-09-412055
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_bashrc
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Check if umask in /etc/bashrc is already set
      ansible.builtin.lineinfile:
        path: /etc/bashrc
        regexp: ^[^#]*\bumask\s+\d+$
        state: absent
      check_mode: true
      changed_when: false
      register: umask_replace
      when: '"bash" in ansible_facts.packages'

    - name: Replace user umask in /etc/bashrc
      ansible.builtin.replace:
        path: /etc/bashrc
        regexp: ^([^#]*\b)umask\s+\d+$
        replace: \g<1>umask {{ var_accounts_user_umask }}
      when:
        - '"bash" in ansible_facts.packages'
        - umask_replace.found > 0

    - name: Ensure the Default umask is Appended Correctly
      ansible.builtin.lineinfile:
        create: true
        path: /etc/bashrc
        line: umask {{ var_accounts_user_umask }}
      when:
        - '"bash" in ansible_facts.packages'
        - umask_replace.found == 0


# Ensure the Default Umask is Set Correctly in login.defs
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Umask is Set Correctly in login.defs
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      aHNhMUF2TUZwU1JITnRUMWdyYkhob2VscG1WVEJSUjFaVmQzTUtjMGRDUnpaRVNpdG1lRVV5ZUVO
      RFRFZHhNVGRoVjBRMlVYa3hjSEZwVVZsbFRpOW1Va1JCTWs1UWRrOUtLMlJ1VmxKd2FFSmpNVFUy
      ZGtscVFVSlNiUXBzZEZoVlQyOXdZbFJ5TTFCNWVWbHpjMWRTUjJ0V0wzZEZlU3NyYlhwWFdXNDBU
      bXRSY1U5RWVUSlVWbll3Y1hGTVlsQnVVVGR6YzNKVWEySXJTekp2Q21OQlpHdFNVMUlyVVhGV1Iz
      WjZTV04wVEhGWWMwaEhVbGRqYjJaNFZ6Qk1aWGMwWnpKVWFEZGxTSEYwV1RkVmFVaDZZMk5rUzJG
      VU1tVlZTakpSTm04S0syVmhPRzU2WWtRNFNtNUNlbmdyTmtGMFZWTnlObFYyYjNweFowbHdOV05Z
      TlN0WmFXc3ZNSGRZYnpGYVREUlBkbEZQU2tWeGRtSnlRa2wyYzBGalVBcHhVVXRhYUhOUVRISlZR
      Mng0TlVwTFZXUlNNVFpHY1hKS2RFZFZTVGR3WW5STmVGZHJZWEphWTFrMFRHRkdiVVZxYm5seVNt
      VkVOVE0zVVhwUmQwUnlDbTR5VEZKdFNYTlpiMUpTYWtGaGRuVTFaWGhCWlRoMU1EUnZha293Ym5s
      NmVUWnhaamx1VUN0eWFuVmlkVWx0UTFrM1kyMVRSWGd5ZG5WSlUyNWFiakVLV1hWaFJFUldiWGRP
      Y0VobE1GVjFjM1pSTVNzMlIxTlVTVFk0UXpSMlEzTmtUVEo1UjA5S1dXNVpUbUUzT0ZRemFXVjFP
      WGxFTkVGMk9Xd3hXalZvVGdwTE1reEJTekp2ZVROYWVtRjFObFJMY21Rck56bDFNbmMwVURVNGIw
      dEliMEU1YUZCeFZrZFlORkZKTkU1elVVZE1hMlpsYW00NWJHSkNORFJJU1VrdkNub3labGh5VjNn
      MFUweHJRMnQyTUhFNVQzWXpTR1pNUkhWalVUQk9Wa3gxY0hvNWNrZGhkRzlTYVhseGJGQnllVlpR
      TWxOdk4yMW9aV2hWY1hOUVNrWUtRbk5NV0VjMGJ6WkhLMUZhT1doUldUQTBNWGcxV1VaR2JuQmxT
      MVYxTVc4MksyMVlaVlZGTVc0cmJGTTBPRXBIYm1kdVlucHdhQzk1UVhKTE4yNHlLd3BTTWt0b1Ey
      d3JUbGhTWm1sdlduZFBPWE53YlFvOWQyUmFkd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83647-8
    - DISA-STIG-RHEL-09-412065
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Check if UMASK is already set
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        regexp: ^(\s*)UMASK\s+.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_umask_is_set
      when: '"shadow-utils" in ansible_facts.packages'

    - name: Replace user UMASK in /etc/login.defs
      ansible.builtin.replace:
        path: /etc/login.defs
        regexp: ^(\s*)UMASK(\s+).*
        replace: \g<1>UMASK\g<2>{{ var_accounts_user_umask }}
      when:
        - '"shadow-utils" in ansible_facts.packages'
        - result_umask_is_set.found > 0

    - name: Ensure the Default UMASK is Appended Correctly
      ansible.builtin.lineinfile:
        create: true
        path: /etc/login.defs
        line: UMASK {{ var_accounts_user_umask }}
      when:
        - '"shadow-utils" in ansible_facts.packages'
        - result_umask_is_set.found == 0


# Ensure the Default Umask is Set Correctly in /etc/profile
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Default Umask is Set Correctly in /etc/profile
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_accounts_user_umask: '027'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      RjRWVkF2TTBsU1JXcDVlSFpqVlhCMVdreFlXWFp5V0hOc2RHOEtTMWhTZGtGemNYa3haRU5YY0d4
      UUt6bERXbk5JY2sxdmJEWTRkekpDYkhGVk9FTnVhSGh4UjNGemIyTnRMMlo0ZERaamIzcHFOMnBx
      SzFkeVF6UTFUQXBVU0RkaE9EbGtWbVJyY1hZd09XdFpUR3czWVdGeE1qUmlSSHBLU1dwMFVYZGxl
      WFpET1hSVGFHbzJaRE4zVFVsME0zVlBUR3hUTDJadmFGQjJRVEF2Q2xwa1RTOXBSMFZGWTJWNFlY
      TnZiMlZsUVhwa2F6Y3dXbGh5UXk5Vk9GbDBiV0pYVTFwTk5GaG9PV1JyYzFCMlRrbHdkekZ0TTA1
      TVJYbDBNREZzUTFnS2MyODNSMmhYYzFVek5pdDNVRkpqU2xBdlRVVkVVRkphYXk5M2Fqa3dSRUp3
      UlZCdmMwMUlOalp2ZVZFclVTOHZSbTB5TDBjMVZ6QnFVbEZQVDBwUVV3cG9aV1ZqSzFwdWFFMDFT
      M05QTkdWWVFqTXJTM1kwZWxVeVlVOVhjbFpWZUhwWWNtaDRNM2R0ZVROVmEyZzNXVEprWjNoVlMx
      Vk5kQ3RTV1dsTloxSmpDbVpSZEhneEwzVTBLMWxLUzBGS1NtczNWeTluVHpCWVVIaERkMWhMVlhk
      WmQweEJiMDhyVG1wNmMxWXpUVGRvTUhsS2FVRlVkV3AyYUVKQ05UaFRTMUlLYmk5VlZtUXlaR281
      Y0cxSlQwbFNTbXh2YlZJM2JqSTJlREZHWldZeldTdEtRMHA1ZDFSMVRYRkVkMGRhUjNoQ1dVaDNj
      MkpoU0ZJeVVHdG5aVTVxTWdwVVFrOHJhamd2Y0ROM1VTdERVM1JzTlhJM1JEVlRSME5wVFZNcmFX
      UTRXbGQwVWtaa05tdDFRVFJ2VG5OT1UyNHpiM2x5ZVRadU9VSnRhRUZsZWk5dENrOVJjWGxsTWxW
      TFNWZFZjalJEUldKMVkzRkpkRE5JV1RWMlNVVnRXSEJNTTBGTVUwTlNha3gwWjFKcVRWY3llbUpt
      TmpOSmNXWndOMlpWVEZabVlqRUtZM0puVDBKSFRqQXpjSEF5ZEhkVE9VaG9WR1owVG1oaVYxWXll
      WEphZUVvM1dXWmlhSEI2V0hCYWJrVkJkMkZPTkhaU2RtazFlakpuVGpGUUsxWkZid28yVEd4dlpI
      UkdUa1ppWkd0WGRITlNkVEZrV1FvOVRWUlBkUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90828-5
    - DISA-STIG-RHEL-09-412070
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_profile
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Locate Profile Configuration Files Where umask Is Defined
      ansible.builtin.find:
        paths:
          - /etc/profile.d
        patterns:
          - sh.local
          - '*.sh'
        contains: ^[\s]*umask\s+\d+
      register: result_profile_d_files

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Replace Existing umask Value in Files From /etc/profile.d
      ansible.builtin.replace:
        path: '{{ item.path }}'
        regexp: ^(\s*)umask\s+\d+
        replace: \1umask {{ var_accounts_user_umask }}
      loop: '{{ result_profile_d_files.files }}'
      register: result_umask_replaced_profile_d
      when: result_profile_d_files.matched

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Is Set in /etc/profile if Not Already Set Elsewhere
      ansible.builtin.lineinfile:
        create: true
        mode: 420
        path: /etc/profile
        line: umask {{ var_accounts_user_umask }}
      when: not result_profile_d_files.matched

    - name: Ensure the Default Umask is Set Correctly in /etc/profile - Ensure umask Value For All Existing umask Definition in /etc/profile
      ansible.builtin.replace:
        path: /etc/profile
        regexp: ^(\s*)umask\s+\d+
        replace: \1umask {{ var_accounts_user_umask }}
      register: result_umask_replaced_profile


# Build and Test AIDE Database
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_build_database,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Build and Test AIDE Database
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83438-2
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-09-651010
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      VmpUVkZCU2xJelFqa3paVFpHVm04eEt6SmliMUJ3Y0RWRWVtUUtVRW96Vm14eE9GTnhZVGhGVkc5
      aGEwMWtjMjlOUTNCNFUyODFaMlV5UlhsU2VrTTJNSFUxTVdkS2NIa3hSRlJpWTNkV2VEaDBOR0o2
      U1VjMlpWY3JVd3BCU20xa05IbGFhREJ1Y1U1RlNYRnJZV00yVlZvelVIVXpRMmQzZDJwdk4yVnVi
      VFZsUzNSbFNqaFFWMGhKWTNJMk0yOUZiR1ZKWWxCdFRYbE9NREl2Q2tsMFdYQjVRMUJVVFU0M1Qy
      MHJXV05VVkRCSlEyRklSbkoyVURGSGMzUjRTbTFPYjJnelJrTkJSRGxQY1RCRlZUQnRZVFZ0U1c4
      MVYwOW1ZWEJETVhBS01rMUlVMkUwUzB3MFQyd3JSR1ZXYUd0UmRrcFBaVzVETkZkVWNua3ZWRGxU
      YTNsMlZGaHBiVEZvU0ZwalJVdzBhMkZsYlRRMlpHUkJkMlY1ZVdkQ05RcHJlRXBhWXpoTU4yMXFL
      MlpFWW1kNGJUQktja3hFYVhCSGFUVkxTbGhVYmpWQ1RsTTVhVmhKYmxJd2IzbFRWRWhDTDNkcE0w
      bzVaRFJwZFUxNlNYYzBDbmxITjNoeU4wOW1lbm93ZVdaWGJtMHJkVkZNVkd0TVpIbERkRGN6YWtS
      cE5HZ3JPVkpGTTNNM1RERnJReXRoVlRCM1dHa3ZRMUZLZVVOWVVsQTJVMEVLUlRSTFNVbFBZamN3
      YTNwSGRVbzJVa05yTW1GS05pdEJNR0kyZVhwQ1RHeENUV2N2WjNsQlFYaEdhR0p0VDNsUGJtTkxi
      amxDUTJsT00xRnpUWGs0VFFwU1YyNDJVeXRxUkRaeE1UQjRURzVFY0RnNU9HSnJUVE5rTnpaU1RW
      SjZPRFpUS3pCRFNsQkpabTlITm5GSmFIVXdabEU0UzIxNGVVdFpaVzlWWkc5Q0NrTm5aWGhHWjBs
      MVIwRXlSV04yV1VOelRXVnZZekJtZGxOc1VpOU9NakpSZDJWVllVRmhlbWMzV0ZaU2JqSklNREZ2
      YjBZd1lrNTZWbE5aYVdkaGNHc0tjVWhSY0VkV1kzZHhNR05OZEhGalVsTnlOVEZOVUU1MmFESjFi
      V2xCUldab1JXSkVUbm94VFRWdWMwdzBZbkpwTTBKMVRXNXhjMWRTTTB4Mk9IQnJkQXBMVEZkQlNr
      Rk9jazFtWkhsVFExaHViVmxqTHdvOVRsazJjQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Build and Test AIDE Database - Ensure AIDE Is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Build and Test AIDE Database
      ansible.builtin.command: /usr/sbin/aide --init
      changed_when: true
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Check Whether the Stock AIDE Database Exists
      ansible.builtin.stat:
        path: /var/lib/aide/aide.db.new.gz
      register: aide_database_stat
      when: '"kernel" in ansible_facts.packages'

    - name: Build and Test AIDE Database - Stage AIDE Database
      ansible.builtin.copy:
        src: /var/lib/aide/aide.db.new.gz
        dest: /var/lib/aide/aide.db.gz
        backup: true
        remote_src: true
      when:
        - '"kernel" in ansible_facts.packages'
        - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)


# Configure AIDE to Verify the Audit Tools
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_check_audit_tools,fix)
# Version: undefined
# platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure AIDE to Verify the Audit Tools
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-87757-1
    - DISA-STIG-RHEL-09-651025
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      cEdTVkZCU21OVWNGb3lWVnBKYzBocU9VZGhNblJITkdwT1lrc0tUM294YlVGbllWbFpTbGxzVEVV
      MFpVUTFabTVCUWpBMlVFeHlNVEZUZEc4NVoyRk5NMjlJWjJwcVJGcEZja2MyUTA0eWVTOHZNRVZE
      T0U5WU1GRmxOZ3BQWmpKVGVEWnRjMU5ZSzJWaVUxSnlTREJDZWxCMU9ITk1hR1o0Um1sV1lWWktS
      RUZCTmtOTmVVWlNNamRsYlhSdE9FeEthMk5RU1RkSFVFZHRkalZ6Q25OeFlrWlpZVlpPTVROemNG
      cEZjM2xoTWxOdGQyODFTVFE0WW5Cd01XazFMM1pNVGxRclpVRTViRGxxVkdwcFdGQjVaazVpTlVr
      clJHbGpXbWw2Y0VRS2FVdGhUamM1V0dkdE1scE5WMnhOZDJnM1dDdGlOVEp2YlZsWU1HY3ZSbk4y
      U1ZsU1pFZG5WMWhTVTBOMmRsWmxXbE5JWkd4RVMyVk9RVWcyWmt0c01RbzFjREJCVkc1blJVRXJW
      MVZXV1V0M1RHMWhaRmRVVEdGVlFTOWplakYzZUZGcWQwd3Zia3hNY2pWSGJubGtkSEY0YTBkNmEw
      eEVTSFYzVmtOT05VRnNDbmxFVVRoS1puZDVXRmhRT0VGU1dEQnBiV1l4VldsMmNucDZiMWx6YzFG
      NFdtdDZTamRKT1dOc2VISjBjazlvTkhwaVpXUkJkSGN5VmsxUVIwcEVSbklLYjBkMFZVVTVabU5G
      UzBZNFZXOVJjR3R6VTFoc1FWaHJNMHd3ZVhObGFrbE1OM0pxTUVsbUsxaGFkelUxZFZCdVJtdFpO
      VFUwVkVSRE1USTFOMDAzTmdwVWNHYzNWbHBCTldzcmVIRjBjbFZUZG1GbE5ucGFXV2wzVTFSM2JV
      dDFZMHg2Y1dsM1ptUktXVU5JZGtOeWVXcFRjMVk1VFZnMVREaGxka1pSYWxOVUNqbExUbFJyZVhW
      clFXaG5kRFZtVjBkWVdFTTJOakZ6VUU1bFZtTlpkME5XTUZOSVNFZFZXbTkzWVZCNlZrODFaWG8z
      UWt0eVJpOVZkRVpaWTBOVk5XNEtTWEZwZWpKUFMwUkhWbXBTU2xvMFJtb3pNR1JGYVdWRmNrSmtj
      MFpKT0VkWWNscDBOMEpTWVhKWlkweFRVR1ZHVlRKcWMyZDBhM0phTkU1bFQydGFaQXAxTm04NWJp
      OTZVME00UVRoRU1sZzROV3d6U1FvOVQycE5lZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure AIDE to Verify the Audit Tools - Gather List of Packages
      ansible.builtin.package_facts:
        manager: auto
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure aide is installed
      package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Set audit_tools fact
      set_fact:
        audit_tools:
          - /usr/sbin/auditctl
          - /usr/sbin/auditd
          - /usr/sbin/augenrules
          - /usr/sbin/aureport
          - /usr/sbin/ausearch
          - /usr/sbin/autrace
          - /usr/sbin/rsyslogd
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure existing AIDE configuration for audit tools are correct
      lineinfile:
        path: /etc/aide.conf
        regexp: ^{{ item }}\s
        line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
      with_items: '{{ audit_tools }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Configure AIDE to properly protect audit tools
      lineinfile:
        path: /etc/aide.conf
        line: '{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512'
      with_items: '{{ audit_tools }}'
      when: '"kernel" in ansible_facts.packages'


# Configure Periodic Execution of AIDE
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure Periodic Execution of AIDE
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83437-4
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-09-651015
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      VlFUVkF2UVhOcU5uQmlNbHBuTld3eVoydzFSRE5yV0ZCNFNGWUtOR3hCYUhJd1JtcEdWMnRJYkV4
      TFpYVlVhSHBTY0N0Rk1tTnhLeXMwT1ZwVlVGaExNMUJVWmpGUU4xUjBPRmhGTDJ4alpGRkNlbFI0
      TWpGTWRUTlBhQW95Vm5CclRVeFBaMEZVZG5Jck4yUm5lVVZMVjJkWmNGTklaVTF4U3psVFMzVkph
      bWhoVDBoRmVFcHlOemcyS3padFprZHlWMGxOVmprMUt6aE9URU5CQ21aNU4xcDRlRlJQTTFaUWJu
      RjJiMHRRU0hGT2RtdzJlRFZLYm5Oc1UwZzBTR0pOVTBWaWNHMDJkMVpGVW1VMkwzWnRVMEp1V25C
      NlNUQm5RVEJVV2prS1RESm9aVFp3TkdJdlRVOVhZV3hWVG1wMWExbHRWVVpTV0RoT1JGaEVVMWRY
      WVVjM1pYSlNTMDVWVTJoM1EwTTRiQzlCVDA5QlkxVmpkbmcwY2pGVmRBcGFRbkZrUjFaQmMzVmxP
      VVJHVm1GR1lqUjNZWEpMWlZoME1rYzRUMDVKYlV0MVVUVkNZelZUTjBKcWRXMXJXVlp1VjBnclVE
      ZHNXR1E0WVRCS2VXbzFDalJOY1ZKRWRFWXplbFJDWVhNNGFIUjNTa1ZwWlNzeVMyUkhXRGxpWmxG
      QlkzUm9PVmhKZVhWNFdHaFpOVFozTVZOVFJtTjFaVmRoWnpGa2FtRk1LMGdLWTNGc2EwZzBPVWRD
      T1hGUWRYTnRNMjQzYUVzeE5WZEliM3A1UVhaNFprSjRSWE5sUlZOeU5qa3JVSFJTTlZvME1Ea3ZV
      emRzZW1RMGEzUmlXa3BYWndwR04yZHVURlJFYlU1NmJHZzROSFJZZGsxMVMyZzRiekJvU1d4S2Vr
      SmFWM3BtUTFoeFIySTJjVWhaVlRneWJYRkNURTFKV2tOMWRUY3ZhbWhNWkdvMUNsazNVSFF4VDFa
      VlVGVkZURVZWU2s1SlNraFNaMW8zYld4eGJXNWxTalpEVjA5SmIyVlFPR1I1TVRWVU5uaDRWVXB4
      V1VFdlluZFdablI0Tms1YU0wWUtiM05ITWtwWWNWRkhRa1Z6UTJWcU5VczRTVVp4VkhGeE5reGFP
      RlpMY0haTmJteGpkemNyYUhaaE4ycERWWEZ1VmpocmJ6ZERka3BpUzNJMlEza3hRd293YVVGeE9H
      eFpNa2xyUW1wR2JHMVZSVXRpUVFvOWRteHdSUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure AIDE is installed
      package:
        name: '{{ item }}'
        state: present
      with_items:
        - aide
      when: '"kernel" in ansible_facts.packages'

    - name: Set cron package name - RedHat
      set_fact:
        cron_pkg_name: cronie
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_os_family == "RedHat" or ansible_os_family == "Suse"

    - name: Set cron package name - Debian
      set_fact:
        cron_pkg_name: cron
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_os_family == "Debian"

    - name: Install cron
      package:
        name: '{{ cron_pkg_name }}'
        state: present
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Periodic Execution of AIDE
      cron:
        name: run AIDE check
        minute: 5
        hour: 4
        weekday: 0
        user: root
        job: /usr/sbin/aide --check
      when: '"kernel" in ansible_facts.packages'


# Ensure Local Login Warning Banner Is Configured Properly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_banner_etc_issue_cis,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Local Login Warning Banner Is Configured Properly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    cis_banner_text: Authorized users only. All activity may be monitored and reported.
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      SnZSVkZCU1dsSGF6VXhjR1p2YlM5U2FGb3hRM2N6Ym1WamR6RUtXRzlCZW00ellVcEZlVFpDVWxk
      c2JYWXJVV3BvZUhOeFFVbFNTM1l5T1hCMWRHcERjR0YwZURoU2JVcHNRVmcxYjFwVWJ6bFVUR3BF
      VTJJMFJrRjRXUW80WlVkeVlrbFllWGhQWTBGRlVVMVRaV2hIWVVsRE5tZ3ZObE50VGtreEx6TkNO
      WGRJVW1jcmR6UjBORmQ2UkRRNU9UTjFiWEU1Y0ZsSE0yRlRZaXRKQ25BM0sxcG9RM2hrVW5KeFJX
      cHRUa3ByYWxWTVlVdHBXVFJQVG1sc1UwbzNUR2hVYmtWMVRTOUNkVVpoWTNWUWNqbDJUREZFWW5N
      MlRrWnFiM0JDY1RZS2JXTTNabkJtWVVGMFdraGxRbEE1V1dVM1YyMXRSMk54Umxkalp6TlhWbTAz
      TldoQ1dESTVVMHRDVW5RNWQydHFkVEEyVTA1UlYwVnNOalVyZFhGR1pBcFZiRFZzTUU1VVJHYzVk
      R292V25kVGF6QjFWVlZCVm5wcVl6bFhTREZuVVU1R2NFNWFTSE53YVZsWE5saHRVVUZMYWtOWVIx
      bGxVbXhYV0dkRWRWa3ZDazVpTlUxSWNFMDFaWE13ZWxkQ05FSnJiVGRoYkhKWFluUklVMmN3ZUVw
      SGNEVTRRMUl3ZG5waWFGVTBabmRrV0Uxb01GUTBZVlJxYlhFelMyTXJjM01LT1hCMFdIcEdkVkV2
      VURZdmVtaFZhbHAxTkVWYVRsbHFNUzlGZW5velEydFhabFJvYlRkMlRDdHhZM28yYURFeVRIcEdX
      RWhpUzNOaVUzWm9hSEE1V2dvNWVsYzBNVEppYlhCbFJYZFRjVGQxYm5ZeVZWQXpNREZqVDB3Mkww
      MXpOamRWWTFKbVNVRjBhMjluTkdZMmIyWm1NVlYyYTNaaFNYQjZNRFJGV0ZwSUNtdzBRVkF6Ykhj
      M09FNVhVR3huTW5KSWNuRlRkRTlQUTFsRWRHRnRZM1pLYml0M1V5OVRabVZ5ZVc5SGRUUnBlbGxF
      V21KNE55OU9iRGhaVlUwemFWVUtkRTloUmpSUFZraG1WR2R4T0dOa1owWlpXRGhLY0dKelFrcEZN
      Vlp5Vkd0WFMyNW1RakJyTWtnNFZUbFpaMHhGU0VzeE1IUkdkRFYzUTJKdWJEZERkUXBSYms1MGRV
      RnFRMVp6UzJkRU5WbG1USFpoZFFvOU9EVktad290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86142-7
    - banner_etc_issue_cis
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure Local Login Warning Banner Is Configured Properly - Copy using inline content
      ansible.builtin.copy:
        content: '{{ cis_banner_text }}'
        dest: /etc/issue
      when: '"kernel" in ansible_facts.packages'


# Ensure Remote Login Warning Banner Is Configured Properly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_banner_etc_issue_net_cis,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Remote Login Warning Banner Is Configured Properly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    cis_banner_text: Authorized users only. All activity may be monitored and reported.
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      TkZNRkF2VWpVeGVIWm9UU3NyYVRaRU1tUkZWRE5xZEZFNWNVMEtWMGxXYTFCSWNYbEVibUZxYVVO
      SWFURmtTRUZQYkRSTFFWbHlVMGRsUTFSMVREVlpUamh4VGpkV2N6RmtaRFJ5WlRneVNGaEhVU3R4
      YUVZNU4wb3lOZ3BaZEhvMUwwWldRa0lyUmtKcFNsTktXVUZSV0c1eldqQjZVa2N6WldkUE5VeFZW
      eXRYTWs4MlIzVTFabWR3V1d0clNITmxPV0pEVGxoRFNXcFBVelJZQ214RGFHbEljeXRxV0RabGQy
      cDNSazlFTlRrMlJteHNPVkJRZG5aNE1sSkJiVnBsTTNCa05qaHFXRkF2U2xGNlRsQkNWRWRMZVVW
      SU9EZHZRbWcxVEUwS2JuTkhVbVJHVVhVMk5FNVhNa2gwUTFWdlFUSkNhR1pZTDBOSU9XZ3lXa2wx
      UjFjNVowVk1iek51U2pKYVpUaE1jVFl3V1haRFJYZENUM2xYUzI5UFRBcEhNVUZyWm05aE4wZHpT
      bEJEUWxKNVIyNHZibmxqT1hSaWRHNUpXRUphUmtneFoyODBSRlZITUVablUzTnFkemN5TTIweksz
      SnRWbnBvT1hGV01EbFdDbTFvVnpGYWIxZElURGxFV25aSFJtZzBRME40YmxkV01ITnhhWFphZWtG
      amRsaHJXVkZQYUZVemEwNVdWbGQ0VWxSaGJXeGtXbmwyY2tZMmExbExObFlLWTNob01rWk5WRlZL
      ZW5wcVZVWnJkV1F4UkZkMVJreDRZMEl6V1RocVpHTmtVbmRzYlRkWk5sQkJjMGxOTjI0MU5FVlpT
      MWhyTlhwRU1UbExlVmxoTkFwcmVXZExlWEpRU201aFRrVXpXR2hqT1hCaWRuWk1PRVpXVnpGb1Js
      SXlhRXhsUzJ4dGFFUlBaVVExYVRnMGRrUkNOWHBQUlhST1VXY3lVVzFGWjBkckNtRlhORWMyVlRS
      UVZXeDVNeTl3YmtnMWEwRktibmxHWmxGUVMzZENZMHBqUnpGM1NqbDRZV1JwU2t4YWJHSXhhMjlF
      UW1KblduRXZWR2xEVHl0NGNXNEtjRkpyWkRScldXeEtkM1ZEZVhseFMwTm5hRUpQY21kaGEzSnNj
      RkZXYkhwcmRtRnBSRUkzWkc1ck5Fa3pXbGRRVkhOSU0xRjVWeTlRTjB3emJ6VkViQW92UzB3MmRu
      SjJhMnA0T0hGR2MyeG9kek5sVEFvOWExcEpaZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86143-5
    - banner_etc_issue_net_cis
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure Remote Login Warning Banner Is Configured Properly - Copy using inline content
      ansible.builtin.copy:
        content: '{{ cis_banner_text }}'
        dest: /etc/issue.net
      when: '"kernel" in ansible_facts.packages'


# Configure System Cryptography Policy
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_configure_crypto_policy,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Configure System Cryptography Policy
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_system_crypto_policy: DEFAULT:NO-SHA1
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      QTJSVkF2VWxaWlJWQlRNeXR1T1VNNGMxQnNkRTFCVTBKWldEY0tWVVZTWlZZNVQybHNiSFl2TDB4
      V1dGQm9Na3R4Y2taUVYzaEdNbEJRWlM5a2QxZDNTa3h0TmpSUFoxRlVaRGRtZGpKcVRYRlVja1ZJ
      UldWTWMzWkJNUXBaTTBwWlVraE9ReXQzTUZWTmNqSTNLMVp2Y0VwR2REUXhjSEJCZERNNFpVbzJh
      bkJhUjNWRFV6bERiM0pxY1hkWVdTOWhSbmxyUzBrNWVGWkpVV3hWQ2xWMlkzUlBkSFZzVUVzMmRI
      Uk9ZVU0wV0ZNd1NXSTNaamd6VUV0V01tRjRTMjFLTVdObFpUSndUMkZuUTBZMFNISm9SazVyUlN0
      eFZEQlJNV1Z2VHpJS1VUTTVjMFphYTBaV01rWmxVRXQwTWpFeGVIZDJXbUU0TlhaNlRVNXhZME5W
      Ym5oMU1EZzBZbFZ1Wms1elVpdDFjelZTTW5WV1p6aHVTRk53ZEV0WFRRcHRRVTFzTVhaNlFtSTVX
      RWRXUlhSRVYxbHdkVmRFTkhwSWRrMDJSMnB3U3pJeE1FeFhOblZRUlVFMVlVRlFUV1Z4YjA5QllX
      STRjbFJEYlcxSFVFNXJDbTV4VjJ0alIyc3hlVmQ2V2pBcmFGUk5jbFUwYURFelRHOW1kREpSWlZK
      WllqWmhVV3MwYjNRMVdHdE1iRzkxVjNrdldtWTVUamh1VlVkTVdIRlFUVllLU2pOMlRVUlRabTg1
      YlUxQ1dGUTNSR1IzUm1FME1rZFZTM2hxT1hwTlRrSjFlV3BsYWs1WE1YbFlUbGxzT1VsNVVISkNj
      VkZYVm1NdlFsSkpZbU5QVGdwRmVVUm5XR1U0UVRoM1MxQkJia1ZSZG1wa1UxRk5UbTF1TTBaNWFH
      UjNUMmRDVG5KS1JVUTFiemhPY1c1dmNWbHplVTg0Um1WT01FWnFjUzhyVTJGdUNtTnRjM2hQZFVw
      dlVrSk5SRzlpU1hCUlFUTlJWa3czVmpjdlVGbzRLMkpYZW1OTlNVOTJlWFpHVWtwaFdrVjRNMVpE
      TVdGdGRXWkJZbUZyVEdRM2RWWUtZVlZWVnpWSFEzazVVbWR3UjFaM2VFWjJNazgxWVZoRllYWldW
      ekF5UzFJellYcFpkREp0WWpoWE1IZFViSGRFTWpWdVFqbHNhSFFyYW1KeE5WZzRTUXA1TUdwTU0z
      bFRhMjVsTlVsamNsRlJWV3BzYlFvOVozaFVOZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83450-7
    - DISA-STIG-RHEL-09-671010
    - DISA-STIG-RHEL-09-672030
    - DISA-STIG-RHEL-09-672045
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Configure System Cryptography Policy
      lineinfile:
        path: /etc/crypto-policies/config
        regexp: ^(?!#)(\S+)$
        line: '{{ var_system_crypto_policy }}'
        create: true

    - name: Verify that Crypto Policy is Set (runtime)
      command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}


# Disable core dump backtraces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_coredump_disable_backtraces,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable core dump backtraces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83984-5
    - DISA-STIG-RHEL-09-213085
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      SkliMUF2TVZWakwzUmlaSEUzZG5WaWJEUjNablpCWjJwVGRIb0tiSGx4Y0hFeU0wOVNhME5XTldO
      MFJUVnRRMmR4Ym5keWFGaG5SVlZ0TWtWTU1XVnBNMVl4U0dWMFQza3lWVk5KU2xsd1JtcEtPVGM0
      ZVZsTmRESjVTd3A2TDJ0dVoyaFVibGhtYVdseGRXaHhUSEZWU2t0VFVUa3ZhVlF4TjFkdVYycHpM
      MkZpZVUxSVFWWmFkVFptVjJaM2JHSkVkemwxTUZaU1kzcERVVkJ6Q2tac09VeDFjbFpXVG1WVk9G
      SmpORnBZTmpkVFQwZGpabW94YUhSeE9TdE9aVkZCU0M4d2NuZExiMVZzTjFZNGVXbERPVkpPUTJG
      eGJFaEpRamcxTlRBS05IcFlTREpWV0U0eFowWXljME5yVjBVdmRpdHZSa0ZQZDJoU2FWbzJhblo2
      YVd0QldHMXhPVVZhTjB0SldubGhlRmhYWVRoNVpsWm5ObGhwVGxGVVJ3cHdUM3BrU1VsM1VUVTJW
      VWhOSzNGMmRYbzBia1VyZUZNeE5FcExhVzA0UzFCVlJpdE1OVGRUZWxKU2RYbFplR2RpYlhGc0sw
      Y3JWRE5rUWpOQk56TlJDbE5QUkdsaUwxZHVlVmQ0UVRJME9EWkhVbE5YYlhaSGNVNHhjVlJITWpo
      SmNqRnJSMkpIUWxoRFRtVmtSRnBxZGtkMVJIVk9Ua2RaWldkdWVrSk9lbElLWVZKellXSndlbTAz
      UzI1blFXSmtaWEJ2ZGpKeVNtWk1TMGxCVnpWclRFVTFMelZKWldaQlMyeG5hRkJ6VDFKNFQwcG5k
      M1I0ZDBwaGNXZFFUemx6VlFwelR6SlNia0pvVTFndlFtSnZhM2MxVmxWWk1FaE9aMDV0ZEZKSlVu
      bHJjbFZEVGtkYU1rMUlURWhpYm01MFNrMWtlVWxzYTNOaGNWQlZWRzB2WjBkSUNuUXpOVUpCVkVa
      bWFtTk1TbkZuZG1SR2RIZEJhbmhXZUN0V1NVdHlSRVZYTm1aSGNFTnJjV016TVd3d1pVZHVhMk14
      TlhSa1IzbzNPVzlTYkRCQ1FWb0tMMjlLTWxCR1owSkZjVkZGTUZOdGRHZzFUVzh2UVdNNE5WVTJh
      bXR0WWxSSVJVWTRhek5aYUdaeVEzbzVUbWRrZFhGWlptWTVNWGRoV2k5c2NHdElkUXByTWpCbFRI
      aGFSRXg0Y1dac1kwTkNZVVZ2VndvOVZHVjVRUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set 'ProcessSizeMax' to '0' in the [Coredump] section of '/etc/systemd/coredump.conf'
      ini_file:
        path: /etc/systemd/coredump.conf
        section: Coredump
        option: ProcessSizeMax
        value: '0'
        create: true
        mode: 420
      when: '"systemd" in ansible_facts.packages'


# Disable storing core dump
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_coredump_disable_storage,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable storing core dump
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83979-5
    - DISA-STIG-RHEL-09-213090
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NVJXVkF2VWpsS2RuaFdNRUU0WlVkb2JqTnNVSGQ1VXpaeVdUVUtlV1kzTkhCVUsyVktTemhpTlZC
      TFVVaE5hekJ1ZFhsV1RVOXJlV3N2U1hCamRqWXZjR296TVVGdGQwOW9WREJFY21ST1JtOUVSREJO
      UlN0cWRuTklMd28wV25OU1ZuTnhSVEpSTlZsVlprMXZjRE5CWkZSc1FsWk1VaXRRZVVnMVMyWkph
      eTlqT1hwVWFVWmlNVlJKZGtsSFlWRm5TMDEzUm5wT2RrVmxWRk5qQ2xWVVIwMUdjbVpuYWxKQ1p6
      TTJVMFV2VHpWMVUzTnNhWE5QTTBKTlMxbE1aalprVUhWT1YzbEhOMVZGTVZVeU1saFhLemhQZG5s
      VmVrWmlTbkZaZDJFS1ZuZ3dVRmxLUm1WRU9FSlZUbm8yVEdOUVpWcDZaU3RDV1hCaFZFeHBha281
      WkdwdGIyTXpZVWMyUzNGblFqa3pTMEZ0ZDBacVJrdFdUMDlJVG14bVdRcHRSM3B0VWtSQlpYbEtU
      RmRwYjFBeFZFMVBhRFZJYzNjcmRFMXlOamRHVm5ORVlXdEpjbE5QTjNSV1EydzVWVnBwUVdkeVZW
      RlNaVU5sYzBwMVdTdHJDbTl0YTNGUE5EVjNNekJpTkRjeWREQkxiVGRZZFZSWmVuVXpObE12ZGpa
      RWJtbFdkMHBQUkhkT2RXaGhWMWgwWjI4dlRrbDRUMk42Y0hoUGFDc3hlRklLY21aS05sUk9iRE16
      Um5wM1JtdDJhV1JpYkZGcmNFVlNaalo2VDNWTFRUWjNOMVowY0ZNdll6Qk1iR2RzYTBnM0t6QjJT
      MUZHT0VWRFR6ZE5UVFpaUWdwblZHRjNjaTlzTUU5VldXRjRaME5qV1VwMWRHSm1ZbGcxYVhFdk9I
      VkpTSHAyTjBac1NqaGhVMlpJU0d0UFpIWTVWVlZsTm14cVJVbFJXRWxzUkhwbENrTlFZVVpMZUVo
      UWNYazJVSHAxVEhsNVNFVjJWMWhYVlhCUFNHVjBValZ1Y0VKdFIyZHFaMko1WVhsd2JFVk1kSFkx
      ZGtWNmN5OXdVV1JWUm5CcVVVd0tVV3hWVTBWVE1tbFpZa2h5UjBSMk0xbEpkM3BVYTJOQlEyZE1h
      emxTTW5JeWVGTktRekpvU1c5MVVrWklUa2RrY1VSMFFYQnBiMnBwTkhoVlNGSlJZZ294VG5GNVZu
      cHdObTE0YTNGdGVFcDJlbFl3TUFvOVNrSmlWUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set 'Storage' to 'none' in the [Coredump] section of '/etc/systemd/coredump.conf'
      ini_file:
        path: /etc/systemd/coredump.conf
        section: Coredump
        option: Storage
        value: none
        create: true
        mode: 420
      when: '"systemd" in ansible_facts.packages'


# Disable Host-Based Authentication
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_disable_host_auth,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable Host-Based Authentication
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90816-0
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255080
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - disable_host_auth
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      bFJZMUF2TW1aRE5FczBURTFsY1ZaalFraDBMM0pWYWxsQ2RGTUtMelY1T1UxNFpuUk9lbXAzTmxK
      UmVHNXNUbVpXU1d0VU1VWnBaa3BJV1ZGblptOVlVV1pqWjFWRFFXVkNOMlpVV0hkR1ZrZ3dZVmRz
      VUVoamEzQjBid3BvYlRWVGFrbDBRVVpZYnpCc1ZGRjRha2N3WkdGRlF6a3ljR2hCZGpCSlZYTkpX
      VEo1WmtaR1pGb3dUVUpJTWpCVmRGaFRjVWg2VG01NFJtWkRVbVF6Q2paSVpXcHZUSEZOVFN0YU5u
      VlZRazVrV1hKSGEzUkRNR1UyTkhSV1FsUnhWRzh2Y1ZnNWQwVnpSRkl6UWtKdU9ITTFRM1ZETkdk
      Rk9FdEJZMEpLYTFNS05XTktOM3BEVGxoSlIycElWblZITTFRd1ZqTnJRVkJLYlc4ME5VRkZiRmgz
      YWtZd1l6aGpUbWt6VTJzdlptaGhiV1ZzZVhnNVMwUnRRMlJOVEVaME1RcGFWbXBMZVhKdk5HMTBW
      RWR1T1ZwNloycDFUM1JuV0cxMGFHbEJZVkpOWTJwRE5ITklhek5xYTJ4dWQxSkNZVkZCZUdJMVZE
      a3hOWGhQWjNCQlYwcFVDa3B1YzB0WWJpOXNXa3R2ZUVwS1lVRnFUMDF4ZFdJNVJFNXJibmcxWldK
      UVlXczJOWGRTVlZwVFJtZDJUbk01V0hNdlpXTjFPRGhtSzJoc1ZYZHlVeThLVVdkaGMweFlTekY2
      YUhabFZGQlVObmh5VWpRMVpFRlBiVkZFY1VaU1VYaGpkMkZCU0VkUFptbFFTRGcyWlVGbGFXcFZj
      R1JxU21aa1FWVkZTRW96TVFwaFNtUmhTRmhtYzJOTVVYZ3JSRFZEYkVoR2IwZzViREZUVmxGUlF6
      VmllVzk2ZVRKeFdWQnFWRnBzWm5VMGNYSnNjRFJsTUhodGNWY3ZNek5LWW0xcUNpOUVVbGhTTHl0
      aE5WVndaMUJqVkRZemFFUlFiV3RCYml0Rkx6Qk1iakJ4Um5wbE5YVm1OWE40Y0dSR2JHWm1hbFI1
      ZVRkd2JWbDBVVGx2UVhCYWJHWUtUbmhQVDNCS1JtUXdibE5hUVZKNE5tTXplVzVVWTBWSk4ydE5R
      a28wV1dKelYzYzJOVEZsWkRrME1tOVpkbGsyYnpOclVVSldkMlpCTUdkUWJrVm5XZ3BxWkZOQmJI
      WlRZblZHYVZOT1VuRm9PVTFUTndvOWNYTlpkZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable Host-Based Authentication
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter HostbasedAuthentication is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "HostbasedAuthentication"| regex_escape }}\s+
            line: HostbasedAuthentication no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Enable authselect
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_enable_authselect,fix)
# Version: undefined
# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora,multi_platform_ol
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Enable authselect
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_authselect_profile: sssd
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      WkxXVkF2TUdWT2RqSkRaWEpQWm1jeFRVcFVSRzAwY0hsMFQwb0tUMkZsZG1GMEx6WkJiWHBOYUVK
      R2QyVldNMXB0YUdsSWIxcHZVVzlMZG1kVloyWmtaWEptU1dJM1VEUmhlbnBLTmpWSmIwMW1SbFZQ
      UkRZNVYyRXJlUXA0U1hCdmFtOUlSRXRMTUhaeFZIRjNibFpNWkRaNFNIWmlOV0pqYkhCNlQwVndO
      bUZFVUdadE4wZElUR1ZSWmk4MGJFbDNkVmM1UjNSeWIyaFVkVEEyQ2xaQ2FtTXZORkpsYUZKSVdU
      WndhRlV3TWpGbWFGQm5URko2ZEhsR1JuZHhVeXR0UmpCRlozQmpWVEk1UkZKSVdrVkpSRzVxYXps
      NE4zbG9lV1ZVWm5BS2EyOTJlVmxCVG5CbUsyTkZVRWgzV1U1MGEyUmhSMHQxZDBkdVdIZDBhRlJL
      UjBrM2QwOU1MMU5rYUVKVlZ6ZFNkWGRoZWtsdk1tRTVZVXh0YUVndlRRcHphVUZYTVZSdE9WaExi
      V3RrV1habFQxVkpSaTkyUjJ3eU9YWnpNR05vY2s1M05Xa3liR2xoYXpoT1VrODBNRU5JZGpWWlJU
      WkxVbGQ1VkVsdFRYQnVDbmxFTTJsSlkyWnZUa1F6ZFRkeU1UVkxUVzFWYlhBeFVFODVaMmxIUjFo
      WU5tOXlielF5T1VwNk1WQlJXVWxMZEhnMGRsUnJOMHd6ZVhCblEwVndRVmdLVWs5RFEyOTBOa0pV
      VGtsWVdtRTVNak5oTkhGWU5YQk1aSGhYUkV4UlFVOXRaSGcxVm1neWFETjFSMWR4VURacFZIWTFa
      WFZYV1RCNFlsWndUMDFNYkFwalUwVXlia3g1YkRVck9VdHBhMUJRU3pGeE1DdDZUR1IxTVdOS1JF
      ZHllWGRTY21aUFluTXpjRkl6VTNsb2ExRlJXbVE1U2tsaVpDOUpOMjlwTTFkbUNpdFBSR1YyUWtw
      NlozQjNOVmRRTWxwSmIyMWpVWFpDVEU1bll6SjJWa1pyYUc1dVdWRjZjMkpDYWxKeVZEWkphRnBu
      UlhabVdFdEJTVkF3Y0dodVVWRUtTVmxGVFRjM2JWQlpRVUZQTDFNdmMyaHVNMVZrUkhaT2MwSjFk
      WGxQY0ZRd0szWlFZVXRaYnpScWRtZEthVkJUZFV4a1RFTktTMlo0Y1dwcmNqWTNid3BVUkdsQ1ND
      OW9VbTB6VEhKTlFrWnlRM2RXYUFvOVZsTk1jUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-89732-2
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
  tasks:

    - name: Enable authselect - Check Current authselect Profile
      ansible.builtin.command:
        cmd: authselect current
      register: result_authselect_current
      changed_when: false
      failed_when: false

    - name: Enable authselect - Try to Select an authselect Profile
      ansible.builtin.command:
        cmd: authselect select "{{ var_authselect_profile }}"
      register: result_authselect_select
      changed_when: result_authselect_select.rc == 0
      failed_when: false
      when: result_authselect_current.rc != 0

    - name: Enable authselect - Verify If pam Has Been Altered
      ansible.builtin.command:
        cmd: rpm -qV pam
      register: result_altered_authselect
      changed_when: false
      failed_when: false
      when:
        - result_authselect_select is not skipped
        - result_authselect_select.rc != 0

    - name: Enable authselect - Informative Message Based on authselect Integrity Check
      ansible.builtin.assert:
        that:
          - result_authselect_current.rc == 0 or result_altered_authselect is skipped or result_altered_authselect.rc == 0
        fail_msg:
          - authselect is not used but files from the 'pam' package have been altered, so the authselect configuration won't be forced.

    - name: Enable authselect - Force authselect Profile Selection
      ansible.builtin.command:
        cmd: authselect select --force "{{ var_authselect_profile }}"
      when:
        - result_authselect_current.rc != 0
        - result_authselect_select.rc != 0
        - result_altered_authselect.rc == 0


# Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_ensure_pam_wheel_group_empty,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_pam_wheel_group_for_su: sugroup
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IydDZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      ZHFVVkF2TWsxTllsSkNUVUYyWm01clJVYzFaM2QzYjA1Q01tRUthMU53VjNCUWNYRXdhRU5qZUZa
      a0wwSkJaVXhxVjBOMVUxWllTeXRLYm1GRVlUSkpNRGhCTVhGaVNsUkZSMkZyUjJ4d1N6RndkVXBz
      Y0VOa1ozZ3haQXBMZG5BNE5FMHhNRk00WjJKRlZtZDRaSEJrV0ZkSFZqWjFaVkV5UVRaRFQzVXdS
      QzlyZFRremFVNXNNVTA0T1hGUFJHazRXVFZNUkRkTmMwNXpNbWcwQ2taT2NXcGtjWFV5SzNoT0ww
      dFZUbEUyUkVKdldXZGxhMlJLVW10aFFWWnhVMHBUU1ZSblExWmxPVXRFU0ZSaGVVaGtZV1pCV0do
      S2RISmxhMmhhTUdNS05VTXhWQ3MyUmpORWRVUlBiMmxQVVVKWlpsQXdVbW8wY0hWNWJFbDNZbXRQ
      T0hOd2VYVm5WVE5PYmtac2JVdzJkMjh3UVhOTlFtdDBUM2xIVmk5a1ZRcHBORUp0VlV3MlVXRnRN
      akJxUnpFNVFuZDRObmxxT0haT2RYWk1kMmRESzJ0aWFEUkVVRE5YZFdsVWMyVjFiRTUyVTJZeU56
      bGtLMFl2TjBSeGNFTlpDbmRGVDBJNU0wTTRUbXN6WWs0eFRVOUdOMVJJZDIxaFEyWmxVa2RTUTFW
      alZXMVdhMk42VUdJdlVHSklOVGwyZUhjNVQxZEtaVEo0YW1OVVFsVldRbm9LYURRNVIwbE5jek15
      Y1doMlpXUXJVbmRxSzFGQ0t6aERaak16V20xSFYxRlBTVEkwUW5FMVIyVnhTbWhVTldoaE5FWlBk
      bTFqYURaTU1qSTBhV2MyV2dwWmRIZDNXa0l2TDFjek5UUXZjbWcwY2xsa1V6WklaMGxDYTNGUFJs
      TkZiSGRGVkROd09UVjJPVTVITVRSM1NIQlJia2RXVm1kWFZHSklhVFY1VDFreENtWnRiaXQwTUZs
      SlNGbDFhM2xzU2tOYUx6QkljRVZQUWpSNlFYTmFXSFJDU1ZWdVJrTkZjRFpqZFRNdlRHeHBkRkZT
      TTNWbFNrWmFWa3R3VGpkSk9XNEtUbVJRT1ZSTlJreFNZalpaTm04NWFrWTNTRU5YTkZKNVFsUjZW
      a2tyZUhWVmVXRnpXak4zUm5aU01XZE5Va00wVkd0NVVITlFkMDFRYjFwRFpqVXhNUXBTZUVwNmRW
      aHlXSFk0YmxCWGExRmFTM0ZuTWdvOVNGSnhUd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86072-6
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - ensure_pam_wheel_group_empty
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty - Ensure {{ var_pam_wheel_group_for_su }} Group Exists
      ansible.builtin.group:
        name: '{{ var_pam_wheel_group_for_su }}'
        state: present
      when: '"pam" in ansible_facts.packages'

    - name: Ensure the Group Used by pam_wheel.so Module Exists on System and is Empty - Ensure {{ var_pam_wheel_group_for_su }} Group is Empty
      ansible.builtin.lineinfile:
        path: /etc/group
        regexp: ^({{ var_pam_wheel_group_for_su }}:[^:]+:[0-9]+:).*$
        line: \1
        backrefs: true
      when: '"pam" in ansible_facts.packages'


# Ensure that /etc/cron.allow exists
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_cron_allow_exists,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Ensure that /etc/cron.allow exists
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86185-6
    - disable_strategy
    - file_cron_allow_exists
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2Iyc3dRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      WktjMUZCU25GQ1RESmxVWGRFU25oeVJWcHVSakpFTldseWJGY0tTakZKVDFwVmVGRkVaRFJqTjNS
      cUszRmxLME4wVUVFM01VVmhlVXRHUzBWT01uTjROVTFGWlVJelluVkpWR05XYkdKMFIyZHdSemRu
      ZVdONlYzSnZjd294UzJGS1JFTXpZekprUnpkMFJrbHBTMXBLUnl0cVJHdFRTblowY3l0UVRsVkJX
      bEF2WTI5Wk1tVnVXWGRPYzBremVrRlNORnBtTnpoVlJEUkhaMk5hQ2tGdlNVSnllV2RzYTNGRmVq
      Z3JOekJPZUdkVVkyRlZVemd6UmpkUFRVeDFXR2hHZFhSaWNYUlFhM0kxZVRWdFppOVRha00wZEds
      eWFsWTRlbnBUWVRnS00zUmFUMmx2ZDBnMVZIWm5SV3RuYVU1bFpFbFVVbVZsVTNKUFFteExkSEpJ
      WkdScFlUUXZUbTFQVm5WdVZHTnpUblZ4ZWpWWmRWWlJRMlJ0YVVKSE1BcDRXVmR2VWk4eFkwZzRR
      V1V6WW05WlZ6SkdjM2RPV1dRNGJFTlpha0VyS3pOTWQyOXBOekJUYTJOSFZWbDRjRVpvY1hsV1lq
      ZGhjVlJSVEdwMlJtVlVDa2xDTUVwNGNVTnJPRGc0VmtveU1WZERlV3RhWnpkV01VTnFWbmQwUlUx
      MmMwdEZLMGMyYUdKWWIxQXhRaTl1UTFGNk9ISmxRVXRKZWtaalVYaG5ZbmNLZDNRd2NtSkhaRE5L
      U0c5b1FYUkVPVnBJU0ROb09GVkVPV1Z4ZFhBeFowVTRZV0ZKZVhKdVJHMVBjMGQyVERsa0swUjJS
      SEEwT0ROQldubEVURlp6TVFvemJGaDVXREV4UmtSak5ESTJkM1Z5TUdOMk1EUldSV1I2VVhvM1pu
      UjZXbXRKTTFkMVdDdDBjSEZFYjJwUldVMVRPSFpKVTBKa2RXTTNlRmRUWlZodkNtUXJZWFE0VTFr
      NFMzRnlNVXhVU1RnNU1ITlJSR1J0Ym1aUE9GTkpVVUpNVGtveGJHdHJkMGRXVldaVmRpdHFXalZ5
      U1VSalduUkxRek12U1VSdU9VMEtVMjVXVUhsaVFsaElWWGxCV1ROQ1p6TnZjRUZYZFVKcWMzcDVO
      RVphZG1WTGFuUlpOekpxTTB3MWJIVjBha0pIY0U4NE1FWjBkV28xU1ZnNWFDOU1NUW80WlRaWlN5
      czRNVFJhVEV0NFZtcEdiM2RZUmdvOVVtdzJPQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Add empty /etc/cron.allow
      file:
        path: /etc/cron.allow
        state: touch
        owner: '0'
        mode: '0600'
      when: '"kernel" in ansible_facts.packages'


# Ensure that /etc/cron.deny does not exist
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Ensure that /etc/cron.deny does not exist
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86850-5
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - disable_strategy
    - file_cron_deny_not_exist
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2Iyc3dRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      aE1VVkZCU1RWUlJEbEpXamxRVjJGVFVFaENWemRsTW1aU2MzTUtOV3g1ZEdrNWRTdDJPVXAzTTNa
      YVYwZFVSbVJyVlU1RVluRkNNMWR4YmxKRFluVTNNM0ZUTjJ4RmVrdHlOM1Y1V0RkTlVXMVRjRU01
      ZFhCM1EyeEJSQW8zVm1ZM2N6RmllR3BrZUZKeU4yZzJVRkJEUlZGa1RIcDBPRGN3TUZvNFR6WmhN
      azEyWWxvelZTczBWMnBVUXpsWFQwazBWMjFGVkhNNVRYWTBWUzgwQ2xoWk9GaEphMVpVV204M2Ns
      aHlZVGROWm1OMk5HOUVTR2RuUm1aMFJUQkVOVzkwV0hWaFRqRkJNR2xOU21wR2RqbFlTM0ZSUTFS
      SU1qbDVWR2hXZDBjS1MzRXdOVE55YmtSdFVXSlRSMUF3UzJZeGFYWm9hVUZCU1hGcWJWcGhXRTA0
      YVhVMWFteGFWR3hPUTBFcmVEbDVhek14Ym1sT1dtNVRibVJXYUhacEt3b3ZiVzVSVEc5dmVVdHJO
      WFZMT1hOemJFWjNhVlkwY1hwUWNXNXphWFZVZFVWT2FsWnpUemhUVUVaQ2NEVXZaM1pXZUhaTlVr
      bFhialJPZDBabmFEWnpDbXA0TkdseVRYSjZTR2hKU0dNd2RHcHNPRTQ0VnpCNVFuTmpWamxCVUhV
      M1VIWjNRbGhPV1VscWNrZFRabkptVDNoNVIzZE5jRzVCV210UVVuTlhjMDBLUTJnMlRDOUdSblIx
      YWtRNVNqQXpTVWxvWTJneVR6ZHdZa05CWkhkclptNXRXbXN3T0V0WmExQTBNVFV4VkV4TVdISm5a
      a2RyVW1sRWRtbENia0pIZGdwT05sUXZVbWRaTkM5SlFtaE1hRFE0ZVRVeGNGUldjVkl2WjBOdlQw
      dHRjRGN3YmxCWk9VeHFkVGhuYkRGUmNUUjVlR3AxY0dSVE0yRm5ia3RzZUVkNkNqSnNRbGc0ZG0x
      RFVTdERjRVl6Um0xMFlVRlhNRWQ2T0hNM1ZVMTRPVk5yY0U5dWIyRllWbVZyTDI1WlQzSmtNbEJT
      TW0wM1MyeHJTMUZuSzFwM056VUtMMmhrU25Fd1RucHFRMFV6YUhsbFJtb3lSR0p2UmtSNlJsaFpa
      QzlaUTFoNk9DOVhMMnhwVlV4c2FqSlNSMDFDUkZSVFJtOW5OWGMyYldWNlptOWpXZ3BPUTA1a1Js
      TkVZVkphY1dob0wzbGtabXRGWVFvOVJHbHVSd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Remove /etc/cron.deny
      file:
        path: /etc/cron.deny
        state: absent
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.daily
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_d,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.d
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84183-3
    - DISA-STIG-RHEL-09-232040
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      Tk5aMUZCU1ZSdlRsRlViRUZvV1U1alNVaHFNMUpoV2tOV1NGb0tNMGxTZEVwUVNISjRXRll6Vkho
      a1JFODNTRTFvUjNOTWJsaFlRMUpCYURGQk9DdFZTa3RVUTB4clNFWlBXblpyVlhveU1VbFBLMHRM
      T0Vsd2RtbEdRd3BVYUdGeFJtRTJXV2xNTlc5U1dXZFdNekpOTWtZeWVWSm9aRlowVTFGVE5DOU9h
      VUpvUlhaSFUweDBSM05aYlRCamNYVkZkM0JVYUhseWNpOUZZVll2Q2tKRlRVdDNWVVZSWW01VWJX
      cGpaMmhVTDNkVVUyNDRhVmwxT0ZoR2JqbEVaMGhQTjJZcldITkxUbEUwY21NMVowNUJTVlYzWmxC
      bmFVNHlTMEppUW5nS0szRnFVVVZoWVVjelJsQlRUMEpRU25sbVRFOXdLMFZ2VUVabVNtOU5ZVmxI
      VDBWNFMxRklhRFpHU2xOcGNtUnJhVE42VnpVcmFWQm9ZVWRUU0ZBMmVRcDRVekZuVkdodlUxaHhT
      bmxSY21nMWFrTkxMMkU0Tm5kSGVrY3lNME5FTVROcFowRm9jVk5GTlM5eFZuQnVNMXBCWXk4MlVF
      VkdVRk5rVDFOMVFtTlJDbnBZVVRacFIyMXJaWGR2TlU1TlFrWTRWR0ZwWlU5VWJUa3lXV3gzUkds
      cldqSnNMekZIZVRseWIzWnVWMHBtV1ZsaloyWjNUVGxyWjJReVRXUnNia3NLY25kRlFuWkhURWxN
      YkdabmIwaDFiVGx4TXprMVpIQXJXRUZPWldWdlZYWmpiWEF4TkZjd2NWaFFZWFZUT1dOb1NGRm9l
      VFJsUmtSVGFqbG5LekUxWndwbFZGSlhWbXMxZUdaNWNuUkZXa05QTlZRMmR5OVdPVUpLVFhCNGRU
      bGhXVVpzV0dGc1ZVcFpRWFV2Yms5T1ExUmlXVzVqVkVoSlYyMXdkeXRDTVc4eENtdG5kWFIyU1Vo
      SmJqbG9kM0pqVkZaTlFVRm5UMlZLY1hsNFdHVXZhMEZNTTBoa1UwZFZZbVl4WldVMmVHeG5WaTl6
      VUdWak1ITTRRV2RGUkV4NVNYY0tSelJDT0VOb1RrSllOSGg1Y1hGS1VtMDNObmxxYlZKeVYwOUdh
      RVJVSzNsa0wwVlZRbWhXWlZKWGFTdFlaRVpaY1djMFQzbG5iVlYwTVhSTFZUWkZid3AxVkhad1Ft
      OXVhMVoyZUZKSWVGbHpNWGhJVndvOVZHMWhWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.d/ file(s)
      command: 'find -H /etc/cron.d/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.d/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.daily
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_daily,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.daily
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84175-9
    - DISA-STIG-RHEL-09-232040
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_daily
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczFRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dGpjMUF2TTBoelEzTktXR3htTkhaMGNYRnRLM0I1Ymt4cFFsY0tlR1JJZWtKUVRuRllWekI1YjFG
      YWRuSnJkbXhTT0c4emNVaFplR0pIYlhsd1NqbHZaMWd6ZG5Cb1REWTRWR015VkhORWJuQXlZMmQ2
      ZFdjdldTdFdTZ3B5ZW5KTVowRTJWbGM1WWsxVGN5dFJkM1ZVZG5aQlNHUm1ObTl3UzJwR05UbFpa
      bnBYZWpoMVREWnlkamxCVHpneFIweDJlVW8wYzFWaFZFaFZZekZSQ2xCR2JreDVTemRXWjFCUVFq
      TkVibFpGUjNCa1JuUTBVWEZ5UVhCUWNWZFpNbEJCZFdaM1ExWlplVkpLTmswd1lXdzFSMDUyVERs
      amRVWk5TWHBhZEVJS1QyZDBVRGRyVVVwRlJFNWpjbWhYWTB4cmJEUk9jMWwxUlhkSWMzRmxkblV6
      TkROb1l6SkJXWEV5UlRsWlltTlFOVEJXTVhFdlNXTmpMM3BIZUcwMGJnbzNMMFpEVFZSNGRHWjFT
      bnBGU2paalJteHhkVzFJVjBobGVHMUZTRFpZU1dSU1VIcEtPWEpNYjJkb1prRlFXR0k1VjJjdk5T
      OHZRVGhDWm14c1ZXMDFDbnBvVENzMlJVUk1lbFIwUlVaQ01qbHVSV0poTlcweWRHTnhTVFJFTUZK
      WWJUZHlNMGRzTTBwdVlWcFpkV1F4YWxwbE9XZFdhM0ZSWVdKclMwVnBUR1VLWkVFd2FsRnpVM2xH
      UlVkSGJreHZNWE5DWm1JelMwVkdOSGQ0YkVadWNrUm9jVkEyTUdsS1QyWmFXR1l5VDFOT0szVjZR
      bFpzWkdaa1RFcFNZMnRYTlFwWFJIaFNUMkZWTW05WFJVMW9la1phTDB4WFVtUXpWMVZoZDFaYUsz
      VjVMekJGVDNSQ2NGSnpMMmh2U21JclZDc3JRMEkyVDBGcE0weEVXR2RqUkRGUUNrNW1UVzQ0U1VK
      eWFrVmhaalZ4TkVKUU1EbE1hbmcxUlhneVFtUnROa1J0YkdseVZEYzRXa3gwZUd0bGNFeFNNVEZD
      UzNWbWQwc3pRbFl3VkVwTlQxUUtiMmxPUkdKTVEybG5UV2hIVjFNMmRFcHlNa1I0TlVsWFYyRnpL
      MHhhYVZKQk5ua3paV1U0YVZFNWJ6YzRTWE5YWlV0eFJETlhOVXhKU2t0VWVEVXZVQXBEVjFacFpE
      bGxXak5IUVhWcmJ6RmtkR0paTkFvOVF6QjZjZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.daily/ file(s)
      command: 'find -H /etc/cron.daily/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.daily/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.hourly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_hourly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.hourly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84173-4
    - DISA-STIG-RHEL-09-232040
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_hourly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      ZG5TVkZCU2xwMGFXNXZlSFJFTm5KUWJqSnNSaXMzU1VobVF6a0tNRFE1VUZOVFFtZEZTMFpCUlhj
      dkwwVkRTVW8xVG1WNk1GRXpiVmxGYkhjek1YcHVTbXBqUkc4NVFYRlNkSGRYWmpkV05uZDRhRU5z
      YjBWS1dUQkJhQXBRU1ZCNE5VTTRjaklyWTA1c1VWZDZVblowVEhWR04xUm1NMjk1Y0hkRU9EZElh
      RW9yVURGb1EzUkNTV3h5TDJ0blZHVTNLM3BRU0N0WFlUUmhibmt5Q21VeFdFeHlaa1JaY1RCallV
      WXdhRk5XWW1oWVNYcFRSSGN6UTFKUVZWVXliR1JwWWpOMFJrTk1PSFYwUWpVMlp5czRUa3MzV0RC
      M1kwZHhNa0k1ZDJvS01GSlNaREpDYTJkQ2VuRktUV05XYUZCM04xaE9MMWt6UjNaeVpVZzBVMDFa
      VFVSU1NFMDBhbmRhTXpoUVFrSjBUekp5VG5jclRESXdNWFptUW5SU1lRbzVaak5oTm1WaGNYWjZk
      V2MxYTJrMU1DOVRSVk4xY0RVM1MwVk5XbmRpYUUwMlprbEdUQ3RWSzNKQk1UUlhUWEoyWkhSUlJU
      aHNjRUpsYWxsUVVtSXhDbmhXYkdSUVdWTmlkVWsyVUdWbFUyWnlSbWwyT0V0M1NrcDNhRFoxYUhC
      bk5VZDZOMGhYYzBRNFJIUkdkMGc1VUZkSmFIcHFUbk4zVTFSclJuaFlLMDhLVTBReVVWcFRTVFJM
      WlRsdVdsZG5NV2xrVDFaeEsyODBiREZzVEV4V1pFWnlSblF4U0ZBNVZHOUhNM2hhZG1rd1ZsZGpk
      SEJTY1d0T2RVMUhiMUkxU1FwUEswOVVUVWRNYjFCUFdrZExNa2xrVTA1cldHNVNiRkpQT1ZGeVMw
      bEZSbTVQUlRSSkszZFJaWFk0WkVoTWNHbE5OVWRIWTFCTmQwUkViaTlQUkRGVENrVTRNSE5hVTJN
      MFYxVk1VRzh3TXpWMVNWQmtTbTR3TWxwU2FIUXZlVTV0Y20weFNteENVRmsyTm1zdmExRkNOVmha
      UlRGcmRIbDBhVmhHUTI1QlYzY0tUbnBHVVhsdlVUTlVlbGRQYUdoRGJTOTVhMHBHZFhaUGEwNHpN
      bGxoVFV0c01ta3JjRkoyTVVaM1NrWXJOamxWT1M5c1EySkVha1J1T1daamVUaE5UUW95ZUdSSWNu
      azVjRGhaYnpScVNFcHZkRFI2T1FvOVRVSmFVUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.hourly/ file(s)
      command: 'find -H /etc/cron.hourly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.hourly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on cron.monthly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_monthly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.monthly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84181-7
    - DISA-STIG-RHEL-09-232040
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_monthly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      RjBkMUF2TUc1Rk5HOXJOM2xpVFZwc05rSkphMnhHWW1wVFIwc0tNV05RWlhwb01TdFVZV2hRTkhC
      NVRqZG5iVGRhVW1WV0x6TTRTamhNUVZSdmVWbEhXV0ZLTTBWYVEwZERkamxPTmtKRGFuRnJlRVJx
      T1ROb1JIVmhhZ3B3V25wVVZVc3JjRk0yY1U1cGNEaERVekJaTTIwd1QyMHpiVmRzZFVSUlNrVndi
      VTVKY2tzMFpWaE9NV2xTUW1WdWMwNXdRa1ZPY1VaeGNHRmhkbEJhQ2k5TVVtZE5VRkpPV1RrME5U
      RlRVbUl3U0RWVFNsWmtibmRhWlVaalRtRjFjRVZzTW5rNWFXZEtNVmt4UmpsS1QyRjNVMVl6VFZK
      d1RsUnZUSFZrUWxFS1VrcHJTbkpzWTNaWmJrWnJVR3hRWWxwTVdGbHVkRnBxVjJoR2VsRXZOemxs
      ZHpOTk9HWkNaM0prUjNOc09WUlRiSEEzYms5d1dGUmFkemxTTWpsMlJBcFhOMUpzYlhadk5FZzFa
      Uzg0UlVKVk1EZG1ZbkpGY0VFMmFtZE9ORmxKTXpWMVJVTTBNVmt4YmpCTVJuWjJWMFZPZERZMWNq
      aDZjalIwYm01dmMyUlhDbWxSTUcwNU1EWlVRakVyYTJZeVVYWlNlblZZTlRoWWIycG1aMlZEZUVk
      SU1qbE1VbWx3V25KcFVURktZM05ST1ZsSlNtWTVhbVJ1V1ZsNVRYaDJlbmtLYWxKSk1HSllhRU5p
      YzBRMFdpOVZRbHBGTlN0a1dqZEtUbFp5V0V3dlpVTmlhRVpRYmtFeVVrRlllWE5hUlVVNFVEaERU
      bk0xVDBaTE56RjZaQzg0VlFwaFJsRm1XRm80YldOWWNEbHlWRzQwTUV3MlNWWm9Wa2gyUkZaVGEw
      ODNhMjUyVUdSYVEwOUpZWGxqU2poMWJHTTNWMUpFYTAxbWNXSkRkVVF3TUhGU0Nqa3JXa0pwWmxS
      a1duQlFZa1UxWTJkeFNUYzNSRzFWVlVvM1ZHNHZUVUZOT0ZZMVlrdG5TMkV5ZDJ0Sk5FRkViRGgy
      VW5kalJUaFhNRXhDY3pOblZVWUtiREpCUkVkNmJ6Vk5kamgzTjFwalJHbFRSVFU0Y1dOU05HZzNT
      MlZ6UWtseGMwdEdWazExVlVFck4wWldaSFpqWVZRM09HTnlUR2xLUzBGeFRHWmhUQXA2YlhORmNs
      cFpSVzVwZVdGRmJXOVJTMEpUYWdvOWJEZEpTUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.monthly/ file(s)
      command: 'find -H /etc/cron.monthly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.monthly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Verify Permissions on crontab
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_crontab,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on crontab
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84176-7
    - DISA-STIG-RHEL-09-232265
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      UlJiMUF2UVhGRVRHZ3JXV1Z3TVU1bGIzTkZURkV5TmtWVVF5c0thbU0xVUZkMU5sQXlZMDF3V0Zw
      UlQxZHRabkk1TUZGSlNuWTNXa1phV2pGRmFXRXlXV3BVVWxONWNHUnFRU3R5TmtoTlkwZHNTM3BQ
      ZW5oV2VFczJOd3B1Y21WUlJWSnBlRVVyYjBKbU4ySkpPV05aYWxabVZXZFJjRWhuTkV0UEx6RkNS
      amxxT0dwYWQwY3dUMk5XUzB3eWVqSTVNM1kyV210QlFrOVhkSFkwQ21NM1J6VXJZWGwyUTAxMlVU
      SlRibEpJV1dkR2JrczNkWEZpS3pKU2JWbGlTR1Z0TVRSV2JXTnZTMXBrU2xCRlRrTnhZVlZTU2xS
      UmNYRm1LMmQ2WW1RS1RFVmthRnBYYzI5R1VrUjJkVVpXUmtvNGVUSmljMHhQYTNSYVp6TnNPRzF4
      VjFaM1oyTkpUMUZsYldGVWFFbFZUVEYwUlhCRU5Wa3hXVWMyUzBJeEx3cEhWVTVHYnk5aFNsUlBX
      alYxWW5wRWJDc3ZhVWxVUzFOcFptMXhjRE4yUWtwTE1WTm9TV3M1VmpneVZuSlFNbVI0U3pka1Uz
      ZzRPVUoxZEdSVlEzRmpDblptUTA0eGNqTkNkVEZvWVdoQlVqbFdNbkpMZEhoR01WQnpZbGhXTHpK
      aVowaHNWVmt6TkcxNk1raFBheXRzUlhOb2VEVlVWelIzTTFWaVltNDFZekVLZHpkeFNVRm1ZakJs
      VmtaWksybDFOMXBzYUZWRFVGaFNTRWRJVUVZck4yTkthWFkyVFhsRU4wZDFZMEVyUW5sS01rZzFO
      MGxvUVVkWFdFcDVaelJLVlFwc1JrNUpiVEYwTm5GQ2Qyb3ljbXRCTjJoM2VVUlVTVlpTTDFsdldH
      WklNMll6UmtVNU0yWkxURzlJZW5GM1pqUm5WSGx0UjNKRVlrUllaVmRoWmtwTUNuUjJiVU5zYUdZ
      MFRGaEpNMmh1UW1VeFZ6Sk5UbVpoS3pWcmFGSlhTaThyZWs4MVZWbFljVGw1VEdObFNFWkthMm9y
      YUM5cksybHNhMVprVkVsalVqWUtjM015WkVsUWVXSXZZM1U0U21aa1VXSjRXbWxDUVdsSk4zb3dS
      MncxVTFwSldVNXFNRUl3VTFwUVkwNHZiWE5UUzFaRFNIUXlRa042U0dKd2FYVjFMd3BHTVUxd0sw
      RlllRXg1VDFGYWF5dHhWVFJWZVFvOWJtY3lad290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Test for existence /etc/crontab
      stat:
        path: /etc/crontab
      register: file_exists
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure permission u-xs,g-xwrs,o-xwrt on /etc/crontab
      file:
        path: /etc/crontab
        mode: u-xs,g-xwrs,o-xwrt
      when:
        - '"kernel" in ansible_facts.packages'
        - file_exists.stat is defined and file_exists.stat.exists


# Verify Permissions on cron.weekly
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permissions_cron_weekly,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = low
- name: Verify Permissions on cron.weekly
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84187-4
    - DISA-STIG-RHEL-09-232040
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_cron_weekly
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      RjBiMUZCU2xweFFUWmhUV3dyY0VoMVMxWjZPWEV4UzNkc1VGUUtibXR0SzBoWGQxcFVaMUphVEdw
      TFUzbDZkbGcyY25GS2RIWXpaM2xrYUhOc1JqSlBjVTkyUVVkd2IyVXhXR0p6ZFZsRVEzbFlkR1ZQ
      VkZaSlozaHZkUXBqWWxwa1dHbDNSbGRuZUhKYVlVbHVNbUZJYlcxM1pGcG5ZVFJPT1ZkU2NXaEJU
      bTlVTlVsUk9FbzFkeTk1VEcxWlJrWTNMMWNyUkVGSlF6RnlaR3gzQ2toWmJtZ3pZMWt6U0doTVJu
      Um5XRE5FZVdZMFZ6WlJOazl6U0ZSNlpFOVNXV0psYlRsblZHeG5NRVZTYXpaNk0wNWhkeTlvTDBo
      cFlXZHFPVTlSTXpFS1N6aHBjMGsxY0VwUmExbGxVV28xUkU1NVJVaG1WVUpKZDJFMlFXRnRkbk50
      VUZrNGJXWmxVa054YXlzMlUwZFBRVTFVUVZGaGQzVnlWR1lyUWpaU1NRb3ZZbVIzZDJWeFRIQmxR
      bE15YWxGVWVGTldjbE5CY1V0aldtOWFjWEZ4TmxsVFdYaERjbTlET1VGelYwdHFTWFpXVHpkMlFV
      MVhaMjh3TURKNlNrUlpDa0pIT0VkalVscFlhRFp1TmxseldteHZVRXAwZUhCeGJUUnFZa0p3Y1hW
      MFVuTkVUbEkwTDBFd2FrWk9NM2RWZVdOSWVrOXVWVmg2Y3pSeGNXOHJMM2tLZFM5eFNtSm9TMjVZ
      VjAxTGFFaFllSGN5U2pCVWNFczFVREZLTXpneVVuUmplWGwzVUV4RFpFUXlkbll5YVZaUWIzVnhS
      bVZQZW5KVVJFOURURlYyZEFwMWFtc3hRa2hDVTBFeGQzcHZXVk5GUlZkalUxRmhjME41UlRSdk1H
      Y3dUbWxXU2pGdk1tOHZibnB2Y0RaclEwMWFlVGR5U214b1pITldiV0o0WkRCRUNrZEZUa0ZhU3pB
      clpGTjJVRk5vSzFoT1lXSjNLMDl2T1RGTVZtWndXV3A2U0ZNMFVrUkZiMDlUY0dabWJUUnNkRzFJ
      UkhwdmJYSjZZelJMVEc5SWNTc0tiV3hUTVZSMk4waEdSR0p3Um5wRmRHdE5TbnByUTJneVJYRnRU
      MDlMYlZGTmQzUkxNWGxzVUhScFEyRjViSEJuUVhoRVFtdDFjMHQwYld0blIxWndjUXByYTJ0TVJY
      UlFhbTl5YW1WblpETlRURUV3ZUFvOVlsWjBUd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Find /etc/cron.weekly/ file(s)
      command: 'find -H /etc/cron.weekly/ -maxdepth 1 -perm /u+s,g+xwrs,o+xwrt  -type d '
      register: files_found
      changed_when: false
      failed_when: false
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Set permissions for /etc/cron.weekly/ file(s)
      file:
        path: '{{ item }}'
        mode: u-s,g-xwrs,o-xwrt
        state: directory
      with_items:
        - '{{ files_found.stdout_lines }}'
      when: '"kernel" in ansible_facts.packages'


# Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_file_permission_user_init_files,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_user_initialization_files_regex: ^\.[\w\- ]+$
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeExRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      WlVjMUF2YVdRd01XcDVURmM1VVVWdWJVaFBXVzlMWkVNd1ZFWUthM1o1WVhNMGRtVTBSMlpZYzFW
      VFpFTkdiMG9yUVU1amFXMVNOVE5LWjJZMGJEVXpkVVJCU0RaVVFXWnpZVUZPVlV4RVRGaGxNVTlL
      WjJ0dGQxcGpTZ3BJV1V4TGVWTkpValpETlZoMlZVRjJkRk5rUldzMVZ6TTNWVmhNTjJ0NmN6TnZT
      VlJNUkVaTmVFb3liVkpOUlRkWGR6SnlUeXRwYVV0NlprcGhha3RCQ2xwUk1GVkpZV1ZrS3pjemVs
      aFhUVVZRYzFSRk9DdDBkREF2VGtNNFFtZGpNbXN5ZDFGUlIxaERRVTFGUW5wUmIwOVVWMWRHY25o
      alRtVXZlREJQZG1RS01YcHhkWEpqZVZsUWMxUk9SVTgxUjJjemRsTlRlRzltWmpFMFFXdFZNVGhX
      ZFhkcVQybHJNVGRTTUZsU05URnNSbXBQUlVwUWVHeHhjbTVtSzJkellRcHZVSFJqUkVKNlNXbEtV
      M0ZEUzFSeGMxTXpVM3B4V2s1S09XVXlTRWN3YTJSbmVpdE5NR3BWTkRWWE0zWkNVVWQyVXpCdGRr
      RnhjMHN3YzB4RVkwRkpDbGhuVEdWWWVVaGFNazl5TW1SSFF6VnpTbmRTTWpoU1lrdzVhR0oyTmxJ
      NFYyUlpVSEpUZEdrek1VMDNhM1EzVGxodVVHcDROVzk2YW1kQ05Wb3pkVllLTTNOeGMwWmlhM0ZM
      YVd4Vk5GTmtNMU0xWW1jelpVdGhORzF4UkhOSFJEUlVORVl3V2taaVdsZzBjRU55YUZBM1NYUnVa
      bU40U0dWaWJHSktUVWxMVHdwR00wcFlNVkZZY0dScGFUbFBORWQxZDB0aWNreGpjV2xxYkZsWll6
      VnNkbGd5WTBrMGFYY3JXbHBsWXpKS2FFTlZkMnB6UVROdlNqWTBVMWhSSzJGSUNqZDRPV3QzUldk
      amNrOXBUR3g1YTBabGFtWTJXbmR2ZW10aGExSjJUVnBNTmtOQ1NXZEhNMFZFY2lzd2VFUkZPVFpz
      Y21KWlJXaFJLMmxHUmpkUk0wMEtUSFIzTUZwcGFISTJSbFpaUVVsUlRVOVVTemhRVWk5S1RqWlZT
      bTh4TDJFd2JqVmliMlJWVG5Sd1pEaG9ibTB5Y0ZFMU5Ia3hMMVIwTlVGdGJFZExOd3BqWWtJemJX
      dHZZMk5LUWtOQllsVjRWM0JzVlFvOWJXSlBhUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83637-9
    - file_permission_user_init_files
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  tasks:

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Gather User Info
      ansible.builtin.getent:
        database: passwd

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Find Init Files
      ansible.builtin.find:
        paths: '{{ item.value[4] }}'
        pattern: '{{ var_user_initialization_files_regex }}'
        hidden: true
        use_regex: true
      with_dict: '{{ ansible_facts.getent_passwd }}'
      when:
        - item.value[4] != "/sbin/nologin"
        - item.key not in ["nobody", "nfsnobody"]
        - item.value[1] | int >= 1000
      register: found_init_files

    - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive - Fix Init Files Permissions
      ansible.builtin.file:
        path: '{{ item.1.path }}'
        mode: u-s,g-wxs,o=
      loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'', {''skip_missing'': True}) }}'


# Configure Firewalld to Restrict Loopback Traffic
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# complexity = low
# strategy = configure
# disruption = low
- name: Configure Firewalld to Restrict Loopback Traffic
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86137-7
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.1
    - configure_strategy
    - firewalld_loopback_traffic_restricted
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ZDRUVkF2TUhkaFJsVm1aWGRHYUhvNWVYbFlWMk53TUhoVVpGUUtORGhwUzJWNGMzUmljRVpNUWxk
      dVZtOWtSVWQxUW5aT1VVOURSM2RyYTBoM1QyZDZkamxqTld0UGFFZzJXa1owY2pSdVExWldWSEY2
      UWxKcFREZDFkd3AxWWxsc2MzTmhObVJXVVZCWVZVZEdXbTVCZHpRMVIxZFdiMDRyUzFOMGN6Tm9T
      QzlJUkhZelFVaEhjR1o2VmpkSFZVOUlTM1Z6U1VOWWMxYzVZbXRWQ25VeFVsQXdkWEpaU0U4MGIx
      Vk5VMWxtVW1vNFNGRmpORmhoUVV3eGVYZENhVXhxVW5sbGVFSm5NRTV0Y25vMlEwTkhkbUZ6TDJG
      b1NEUjNNV0pxTldZS09FWm5VRTVSTmxsdVpHbEdiRzB3WjJrMmFrbDJUVzFuVUV4bUsxQkZZVWR0
      UVU0eGVWUldaWFU1V0ZWVlJWUmhZVzVXVWtVMFpEWkVhSHBQVGxFd1JBcENPRk00TmpKMGJEUktl
      V1J2YTNGWU9VUXZRVVJET0haV1oyZEJNRFZYV0hoUFlWUnpXazlNYkRKcldqRXJWa1Z1ZVN0SmRE
      Z3dSRGR0Y1RoUlRsVkVDamhOYVV0VVlqbHhiRTFDUzBka1JVb3dRMU0wYkhCUE5rUlBTWFJNV1Ux
      VE9XSlpWbVpTZG5jNFZrTklkVVl3WlRabkx5OUVPQ3RXUzJoQ2FrMVFWMmdLWTJKYWN6aDRjak5I
      VEVOc1EwMUJSMVpsWkhWNk9IWm1aVkk1U1ZCM05IZ3pNRFpYTkd0dUwySkZOWGgwVFVoRU0wZGhO
      RkJvVmpjeGEweHZiMGh6ZEFwTFlXOW5VMXBCYUZwMlRFSkVjemx1YXpCQ2Nta3lZVU5RYm1GUVF6
      ZDNWMWhNZVRsVVFuRk1hMWRHYjFCNE5XY3ZibFJUU0ZBck1XNHhVV2xoTlVSWUNtUmFORTV2UVVs
      UlpYWjJSVXhtVEV0RVFtWlFWSEJrWWpOUlpXRmFOVzluVjNkUk9HZExVazlMWVZOblpXdG9TVGRz
      UkVGWVl6azVRa2RUVGpGNVRXUUtaV1ZvVjNaRlRuSlRVVWd4VWxBMVdtOXphRUZwTlV0T1RrUXZZ
      bkJHY2k5dGVuSjRTSFUxTW1STFJUQnBPWFV3ZGtjeVlXOUhSV3BuVWprd01UWktNUXAwYmxaVlFq
      TXZWSGN5UzNWSFZrNHdTRE5SUVFvOU5razBhd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Package is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - firewalld
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Restrict Loopback Traffic - Collect Facts About System Services
      ansible.builtin.service_facts:
      register: result_services_states
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Restrict Loopback Traffic - Remediation is Applicable if firewalld Service is Running
      block:

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted Zone Restricts IPv4 Loopback Traffic
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv4 source address="127.0.0.1" destination not address="127.0.0.1" drop'
          register: result_trusted_ipv4_restriction
          changed_when:
            - '''ALREADY_ENABLED'' not in result_trusted_ipv4_restriction.stderr'

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld trusted Zone Restricts IPv6 Loopback Traffic
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-rich-rule='rule family=ipv6 source address="::1" destination not address="::1" drop'
          register: result_trusted_ipv6_restriction
          changed_when:
            - '''ALREADY_ENABLED'' not in result_trusted_ipv6_restriction.stderr'

        - name: Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld Changes are Applied
          ansible.builtin.service:
            name: firewalld
            state: reloaded
          when:
            - result_trusted_ipv4_restriction is changed or result_trusted_ipv6_restriction is changed
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_facts.services['firewalld.service'].state == 'running'

    - name: Configure Firewalld to Restrict Loopback Traffic - Informative Message Based on Service State
      ansible.builtin.assert:
        that:
          - ansible_facts.services['firewalld.service'].state == 'running'
        fail_msg:
          - firewalld service is not active. Remediation aborted!
          - This remediation could not be applied because it depends on firewalld service running.
          - The service is not started by this remediation in order to prevent connection issues.
        success_msg:
          - Configure Firewalld to Restrict Loopback Traffic remediation successfully executed
      when: '"kernel" in ansible_facts.packages'


# Configure Firewalld to Trust Loopback Traffic
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# complexity = low
# strategy = configure
# disruption = low
- name: Configure Firewalld to Trust Loopback Traffic
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86116-1
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.1
    - configure_strategy
    - firewalld_loopback_traffic_trusted
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczNRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      QlNjMUF2TWs1cGRtNVRPRnBvYTJSeVJsbHhjVlpXTmlzd0wwOEtRM0Z1T1hCbVFTOXFiVTh5ZUZw
      R2RYaDRkRGgzYUdobE0yMDJSSE5IZDBjck5HMXhaMmsxUjBSalNtNW5SRlFyVVZKMlZIaHdUall6
      TTI1NFRGZDZlUXBwYzFWdlEyWm9NbmhxY1RZMFVVbHVTME5YUVUxQ1NVTlNlbTByZG1ONVpEVjJS
      a2R3UTBORFZHSTFhbVZsWmt0eVZVcHNOVmxUTjJkT1R6bHNOM0V6Q2psS09VZ3hXREF5VTJnelpV
      dGFNRmtyWlVzNFVrWTVZVE0wUzJNNVRsSklhM0J2VmxGbWJtbHRRMUJPVVdKMmJ6VkxTRmhvT0ZW
      UVp6VXdWVVpaT0hNS1RFc3JLMEpoYXpSbmFWUnJWbXhPVnpWQk0zWlROVmhIV1dWcVJXVjJWRFps
      VERCWmJqWjJOblZqT1hjeWRHNXBOR0UxT1UxVk9IbzFWRGhMWjNVeU9BcEJMelF4UkdoQ01qZDJV
      RkZRUW1Gdk4ySTVTVUZOSzFCWVlsWkhjV3BNT1RGRmVWWlBNVVJ2U1RkaVUwUlBWRVJyUlhSVU1t
      UXpTbWhRTW05SWFuRnpDbE5LTkUxeE5ubzJjMXBQVVhaTE5VMXRPR2RwT0M4clYzb3hSRk0wU3pW
      UWFFRnVhRE5vYTNOalMxbE9UMFpyYVVOVE9XVXpiRGRSVWpCUWJYZHZSRTBLVkhWcUswUlRNV2hQ
      ZDNOc1pXY3JlV05VVTJWQk4xTlNjelJVZVd0cVREQldSWGgzV2psSVNYb3JLelpCVlU5SksxbDZh
      ak0xYTA1M1NraFpVM05UTVFwNFIwZDFWM2swYmxBd2VreEViMVpzWjBNME5FSlNZbXROYW0xMU1r
      ZElVa1pLVFhSb09HTlhOblV4WmsxcFdsZ3lWM1UxZVVaV2NXWkxhRFl4UjBwT0NsbE1iVkJyV1ZO
      NFMzZFJWRFZ0TURFeldXdDZSMlIyZFZCbmVHSTBaelJMU3psTFprSTRSRXg0VUhZdlpUQnFhWEIz
      TTBWbVdHOXVRbEZtTURGRVdDOEtaMVZ4TlVGM2IxYzRVVzVzZWpoMmVYTldjVXN6VkRZeFIzQkhR
      M0J1VmxCWGNXWlBjbVU1YWtGcU5HRXhiRmh1SzJkNlpWQXJXbmREVml0c2VraFZMd3BHV2pWeVIz
      WnRVV28zZURGV0swdDBTa2RhT0FvOWFXTk5SQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Package is Installed
      ansible.builtin.package:
        name: '{{ item }}'
        state: present
      with_items:
        - firewalld
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Trust Loopback Traffic - Collect Facts About System Services
      ansible.builtin.service_facts:
      register: result_services_states
      when: '"kernel" in ansible_facts.packages'

    - name: Configure Firewalld to Trust Loopback Traffic - Remediation is Applicable if firewalld Service is Running
      block:

        - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld trusted Zone Includes lo Interface
          ansible.builtin.command:
            cmd: firewall-cmd --permanent --zone=trusted --add-interface=lo
          register: result_lo_interface_assignment
          changed_when:
            - '''ALREADY_ENABLED'' not in result_lo_interface_assignment.stderr'

        - name: Configure Firewalld to Trust Loopback Traffic - Ensure firewalld Changes are Applied
          ansible.builtin.service:
            name: firewalld
            state: reloaded
          when:
            - result_lo_interface_assignment is changed
      when:
        - '"kernel" in ansible_facts.packages'
        - ansible_facts.services['firewalld.service'].state == 'running'

    - name: Configure Firewalld to Trust Loopback Traffic - Informative Message Based on Service State
      ansible.builtin.assert:
        that:
          - ansible_facts.services['firewalld.service'].state == 'running'
        fail_msg:
          - firewalld service is not active. Remediation aborted!
          - This remediation could not be applied because it depends on firewalld service running.
          - The service is not started by this remediation in order to prevent connection issues.
        success_msg:
          - Configure Firewalld to Trust Loopback Traffic remediation successfully executed
      when: '"kernel" in ansible_facts.packages'


# Ensure journald is configured to compress large log files
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_journald_compress,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure journald is configured to compress large log files
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-85931-4
    - journald_compress
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      RjNVVkF2VWtGMVNXVjRTWFo0YW1GNGJHTjVWRmgyV2xSU2VEVUtVMVZLZFRack0ycDBVVTVETkdk
      M1ZETjBNa05wTWpCaWRXUnVZVGhrYTNGSFNreEpSRk5tYTBFek0ycFVkamhDYUhGcU9UbFJZMEpW
      VXpsSkwwTXpaUXA2TWtzM2EwOHllRVV5YUdvMlUwWjVORTFzTDFrcmIwVkxTakZTV2k5dEswdHdS
      a3hxZUhkRmJVNHZXRzVGTHl0dVVrUTFSMmhqYnpCSU9IUnNZMjV0Q2sxU05XczBOMFJ3TWxOa2Vu
      QlhTVUoyWWtRclREVTBMelpRT0dkU2FpdEtOMGRhT1V3MVluaDFlWEp0Y21SWVRWSlJRbXBKV1Za
      amMyVjVlblJCTm1VS2JIVTRVazVNU0RGc2FEQTRTWFJuUzNaSmRHTjRRbGxwUmxwNk9XUjZablZL
      VEZOaGMycDJZMlZHWm5sRVFVcEZZM2x1ZERGaWFrRXhNMjgxY21oSFpRcEdkRTR6YkZwSWNFMXdM
      ekpNVFV3clpWa3ZNakJDU0ZsMk1WZzRNbVZ0YVc1SVIwTm9aWG93U1V0emVEUlJZVTlEVFdSWVlW
      bHJlakpXVkhSM2IwSm1DbnBvYlVseVRFaHpWRE5PYVdGbFRsTXJWbUZyZGxKbUwwSnBiRm80YW10
      cE1uY3piM1ZRSzNOUFoxbFVSa1JzYzJwNFdYVkZla1l4VDBWSFVHWnpZbW9LTlhJdkwwNUNPRFpZ
      YzNCUFNYcERiRkEyV0ZCVVZXcHBRbFpPTmxwdGVrWkxMeTlCTDJOMGNETnFLMG8wVlVaaGN6aGtZ
      MDlYSzNsbE1HbEtTSFk1UXdwRFZXSTBiVFpyV21wVk4ybElhbnBWVEdJMldsVnVZbFV3ZVZGc1RW
      cHZjMjB4VERSTFZEVjFkREZNVjNJM2VEbHdja2NyT0Vrd1ZuQXpZVFZNYm1SMENsSmthMkYyTkU1
      NFJuWndSbTR2VTFwblFsWkZNRzVZZFVoNFdTOXZieTlTUVVkbGVIZE9WRzlhT1hkUVRVMU5RbE5q
      VWs1U1QwdDNaazB2YURCTGVWUUtTWFJXYW1kMVJXTlhjbUZzU1hkWk1YbEtRU3RUTTFSTlQwaEdL
      MHczTm10MWVVZzNZVmRWSzBOVE0zSndiV2w1ZVRNNFRsSnJTSGRQVXpCRksydHVPUXBsY2xjeU9Y
      RmljMWMwWVVwSFYya3pha1Y0VVFvOVRXaEJRUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure journald is configured to compress large log files - Search for a section in files
      ansible.builtin.find:
        paths: '{{item.path}}'
        patterns: '{{item.pattern}}'
        contains: ^\s*\[Journal\]
        read_whole_file: true
        use_regex: true
      register: systemd_dropin_files_with_section
      loop:
        - path: '{{ ''/etc/systemd/journald.conf'' | dirname }}'
          pattern: '{{ ''/etc/systemd/journald.conf'' | basename | regex_escape }}'
        - path: /etc/systemd/journald.conf.d
          pattern: .*\.conf
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to compress large log files - Count number of files which contain the correct section
      ansible.builtin.set_fact:
        count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results | map(attribute=''matched'') | list | map(''int'') | sum}}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to compress large log files - Add missing configuration to correct section
      ini_file:
        path: '{{item}}'
        section: Journal
        option: Compress
        value: 'yes'
        state: present
        no_extra_spaces: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int > 0
      loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[]) | map(attribute=''path'') | list }}'

    - name: Ensure journald is configured to compress large log files - Add configuration to new remediation file
      ini_file:
        path: /etc/systemd/journald.conf.d/complianceascode_hardening.conf
        section: Journal
        option: Compress
        value: 'yes'
        state: present
        no_extra_spaces: true
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int == 0


# Ensure journald is configured to write log files to persistent disk
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_journald_storage,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure journald is configured to write log files to persistent disk
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86046-0
    - journald_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2Iyc3pRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      OTRXVkF2TTNaNFJrYzVVREJoV1dacFJsTXlSRFJqUzBZNWEyMEtWRXhQZVcxdWNsbGpTamgzTTI0
      clpVUkVia2xaWmt0dWJIUnZNbEJYWmpWdFlqbFhVR2xCWjFwSmJIcFNiVFZ4UWpGSldFc3JjbEFy
      Y0d0cWFscEdhZ3BQZVdnMVpEZGlSMWhPVjFSR1lXRXlkbVpqVVdzd1VVeElNMGd5UzBsUFUwVkpl
      RlpRZFRkQ01Ya3hjRXBpUnpKdFMwOXFWR2xWVWpWV2VuVlVOa1p1Q2lzeVkyaHZORUpJTUc5d2FV
      TjZObUZwUjNKcVkzRldVazlQWTNKVFdVbHpUblZFVmxGSFdrWXpjelJZVWxwbVFXSTNaVEZCZEhC
      UFlVSnBTWFZVYldzS09ISlFjazkzTDBaeGJEVm9kMkpIYlVwdk1rTlNkM2N3U25WSmFYQkhXbEZy
      SzNZeVFURk5TVFpzTTBabGVHMU1SMHBuWWtwM1ptTTJTbmxTV0Zvdk1Bb3JhRk56UWpWT1FYVlRi
      WGwxVkVwNllVVmhNbWsxY1RoUVRXNWpLemxoYTNWNWIxWXpZMkkzWVUxV2JDOXVlVmNyYVVSMlZu
      SkVWamhHWlZjMU5GRkVDbTVEU0hFNFJFRm1SVU5DVlc5NVJXaFRTbklyWWt4UVYxRjRibXhIY0Zk
      NWNEZHBUVmNyU0VwdFZsQlRhazFJWWpaYWVFMWthVlJzVGtWTE56RkpXa2dLVFZwcGVsUXpRMDRy
      WkhJM1p6UktaV3MzTkhWcFpEa3lNalpOYVRGUWVWUnFTV1pTZDIxVGFXVkRSV2xqYkVKRmVtdHVP
      RTFIZWs1amRHTlVNSGw2UmdvNWNWbDRSM0JtU0VaQ09VZGxOU3Q1WVZWTE9WTjVhV0pGVW5sS1JY
      ZFhhMmh3VWl0cU9FSXljVVkwV1ZKVU1rWlJjMVlyZVM4elptOXhXRXhIVEVaS0NuUjBWR05EY1VO
      NFpXRkRlbHBTZFVNMWFYcHJUblZEWlZGaloyWkZNRGhWUkVkUllYaEtTRGg1VldWSFFVdFhNRVp1
      T0N0eGJVTk9WakZRYjA1UGIyRUtZakZXUVVRNVJGZDFXVlZIUTBWUk1IUk1TVGxEVnpGak1rdFpO
      VGhTUnpjMGJUWXlVVlVyY1RacE5ESXJOMFUzVEUxWU5uSmthRVpFTTBweE1YWnRlUXBQYTBGTVdt
      UTViV05YY0c5elVqRnhPR1pMZUFvOU9HWTJVZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure journald is configured to write log files to persistent disk - Search for a section in files
      ansible.builtin.find:
        paths: '{{item.path}}'
        patterns: '{{item.pattern}}'
        contains: ^\s*\[Journal\]
        read_whole_file: true
        use_regex: true
      register: systemd_dropin_files_with_section
      loop:
        - path: '{{ ''/etc/systemd/journald.conf'' | dirname }}'
          pattern: '{{ ''/etc/systemd/journald.conf'' | basename | regex_escape }}'
        - path: /etc/systemd/journald.conf.d
          pattern: .*\.conf
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to write log files to persistent disk - Count number of files which contain the correct section
      ansible.builtin.set_fact:
        count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results | map(attribute=''matched'') | list | map(''int'') | sum}}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure journald is configured to write log files to persistent disk - Add missing configuration to correct section
      ini_file:
        path: '{{item}}'
        section: Journal
        option: Storage
        value: persistent
        state: present
        no_extra_spaces: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int > 0
      loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'', start=[]) | map(attribute=''path'') | list }}'

    - name: Ensure journald is configured to write log files to persistent disk - Add configuration to new remediation file
      ini_file:
        path: /etc/systemd/journald.conf.d/complianceascode_hardening.conf
        section: Journal
        option: Storage
        value: persistent
        state: present
        no_extra_spaces: true
        create: true
      when:
        - '"kernel" in ansible_facts.packages'
        - count_of_systemd_dropin_files_with_section | int == 0


# Disable Mounting of cramfs
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of cramfs
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83853-2
    - DISA-STIG-RHEL-09-231195
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ZHZRVkF2TTFkb016YzBUSEZLVjJOR1VGRllabkU1YVVZMFRXWUtWVFJ2VURaM01VWXhabTVMUlU0
      NGIwbGFOSFo2V1hjNWVWVmFaV3RsY3pWc1draFlVbVpVTkc4clFWQmtPWFp4YW1KWFJ6UkhjRlp0
      ZUhSc1dVSmhVd3BGZUVsQk1FOU9lRlpPYkhwSlRYTldiR0pOTWl0SlJuSkdTMXBhV1ZrMlptYzRW
      aXR5YUhJeFREUkdaRVpPZUVNMFNXRXpiR3ByT0RkV1IxUXpaM3BZQ2poVUszcE1Na1ZtTm5OdGF6
      RmhRV3BUYW5sUFNUQjFjV1k1UTA1bFQwMTBaR3huWjFWVGN5dDVlVmxIYkhjMlIyeHlTWE40VlVr
      M2VXTXlRV2RoTVdVS1prNTNVV0pRWW5GelVsZDBjM2xOZUZOM1NFeGlTbXAyU0hjclZWTjVjbFYx
      VGxGMk5sbG5XalJUVTFKR1lXdFhOalo0VGtwQlMydHJTakJ4UzNFdldRbzJka3BSUTBjNU9UVlJi
      M2xzYms1R1dVcElWRWxSYUhNMFIwNTNlbGRZUzA0eFkybzVOVWxuWVdsQ1kzcFRZV3hOYkhRelNs
      ZzFkR0kyVkZWM09YSlVDakpLYzJ4TmExUTJRU3RLTlRZck9FbEVZa295TDBVclJUaHFOR3hvVEhO
      NE5GaHRVelprU2tOQ05sVXpOVEp2TWxSM1FVSXdXRmxZT1Vjd1JFRTBRbWdLVlZGcFNIRnBjMjla
      YVRJMlJVNTFTMEpOUkdwemFuVlFMMXBYYUVaQ2NGbDJUMkpJY0ZSUk5Hb3ZLMVl4TVhGSWQySm9l
      RzlRY25GSU5qVm9Za2h0TndwNVdHSjJkMlo2WlZkcVUzWkdSbkZZYTJoRmVFMVZkbkpGTTBwbFZr
      SnJhRk4wUVRGamVYbG5VSGhYTlhwbWNqSm5VMmxaVW5wRGRHTmplRGhoVFVZM0NuQkJhMEpwTWtS
      cWNHZzNjazVOS3k5aWNqaGtUM1ZyV0VKS1MyeGxjVlpJWmtKM1FWRlFWVE4xYjB4dlQwUTNWMHN2
      UzJwcVJsQlRWMEpNTlhaclRqa0tUbVJHVEdoalNFNTNWblYyVG5KWVFrTnpZMWt2T1V0VWMxVm1W
      U3QyYzJaTWJERjZiRU55VTBGeUt6TjJiVFpKWm5GWWJ6TXdZbEU1YWsxS05tZGFkUXB2VnpZeEwy
      UTNRbEJKVEV0MU9VdFpOVFJUU2dvOU1tODJjQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'cramfs' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/cramfs.conf
        regexp: install\s+cramfs
        line: install cramfs /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'cramfs' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/cramfs.conf
        regexp: ^blacklist cramfs$
        line: blacklist cramfs
      when: '"kernel" in ansible_facts.packages'


# Disable Mounting of freevxfs
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_freevxfs_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of freevxfs
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86763-0
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_freevxfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      WkhPRkF2YWxOM1RIcEZiblZhVG1OMk5EaGphRVJoVkcxdk9Xa0tTRGRCVUdSV1dESm1PRkpNZHpO
      WWJtTTJjbVpFUkZZelFtRmhhVmRJTDBOVk5GaERiMmRVVFRaYVFXOW5XRVJzU25abGMydFRWalZV
      Vmt4bWRVMXhjZ3B5YzFBemVrdDFWbUppVmtWdlMzWjZZVmhGYjFVMVJqUnVNRzR3UVM5elNXbGFi
      SEJ6WTFCbU5WUnpWR2xXT0VwS1ZHczJTVzlPYWk5bFVVeEhWVGhFQ2xOMVVHNDBXVWRpYXpSWlpI
      Wktha2xWUjAwNU9IWjFSMUpXTm1wVFVVdGlhSHBoT1Vwd1VIWkZlRk5wYkcxU1psRnRjMVJVU20w
      MVlWTlZVeXRqYzJJS01sTndMME4yYWxFNFFXNWpjSEZIVDJWTGEwbEtiMGhaUldreGIyOHhORmhh
      WVV0Nk9YZENTQzhyTDBKNlRsSkZRMXBVVTBwQmNpOXZXRkV5TDB4UFR3cHNXVGswU2tZck5UVkVa
      eXRIVDI5cVlWcFBVSFo2TkU4MFpURjBVbWx6YVN0RlZETnRZbVZuZW5jNU1ISTRVQ3R5UkVGbVEw
      RnJUMlpNTjBrM1VUQllDblJ6U0hoRGQxY3hlRFZzVVVkdVUxbERaQ3NyUm5SM1JsWjVVMGwxTmpK
      NlJtWTJaVUo0YzNCTFpYRkpWRm8xUlZCcGF6WlZORVY0ZW0xMFUyTlZhR01LVUVjek5FMHZkbmxG
      Y1dwNFpURlJhbWRXYlcwNFZtcEdhbVUzTW1WcGQxZENlVVJIYWxCU1RsRTNlRzlFWm1oVFFYY3JV
      VlY1WTNKd1VHMXBRVFJGTndwQ1JrUTFXVk5SZUZWNVZsbFJjVlowTW5kM1NHOXFUVkptZFZWclRH
      ZG1kM0Z3WWpreFptRkdWRWR2Y0VGcmVtaEhZMlZxUkV4M05uVkhhR0l5ZGtKa0NubGtOU3QxYzJj
      ckx5czFTa05WWmxKaFRXTkZVRVZyU3poemNsRlRlVWN5VkROU01sVllTMjF4YUVZelJHdDZSV2hN
      WWtoa1lVUjViRGt3Wm5weFlrWUtWM3B6V1dVd1JHdEVUWFpMVGpSTFZIQnNRakpFYTBaWGVUSXdi
      SE01SzJKc1EyMU1SRE5zVUdOSGFGSTFRMGhWUVdSQlRXOVBRMDh4WWtsS1FtNDRZUXBsYTFSU1dH
      UkdMMnhTUzFJMVMxQlJla2RZTVFvOUswTnZkUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'freevxfs' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/freevxfs.conf
        regexp: install\s+freevxfs
        line: install freevxfs /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'freevxfs' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/freevxfs.conf
        regexp: ^blacklist freevxfs$
        line: blacklist freevxfs
      when: '"kernel" in ansible_facts.packages'


# Disable Mounting of hfs
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_hfs_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of hfs
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86764-8
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      SXZNRkF2YVdWNmNtcHFiVkJyUldzNFVrdzNTbUZaYVhaVU5uRUtNa2RxY1hab00zWkNNMEZ2TDJN
      elVYQkdWVXhDVVdkc2IySlliMWxYYkdOTk56aElUM013VTBWaVZHZHhRelZvTUhsMFZqQlFka1Zh
      UlV4aFZESnJkd28xVWt4cFRVdGxhRXhIVTNWbFlsbHhRbEJQY2k5eFozUlJkMk5vVUdnMlduUmla
      emt5VEc5U1RGWlJTREJOVlhwck5WUnNRVXRKYjI5R2JUaFhWV2RYQ2xwYWJHNWFiR3hpY0VwSVMx
      UnhPVVV4U1U1a1kwUTBUemhIVVZRM1puZHdNMmRLT0hwTVJqbE5lR0UwUnl0NU5XbE9kbFZaVFdN
      MVlVZG9TMk54U25rS1RuWkxlVnBTTDFoMlJVNWlkM0ozUTFoSlYyNDRZbFUxUjJWdWVVbDJkbXR3
      WVRKdlZESmtWRU0yTjBkaFFYaHhibVkyT1VkRWJrbGpRVTVEZFVGSE5ncDBVRlpwZFZaUVNqaG9X
      REpEUW01d2VFdEZOSGhhWTFaVmQxSk9TU3MxVkZOR01FcHFSVmhMWmtscFprRk9PRUV5UzB0dmF6
      Uk9aMnhvYmsxcE1TOHdDbXRRTVRaNU5pOURNRFJNV1ZZMGFGUTFTR2hwZW1kbWNHVXhkRmxHZUdj
      eVMwczNSRTVPVTJOc1EwWlhhSGRUYTNscE1qUTRZVUZOZEZnM1pHeHlaellLZW1sWFRuRlVUMGgy
      T1VWNFdHaGphWEExTlRkWU9IZzNORE5hYm5ReFIybFpaV2RuVWtaMmRXRjNNa295WkdsUGNpdFpZ
      VWhwU1VNNEwwWm1aV0Z0Undwb2JVSllRMFUxUVd0aWJYVlNZVTltVHpReVJXTk5kRWwzV21WeFFV
      eGtTMWRKYkhkMmJteFJjbVoyTm1ob09TODNUMWQ1VW5aME4xRkpTVFZJTWtkR0NtUmhUV1pQVW5C
      cGVXOUxOVWxxWms5QmVETnJZMDlTWWtadVEwVjZjMHhsTm1kTWRWZFFhVk5ETTJOeFNqVXJiazlo
      ZGpSdk1WaFhTM1JtY1d4VE56WUtTMkZDZVZCTEwxSnNUMjFhYzFWcmFtUnNja0ZZVEdFNWFEWmpT
      Vk15ZFhRMFRITTBhWFI2VGxaaVNrRkVhbEJNY0N0WFUzVTBaR3M1SzNaSFdGZE1TUW8yVDFkRVFX
      cHZiVXBJU2xFNFFWaFZkMWRUTXdvOU5sUmliZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'hfs' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/hfs.conf
        regexp: install\s+hfs
        line: install hfs /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'hfs' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/hfs.conf
        regexp: ^blacklist hfs$
        line: blacklist hfs
      when: '"kernel" in ansible_facts.packages'


# Disable Mounting of hfsplus
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_hfsplus_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of hfsplus
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86765-5
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_hfsplus_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      RjNORkF2TTJ4SVRWUnJaMUV6YkZwNlozQlhPVFUyVGxVM1RWWUtZalpQVlZSVWRWbzRjR2h5V2xO
      VlVXNU5ZazV5WjB0Q2NEbEViMVJaTW5aMVNsWmtObEJ3VjAwNGNUa3phbmxxTDBWU01IbHFhVVp4
      TUZKVFNFbEtXUXBqUlZjd01sY3dZVWhIV0ZkeFkwOW5abXBIZDBFMmNVRlJTMmxWVjBZNWNXcG5k
      VEl3SzBOVWExRnBRWE5JYjNkS2IyOTBlVWxYYlV4TGNISnJiMlJFQ2tWaWR6TnljVzVHY2pWdVZF
      eE9kMUJZUmt4UVkweHBTakpJZDNObVpYWTJabFpIZGxOSFdrbEpNRmM1VkVSMVduTndaRkZLZG5O
      eGVsWnZXVXBUVTBnS1VHWktWRzlNYUZadk1taGFUMXBKT1Vzd2VqaGFWMnhNVVVkc1pHVmxibmQw
      UTJkb2FtVXpiVTV0VUVkQ2NqRXhSblEwYzFkU2RtdDFlVUV4VFVoNlNBcDNTMEphUlVsT1dIZ3da
      amx4TURZclptNUZkRkJ3TTNoNk5tbDVNRkIyVFdOWWEycGFTbXBpT0RGdWFFTnlURTFQZFhadlJW
      ZDNlR3Q2VTFoMFJHVmlDbmhZV0ZaR2RuSkpURzV5U1NzNU5tOU9ibXM1VW1GV1JGb3laVE00T1dK
      R1JWRTFXWEpvYTA5alUwTTNTaTgwVEVORGFqRTFObEJpUjA1clptRlpXbklLWkM4NFNrMUplbk4z
      VmtObVNGQkpkemR0TUZGU2RrdHVTR3RpSzNCRmNXRlNiamwyY2xZeVNHZFJiVlJJWW1kd05WaDFW
      VU5UVkVoTlMxSTBPV3d6UkFwRE5EQmlhMDl6YUVsNFRsbDZkR3g2TW1GVVdWRkJVWFpJTWpKVGRY
      Qm9TV001Tml0eWRscHJOR1o2Tm5RelZDOXlNVVZHVDFKblVIaGlaR3hwT0VZckNtMDRSREJXZDJa
      dlpuSlRaaXREU3pORVZVcERNMG96TmxkR01Fd3dkV05SY21aRWNtdGlXSGwyYVRnNGFUZDRTVVZL
      TkM5dWJtdG9VaXMyZEZSNllsY0tWMEpxZWtadWVuaG1TSGRaZDI5TlQwUkhWRlZWS3psMk0wTlRa
      MFJXV0hCRmRFVnBlRXRFWWt4SFdWVkdRVk5sZEZaVFJVOWxPWEJIT0RkVVRIQTJOUXAwTjFrNVZs
      QlFNRlpoUVVkNVJVMU1UMkpCYndvOVIzVkxNZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'hfsplus' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/hfsplus.conf
        regexp: install\s+hfsplus
        line: install hfsplus /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'hfsplus' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/hfsplus.conf
        regexp: ^blacklist hfsplus$
        line: blacklist hfsplus
      when: '"kernel" in ansible_facts.packages'


# Disable Mounting of jffs2
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_jffs2_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Mounting of jffs2
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86766-3
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_jffs2_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      SXlPRkF2VWxkS1N6QllNVTE0VmxOclVqbDRVMEpaVFRaaVlUTUtOMlo2YjIwNWFqZFJTVXRIUm5G
      MlFqaHFSMGxQYW1vd04xbFhjak5vZVZBclMyZFBiRmhGV1VsbVFub3ZOekpDYUV3clV5OUpSalJH
      V2l0MFZuQkRZZ3BOWlU5TlRFVmhkak5KVW5Ga1dtVTJRVGhNTUV4ME1WWjRRbFIwZWpNd09XTm9T
      eXR2WW5aemQwRkJjakJhVldsQmFURmpXRGRZYlVoaU1UUjRjSFZYQ2twUVoySlFZVFZQVmtsUmIw
      cEVMMUYwWlhaUlZIWXJZVVUyTW5kbFRXdHZRMWhDWmtGeFYxRmtaVkJhYlcwd1FVVlJlR3h1YzNK
      SVQyYzBVRnBWUTNNS05TOXdXVGhYTDBGalpWaDBOMVpvVDBKaVdXSkJWWFpUT1dVelZtMXlVVzVW
      T1dGa1ltUldaSFJpTUdJNWFsUkRNRkZzU0RFelVVSlVPVkkxU21OSk53b3lhRzExWWtSbk1HaDFj
      RkZXUzNCNlRHTndjMGRyVm1aVFVqQkxabGsxT1M5NVpVUjVVMVpvWVVjMFNVOUlkSHBUVEZCcFVV
      eDFhalU1WTJOTGJrbHhDakV2TkdOd1NYTk9hblY0WTBOd1FYYzFjbTlXV1VRMlQzQndWMU5sUVVS
      RGNIVlVkemQwVVdJelRWbHBTQzlsVTFCSFpGcFhlVTFsZUhSSFpHSmtjSFFLYTJjeFYxRjZjREZQ
      Um1zek4zZDJVamhaY25sTE1tczFSVVV3VERGdlFuQXdTRzlNVFV4NFJVaGxjMjFoVHpGQ1pXNXRl
      WGRhVjFacVlXTlpaa0pETXdwRVNVZFBSMDVKVlV0T1IyMXZTRWxqTW1odGN6aE5iRlF2WTJ4ek5F
      SXJLMkkzWmxGclpreFFiMUpTV1UxT2NqUkVkazl2ZEcxMFMxWnFXbFo1Y0hWeENqZDBPVmhIT1d4
      Q1VsZFpOMUp2WldoS1dGRlpObloyUzNvM2NUVTJUVVJXYjBnNVNrODVOR1poVkdJd1dWZERkR05S
      TURWbVF6bElhRmt3YTJ4VmVqUUtjRXR6UXpGME5tNDBiekpQTUdkSGNqbHBUWGROV1ZRNFNEWnhO
      a3RyYTFwbWEwdGtaVWx6U0ZGa05tVmtUVkpNYmtKRGNHTm1lbEo0YzFoNE9VRkdTd3BKVG0xQmNI
      Ukpia0U0VFZsV1dtWkNXVzFtY0FvOVRYTklNQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'jffs2' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/jffs2.conf
        regexp: install\s+jffs2
        line: install jffs2 /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'jffs2' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/jffs2.conf
        regexp: ^blacklist jffs2$
        line: blacklist jffs2
      when: '"kernel" in ansible_facts.packages'


# Disable Modprobe Loading of USB Storage Driver
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle,multi_platform_slmicro
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Modprobe Loading of USB Storage Driver
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83851-6
    - DISA-STIG-RHEL-09-291010
    - NIST-800-171-3.1.21
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - PCI-DSSv4-3.4
    - PCI-DSSv4-3.4.2
    - disable_strategy
    - kernel_module_usb-storage_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      cEtXVkF2YVdoUE9YRlNWVUZoUlU5YU5DdFBibWxWY1dKNGNHRUtkV3RDY2xaMGJrbHNaRzA1Vkda
      ck0ySm5SRWR3UWxaNmJWWTNMMkpoUm5sMFlrSmpSMnBGWms1d01rNDNSbEV5WVVSek5UVm1aMFY2
      VjBWT1oycDRjQXBJUjFOM1lrVnVXWFl3TVVKNlVsbHlPVXRzVFRGblpsUTVla1UzS3psYVFUVmhi
      azB6YlV4dFpuUldZazE1YjBGMmNVOUJWRU51Wm1RNWExZDFUak5qQ2pkb2VHTm1WWHBHTlZBMFMw
      SkNOblp4VkZKVVNqVjNVelZaU0RaalZIUm5iV1p2U1ZaU1ZtNHJWa2Q2UWtFeGRuQldLMVZ5YzBw
      WVUyOW9OeTlwVldnS1JHSk9UbkZ3Ukcwd1RVRlBUM2hNV0ZsRmRGWTRZMFpCT0hORlZXdzVOWFEy
      TkU5cmJVUjRjak5wYjNOeldXbzBPVnB4VVVWeFVHaFBaMWRUTVZKM1V3b3dSekpIVkVwM1pGTmpl
      a1p1WTBwRWF6aHBMMlZ0ZUZreWRHUXpSbFozUTI1RlV6ZEdhRFZZYmxWMlVsUlBOWFJGTldZMWRt
      bGhlVGxFWWxCT1ozbFBDbXAxTkhjeFUyaEJiMmhVV2tZeFMyZGpjMVZFV25FNFYxUk1ZMHhOYkVZ
      dlFsbFVLM0kzUzFSbWJUbFFjbmhtVGpWWVNIa3ZLMWhXZG1kdlptZDRObE1LVlRKQlptVjZjMlZz
      VG1waWJsZHBWRzk1Tm5aWlpGaEhVVlJRZDBWeFpHMUtZM2xRZFVabFZsWnFTazE1VnpBMU9XTm5i
      VGRtVVd0RmJYQk1WMVpaUWdwSWNIaDZiVUV2YTFGTVpGbG5TamxJUVRGeWVsUkxUbmhJYzBWR2Vr
      cExXVEpLTjJWSFMySlBhMHBRY2xVeldHVTNkVkZaVkdNcmJuZFhjbFY2V205MkNrSkhWVmxqVFdw
      QmMxSTNPSE5KUlZOVFFXVk5MM1V6ZEZCb1pHbDVNMGRYU21sSmJWZFlaR05IZUcxTGRsVXdjemQ1
      U1ZoamFsVkhiblJMV0hjM2VWUUtTbll2VmxveGVqTllZbmRPWWk5cGJVaENPV1V4V2tzNVdUSktZ
      WEpNUkhJMFpGTlhNbXBsT1dFeE1sZHVhV2RPVm5GRVEwTk5kblZpU2psRk4xWlRhZ3BKUkRsalpF
      VnlhMFJxV21NelNIcEpTRU56UmdvOVkxZGFWQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure kernel module 'usb-storage' is disabled
      lineinfile:
        create: true
        dest: /etc/modprobe.d/usb-storage.conf
        regexp: install\s+usb-storage
        line: install usb-storage /bin/false
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure kernel module 'usb-storage' is blacklisted
      lineinfile:
        create: true
        dest: /etc/modprobe.d/usb-storage.conf
        regexp: ^blacklist usb-storage$
        line: blacklist usb-storage
      when: '"kernel" in ansible_facts.packages'


# Add nodev Option to /dev/shm
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add nodev Option to /dev/shm
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83881-3
    - DISA-STIG-RHEL-09-231110
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczRRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      TmFRVkF2TVRCcWFrbzVSSEZNZUdScFdtTmFWbVl4Y0ZSQmRtNEtaakJPYzBkQ1FsWlRRVlZtVVZZ
      NU4xRjBORGxoYkhFMmJsWXJVbnBsVTBwTVVXUjRRM0poVFcxcldHZE5kVEl2ZFdWRVpFNDRRa012
      UzBaTFV6Rm9RZ3BDTWsxMVVVOWxNMnhwUm5WTU1FUnhXVXg1ZWxOaWVraEtVSFJUVjJSM1JFSjZj
      MUZDWVVwa1NITkhTR05hVWtGRVkzcHpTM2wyVlZGdFZIbFJjRTFNQ2t3NGFEaGxlWHB3Um5BdlNt
      SkZWRGxyTm5aMVUzRnRSMnhYVnpSQk1uZHdkMnMyV2sxVVoyUTRRWFZTYWt4d1RXdGhlbTVOTlhK
      VlRVNDNSazlpV1RBS1QycExZV3hoZWxwQllrcFlMMWx6ZGxoWGJEbHNRMnd6Vm13NU9GRnhNSHBR
      VmxwQ1pVUlBUMDV3VVUxQlJHMXNVMDFTYjJKRE9FWTViSFEzVkhKNVpBb3JlVzA0ZEZCaWVFVlpO
      RlppWWpWM1JrOUJjMGRXVW5wbE9USmhOaXN5YkhGelQyY3ZSa0ZoV1cxeGRVdzVXWFU0Y0VOUlFu
      QkxTMlpZTkZFM1ZrUnBDbE5yYzBKcmVYVlpOVlJhWVd0TVozZFJaRU5qV214VGFsVnRNVkk1TkZK
      aFZERmFUSGMwV0hrME1rRm9lbnB3WW1GSVEyOVhPVFZEYmpadkt6Vk5lRklLYWtOVmFYcHZUaXRO
      TlhGNVkwMDRXbWd5Tml0MFlXNVBURXd2ZG5sT0swZHpObGM1WW1wa1NETXJSVE5wTkdWQldITTNa
      VkJsU2xkelFVOXdVREF6ZFFwTkt6SklaRlJVYzFGRWJVZFFaakZOWVVSS05XOUJhRGhpTm5obFVY
      QTNSWFpxWWpSb2EwMXZha2ROVDA5WVdHVnNVemcwVDFsbmJ5ODRSR1ZqWTJoeUNqSlZVVEZ0ZUZW
      R1kzTXphMjkyYjNoWWRXRXZkRzB4WjAxR00zSk1ORFZZWW1OUVVEaFhPRTVSTjFkbGVsbDRZM2xP
      Um5sVlFtWXlka1ZXUXpnd1VXRUtWWEJ3VkVJME0xSkRVRE5RUVZZdlJWcHZURFkzVjJaSkt6bHhX
      R0phTTFJdmJqZHJkV2xDVmpOdlJrZGhUbEZtTlZkSWNYVTViMDVWUzBoSWJDOTJid281U2xVNVkw
      NDFRMmRKUVdSaGVWZE5aR012VHdvOVRtZEpTZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nodev'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "nodev" not in mount_info.options

    - name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Add noexec Option to /dev/shm
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add noexec Option to /dev/shm
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83857-3
    - DISA-STIG-RHEL-09-231115
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      YzJZMUFyZDJJMk1HZG5aMWRwYkV0MlN6WmxNRzAwVkN0NlVsWUtUMGxJSzNsTlYweFFiRzlUVTI1
      c2MzRlNSbEl4YVRoR2VEUm1ORUZHYlRGME0yOHZjalZFWVdjMGRrdHpURlp2T1ZWcGJHaG5kemhs
      VnpkcFMwd3dlUXAwWVVORFJ6Wk1Na2gzU0V3M2NtVlJjR1p2UXprNWEwUnBVRXA1UlZGc2NuQlZP
      SEJHWTFGS2MzazNZMDFEYlhOcGNtbE9kVEF3WWtGMFRXWnJTVUpFQ21neE4zZ3dVR0UzUkM4MmFV
      MHlSRFIyVlZoc05EbDBUakJwV1Rac2FUSnpPRVpLWkRsV1RGcFRabGxSZFV0eU9YY3JOMmRJTXpW
      TVNraEdOM0ZrZUZvS2JWRjFkRVZWU0dKVWRsRnJiRlZXZUZKbFVEbG5RekpoTlZobFVXSlNSMHht
      T1dJeFpWTmtaWGMwTmxKaVVGVkNTRk5TUm5rMGVYWmtOMFZFVjNKUlJnbzJNRWRqUnpNck5GVnpO
      RmRwYzNCUVVXVXZLMU5hZDNRM1ZXWkhNRVl4ZW1GM1luTlNjbTFYYmswNVRUazJVa3AwYm0xMVYx
      ZzViVGhGUVVNeE9VdHFDblZGTlVNM09YbzBTbkZDVjFvNGRHNVVkVEJGYkRKbmFHWjZZU3R1WTBk
      WGNUaFZMMGQxUm5GcFExSmFkMU5FZWxoT05tcGpOalEyVlhGTE1qUlhiSFVLTjFoTWNrZGxjRU5z
      Y2tKMFJUVldOalFyVDI1d1dXNHlOR2cxU25oS2RYazJaa3BHWlZWYVkxQllSa2xMVXlzd1dEbHVa
      VXRIYmtwUGNFdzFSMGt3S3dwMmQySllaVlZzVlRaNlRXOW5UREJRU1ZoSk5UTkRZbGhzVGxsdFVu
      aDViVnByY1RGQ1Vtd3dPWGR4YXpSdE1FWlVUazVtY2pZMGR6bFJVRzlMV1d4R0NrTnZZVWh0THpG
      VmVsQkpabTlDU1ZKMGFqZFBWV1pMWjNsaVVtOVBORWhDVUVoT2NtcFlaM2t2UkdWb0swSmFlSEZo
      YkhGRVZtWnhNV0ZuWlZWTmRsRUtaM2hKVG10TFZFWmxhbEZ5YkdoS1FYVldlVFJzTTNaUGRXRkNW
      ekU1YUhseE0yTkVlbll4Y0VkeU1HMXFMM05QZVZFeGR6VkhVVFZJVDFweGNHVnhZZ3BIV25ObGJs
      RnpWVnByY0ZKeVlYbzJRMUZRS3dvOU0wdGpkd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',noexec'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "noexec" not in mount_info.options

    - name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Add nosuid Option to /dev/shm
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: Add nosuid Option to /dev/shm
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83891-2
    - DISA-STIG-RHEL-09-231120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyczVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      WlhjMUZCUzAxeFEzUllNelJWWW1SVFkzSTRLMlozWTNOM1MyWUtRakF6ZWsxSE5uVnBMelYyTUZW
      NE5XUlZSR1Z5U1ZRd1FtSTFVakZJZG5sTE5sWm5RM3BDTms4eU9HaDROM2RGVWl0blFsUnpaVzlE
      ZGtSd1pHMXdVd3AwYTNBM2JYZGhNVVl3YVRkM2VGa3JRakpzYTJzemMwaHhPR1JyYkVKS1VFRXdh
      V2wyUWpGd1RFNU9RM2RtWTJ4VlQzQllRMWg1V1ZWallrcHpWV3RKQ2pKMFYyNUJVMmRtZEVvMk9H
      ZE9Ra2RLY2pNeE1rcEpOM0ZKY0dsWlVHUk5XVFZwV0RaUEwwRlFXbVY1VTJ4TVprdFJWR3hWWm1n
      MlFVWXJNRTlvVm5rS2MxbFdNMXB6WVZkbU1pOTZNemxvVUhsamJ6SldVRGxMUVhKRldVUkNLeXRq
      TlRKTk5WUnBla3A1VkU1bVdrMU1aekJxVTJKRFRXOU1WMVJXWVZSU1p3cHZXVXRVZDFoa1dEVTNW
      bXBsT0RoNVNtMXNPVWxSZURoSE56TXZVSFJEUjBacGJuTmhkVVJFVTJ4aVlqWmtLMVk1T1hKQk1t
      eG9aMHQzWm5GSlRWcFZDa3BwTjFGdFN5OTZkR3N4UTBGVGFsaHFPVGRuVEZFMmIwUlBlbXBrWVVw
      VFEwVTRRMkp6VVM5U2FIQnVjR3h6WjNOTFFVdzJkbVJEVDJGb01UQk9MMUlLUnpaYWJtMU5RbVpC
      VG01UFRVeEhXakZhVDBSTFUxaGFlVXgzZG10U2RUUkNOalpNVUU1cmRuSkVVMDQ1WjBoellsSnNh
      amhwYzFOMGFUa3ZVSE53T0FwemFIRkVlVTFtUlVWbWFHTkJVamxqUVdwalZrZHVjVEJ1WjNseFUw
      MXFTSHBNUW5ocE1XRTBMM2RwZDFSdFlqWlpRMEY2Y2xNMGNUaDVVazR3TDBGSENscEJRazlrZVhW
      TU0xbEhZblpYSzFoQ1lWUmhVVXRhV2xjNVRqbGxRV1pRVTBsT1oyNXViMlZyVDA4clRIbzFVVVp0
      ZVU1RGVERlNUMUZrZWlzcksxUUtOMFJTYTB3NE9HMHdLMDlYVFRoMFRuSktWbU5LVW5CWlR6TjZW
      azFGT0ZwQ2FrczJjalZsY2xZNGJsUm9MMUJ0VDNCS2JXb3dkV1J1YVhSdVZYQkpjUXB4WVRNMGNX
      VjJNMU13TjNaV1ZYQTVMek5tY3dvOVpFZEtjd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
      command: findmnt  '/dev/shm'
      register: device_name
      failed_when: device_name.rc > 1
      changed_when: false
      when: ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
        "podman", "container"] ) )

    - name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        - '{{ device_name.stdout_lines[0].split() | list | lower }}'
        - '{{ device_name.stdout_lines[1].split() | list }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length > 0)

    - name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info manually'
      set_fact:
        mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
      with_together:
        -   - target
            - source
            - fstype
            - options
        -   - /dev/shm
            - tmpfs
            - tmpfs
            - defaults
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - ("" | length == 0)
        - device_name.stdout is defined and device_name.stdout_lines is defined
        - (device_name.stdout | length == 0)

    - name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to /dev/shm options'
      set_fact:
        mount_info: '{{ mount_info | combine( {''options'':''''~mount_info.options~'',nosuid'' }) }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined and "nosuid" not in mount_info.options

    - name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
      mount:
        path: /dev/shm
        src: '{{ mount_info.source }}'
        opts: '{{ mount_info.options }}'
        state: mounted
        fstype: '{{ mount_info.fstype }}'
      when:
        - ( not ( "kernel" in ansible_facts.packages and "rpm-ostree" in ansible_facts.packages and "bootc" in ansible_facts.packages ) and not ( ansible_virtualization_type in ["docker", "lxc", "openvz",
          "podman", "container"] ) )
        - mount_info is defined
        - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" | length == 0)


# Ensure There Are No Accounts With Blank or Null Passwords
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_no_empty_passwords,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Prevent Login to Accounts With Empty Password
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83611-4
    - CJIS-5.5.2
    - DISA-STIG-RHEL-09-611025
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2Iyc3ZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      SjJTVkZCU1ZwRGJXcENZV05PY1d0Qlp6UklZVVpOUzBoWFZHTUtXVlJKU0hwRk1UZElaRVpZVDNC
      RGMwWXdXa0ZJTVRCMk5YWnpiVGxhVFRGblRVcFJaWFEwVkZKaU1XcEZRbWhJZFdWamFreFRlRXhI
      T1dkMVYxRlhWQXBYVjFBdmJubzNXRkJ4VmpKVE1tY3dLMGN6TjAxUVprMHpLelYyWlhwNE5ubHVa
      MUJZV1VsNldWWlRhMFpPVGpkdWFuSk5ORU5VVlVsWk5HaE5ZV3dyQ2tWVFEyMDRWbnBPZG05ck1V
      NW9TMmt4VUdZMWFYZzBWWE5oUVVJMVZ6WkZSekpPYVhKcllYaHFZV3BqUVUxU09FTlNjSFk1ZUcx
      eVkwVXpLMGhsYnpnS1NtNVdabFJwVFhKNFJVUlpNamM0Vkd4RVNuVmplRXhJVGxFek5WaG5kR0Z6
      U25FM2J6bFdSakZQTDBod01IbHJjVlZRY1ZwT2NsbHJLekJ0UTFaTFVRcERTRWh1ZFV4UVEyWjVj
      RFEzUm5sNGVWUXJkamg2ZDFCYWRFbzRTRUZ5ZHl0aFYyOHlMM0pHVTFSMFpWRlBVME5qTTBObmVt
      OWlRWEpNVVVsRldWWlhDbkV2V0RoTVoySkNhRmxrWlVWWFdVVnBjbTF2ZEV4a2VFSndXbTFzWkZa
      Sk1rUjROR1ZDTWxOeVZIUldOMEpVUzI0NGFIcGtXVTQwTXl0MlpHeG5SMVFLY1VaeFpGbzViVEk0
      YVd4bk4wZHJhbWxoUldRM0wwRTRaVVpKUWl0cVRtOU5VbXBVVDNCeVltTnlZVTlIZVZZMVdtbEpi
      MlpsTVdsTWMwcFNPVFowY3dvMlVUWTRUbVpzZWl0VmMwRklTVmQwUVc1dFMyVTNWMFZVZG5SRVZu
      cEJjQ3Q1YUVZNFdXUjVhRU5FUkhabFltWndkWEZ5Ym14emIzRllVWFUwYlVoYUNqTnVRM1ZVWVZJ
      ellXMUhXSEJTZGl0bVJIaE9PRUpZZEhod1dHbEdOek5sWXpoV2VubFRUblZUVERadk9URmtTVm8y
      U1VVeFYxbFFjemRtYm1WUGNVTUtSRWR1VG13NE9YbG5RM0ZIZUcxcVEwWllUa1p1VVRSYVJsWmxR
      VWgxUkc5bVF6azBlR2RDWldSYU0yOXBkWGRvWTBkV2RYSkRRMG8zY2xOUUwxQlFSZ3BKWjFoWlVV
      STFPV3RrVFhCaVJXNVdUVEYwUVFvOVpEQldlQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Prevent Login to Accounts With Empty Password - Check if system relies on authselect
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present
      when: '"kernel" in ansible_facts.packages'

    - name: Prevent Login to Accounts With Empty Password - Remediate using authselect
      block:

        - name: Prevent Login to Accounts With Empty Password - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          failed_when: false

        - name: Prevent Login to Accounts With Empty Password - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
              - result_authselect_check_cmd.rc == 0
            fail_msg:
              - authselect integrity check failed. Remediation aborted!
              - This remediation could not be applied because an authselect profile was not selected or the selected profile is not intact.
              - It is not recommended to manually edit the PAM files when authselect tool is available.
              - In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended.
            success_msg:
              - authselect integrity check passed

        - name: Prevent Login to Accounts With Empty Password - Get authselect current features
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          when:
            - result_authselect_check_cmd is success

        - name: Prevent Login to Accounts With Empty Password - Ensure "without-nullok" feature is enabled using authselect tool
          ansible.builtin.command:
            cmd: authselect enable-feature without-nullok
          register: result_authselect_enable_feature_cmd
          when:
            - result_authselect_check_cmd is success
            - result_authselect_features.stdout is not search("without-nullok")

        - name: Prevent Login to Accounts With Empty Password - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b
          when:
            - result_authselect_enable_feature_cmd is not skipped
            - result_authselect_enable_feature_cmd is success
      when:
        - '"kernel" in ansible_facts.packages'
        - result_authselect_present.stat.exists

    - name: Prevent Login to Accounts With Empty Password - Remediate directly editing PAM files
      ansible.builtin.replace:
        dest: '{{ item }}'
        regexp: nullok
      loop:
        - /etc/pam.d/system-auth
        - /etc/pam.d/password-auth
      when:
        - '"kernel" in ansible_facts.packages'
        - not result_authselect_present.stat.exists


# Install AIDE
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_package_aide_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install AIDE
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90843-4
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-09-651010
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      Z3liMUF2TTNoVE9Vc3dNbXhWVG1KTVFXaDFhMmhuU0ZvNUszY0tZakZxVEV4UFlscFBaMGhEYUN0
      eWJ5dDZORGQzYjJWdGQySjRUSGhMY1VsNmVHaE5PV0pNYVZjMVpXSkZNalJzZFhnMFEyWjBhMlJP
      V1VsNmNXUkpNd3BaTmpCc2RrcHNNRm81U1RGaVpDOW1SVTloWW5aU2FGQm1aVEEyYUZsRGNFNWtO
      bVJhZEhkS1NtOXhXV1IwYm14d1kzRkJhamRJV0ZCUlZqZ3JNbHBQQ2pjMGIyUkxMekpwVkVkS04z
      cFJkSGRXYkhCaFdHUlRRelZVZEdWWFZEWmtNazFtU1VsRGNXcG1NSFE0UkdRelpVeFVPVFkwWlV0
      aFlVMWpXVko0U1c4S2VuQnJTa1UzV25GRmNuUTNkRTFyUzAxTGJGaFBiakJUVEZabFNHTTNiMHhN
      WjFjMVkzSm9kSFIzTHpBNGVVZEhSRWR4ZEVOYVNTdFJjR0l2T1U5V1ZncGxTRE5ZUTNaSU5TOXRk
      V3RqWVZKTlJWcDBWbXhTUWpCd1RqUk1lRnBKVWt4U0swWkRaVnBESzFVclNVSjRSRXMzVEU1TllY
      WklaRUUyU2toYVVIbFVDbGRWZUdwUFVFWldTMnA0TWtSQmNVSlJkR1ppU1hSUGNtZFhZVkJpVkVW
      U0syNTVTVFV2TjJwYU5TdHRaRk5sYTBSSlZXYzVlQzlhVjFsa1dUWnhaMndLVjNacVlrbG5lR3h2
      Y0ZGT1JVSkJPVmwxU2toalkwVktWV1F4TUZobFRscHBNbmhwTlVOck5uVmtVVGRrZW1OdlNsVXJW
      WFl6ZGpaYVRUWkRRMXBEZFFwNGQzaFBWSGRxTXprclFUUlhNekZJZVVVelJHeFhSVU13TkRoMVJp
      dFBSeTlWVDNnNU1FMDNkekZNVlVNMVpXaHVLMk5OYUZCQ1UwUjBXalpwTWtwdkNrcGhRVzQzVVhW
      alNUbEZWbXRTYlhCNWJWVXphM2RtTjJ4aFVGWlZNbGd6UzFOTmVUUTNWRUU1VTNoQlNrOVZjVTlJ
      VDB0R1ZVMVlaVlV5UjNaeldVUUtNbUpCUkRsRFpXRnlUbkYzVEhsUGVVZDZibE5JWkhoU1kzQk1a
      RlJEVW5WeGFHRm1lRUl6TDJKRFNVSlZjbFZaZVhCV2NYWjRiMHd3T1ZReU1FdERXZ3BrUzA1NFUw
      bDRhMGhWU0d0M1lYQTRkWFZTT0FvOVRUQjRZUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure aide is installed
      package:
        name: aide
        state: present
      when: '"kernel" in ansible_facts.packages'


# Install firewalld Package
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_package_firewalld_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install firewalld Package
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84021-5
    - DISA-STIG-RHEL-09-251010
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_firewalld_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEJRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      VjZhMUZCU2xOdmFFdzJVak5JTmtabGVIUlFNMjR5WjA1bE1GY0tVMUpyVFROSFoxWnlabGw2UXk5
      dFJHY3JlbGRzV0doMlUzRjVWRlo0VWt4RVFrRkJTMnAzUjJGNFRWZHNUMGs1ZGpaaGExRldjM3Bx
      WlhWWVRsRmxWZ3BYY21OQk5YVnFNbHBEVHpsRVlqQktjV2hNWkZKTE9YbFpNMHN4UW1OTldqWXpN
      RzFUT0ZoNk4wUllaRTQ1YkRSdVNrd3JaRVJtVkVSWGNqQnllSG8yQ25kUFNqbDZaa0U1V0N0MFlt
      cHRTRzVUVWtoc09ISlRWbkJJZDJ0RmJHMXRWSEV4VFU5VmMwd3pTRVUzVVVOblQwc3ZNMGxxYjNV
      NWFVNWpWR3MwVWxjS2EyRktNRmxNYUU5dE5WVmpNazV4TjFab1lrSnhUVXR6YzI4NFJXd3ZRemxU
      V2pWVWJFaHVkamRaYmtZeFFtTlVURVpCYUdkb0wyZFFOME5PVFZKUGF3cHdVREUxTldselIybHZV
      bnBvVjA1Rk5rdHJaQzlzTTJ0aFFYSjZXVGRQV201cU5XNDBabGhUY25ZNVRITjVlbGt4WjJSMWIy
      bFJhR1pZTlZreFNISk1DazQxV2tsVFMxRlhlRU5qVkc0emRtd3hiek00UTNKSFIxSk5lbEp1Um5w
      aGNYSjVjMnRTYWxGVFpWZHBUbHB4TjFwb016Wk5RMFJ4VWxkdlRreG5VRkFLVldsdmRWRkZUWEF2
      WW14SVNFTkxWVXhrUlhCWmQzUjFUVmw1YmtsdE5TOUtURXRWU3l0TWRrSjJXbGhDTmpJd2FrSkdl
      R0ZZVWtwVE0xRXlOMWhFUndwb1NWRkRWMlZsV21kYWRpc3JRbEZ2VDNkaEwzbzJSMFF5V1dGMlZ6
      UmhlbGxHVldvMUt6Y3piVlp4U0VOVk5XTlVWRTlRWXpsWlUwaFdkRVZVYzJ3d0NubGFWRkZrWm5C
      YVVYTnlhREJIVm1sR1JXbFZLMFYxT1Vsd1ZEQnNkRUpNSzFFdmREVnlSMngxTDAxclF6VlVUM2Ny
      YVZSdEwybEZaV1JpVEVNck9Ya0tURkptWml0dVFVSnhTV1JXVmpkWllXbzNhREo0VVZFd1MwRnNl
      a2t3WmxwVE9VNDBlR1pzVW01MlZrMVJZMUpoYzFwM2REbG1UR3RvVnpSUVMxaGxNUXBwYVZOSGFU
      UldUVlV4UzNObFRHOWtjemRhVFFvOWJUSkxXUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure firewalld is installed
      package:
        name: firewalld
        state: present
      when: '"kernel" in ansible_facts.packages'


# Install nftables Package
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_package_nftables_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install nftables Package
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86378-7
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_nftables_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeENRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      aEVSVkF2TUhOcWJVMDVka1JPYTBKRlN6UkdiMkZKU2padU1UQUtaMWgyUldoVGRIVjJRak5ETldW
      TlRVOURjVkprZDNkRVNXOTFXblpLTVdrdlJERXlXRGhETDBkcmFYRlhla2tySzA5Wlp6RXdLekpU
      TDFSb1RuSnlkQW8zYzNZMU4zY3JOWEZtSzFBMlpIWkNOa2xxT0RCNlZVWnJhR3MyTW5oUU9EVklP
      RWhUVVhCMGVtZHVPRzg1TTA5Q1kyOXpSMlI0ZFVabFJVUm9NalZZQ25OS2RVTlVhMkl2YkRWRGVY
      cHZNbkJGT1RkS2RFZHFlRGw1TTNsNmFXMXhNbWxKTkRWWlJrUkhURVV3ZEhobFpXaG5TVGwzV0VN
      NWFGRnhObE5KTnpjS1J6ZzNTRkpKUW1wNlUxaEVlRmxXTVdZeVR5OUdTazF4ZFZSVWNrRXlkbUl4
      VjNsaVJHZ3lhM2hLYVU1elFXdHBiRzVVSzBWaVlXSnBWSFlyU2tWdmJ3cHJLMXBPYkhkemQzVnRZ
      VFJDU1M5cFJEWjRNbTF5YTNGd2NYTm5Sa2xrVjFCaFRucG9hakZWTUZoc1ZUZGFVbXhCWVhwamIy
      UllTVUptVG5neFRtZzVDbWhMZEhVck5WRllMMVpsWnpSc1dWRjFRMlZVUTNwemJ6TkRTVXhYTDNJ
      MlJHb3pVRTRyWVRoWlNGQlJaekJ2YTFBclFsQjNUblV2VWxGdVRXVnJZa2tLZGk5MVZURnlWakpL
      VldWM1VIcGxOakZsVW1Wbkwza3ZjbUpRY25oeEswcEdZak5GVkVoWE1YWXJlSEZ3TmxKb1RYQlZO
      VWwxU1ZOaVF5czRSazVuWmdwQldtRXJkalJDWVZWb2NHazFja280YWxFM1dXNUdZeTgxU1RGRVEw
      WnRaMFZMU25KclZFVk5RMXBQU2s1NFZIVTJiM2hRZWsxc2FFRXlSakU0TUU5VkNpdFNURkpZWmpC
      UGNESjNaems0VW14eFFtdFhMM1V5VHk4clVGWk9OVkpYUVZONVpqQnRSRzg0YWxWQ0syOXdOVE5S
      VERsTVowdHFaSE52T0ZaRUwzWUtNbG93ZUU5bmIxTTNVWFp0V25aaFRGZHBTbE5JTWs5WEt6VTBj
      VkpQYTB4WVdqUnVWM1prTXpWamJ6aDRjQ3RJVWk5S04wRkZOa2d5UTA5dlYxTnhlQXBPUlZCa1ls
      bFFlRVpoZUVoTFdWTkhRMFJ5YWdvOVQwVXpUd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure nftables is installed
      package:
        name: nftables
        state: present
      when: ( "kernel" in ansible_facts.packages )


# Install systemd-journal-remote Package
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Install systemd-journal-remote Package
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86760-6
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_systemd-journal-remote_installed
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE1RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      dHRPRkF2TVZCRFVrRXdNWG92UkRkUGNHMVZkbWgzVEU1UVlTc0tlbk14V2sxSllUTTJNV1JpYVhj
      MFNURXZUV3d4T1M5V1dHa3dTRkkwZUU5YVZtTkdaelZoT0d4YU5rNURSRkU0U0UxWFdrTjNjR2h3
      U1RsRlZYbFJXQXBsUTBoeFYwd3pWbWxYYnpaeU1uWk9TVXhVT0RSNmNUaENkbnA0TlVGVlFYQlRU
      SE0zVFdOSE5XdG5jbWg0U1RaYVMyTk1TVWN5VW1ObU1rWTJOMlpVQ25FNU5uZEhWa3BvVDJ0SmRW
      TnNWWEJvVEVWWlRsRmlNMnRDVTNsVVFWTkxORlJxZFVnMWRIVjRSMDltZVZOMk0zQnlNazQwTUhk
      amRVWk1lbTFZY21ZS1MyUnNjbkE0VTJ4TVZsbHZaRGwzU2tOVVpqZ3hjMW80YWk5a2FUbDJhbVJR
      ZWxwNWEwWkJXRll5VEZsV00xaHFhMVZqUjB4eGRYbENaRFZ2VldveWJBcFRTVU1yWVd0Q2RFNVVW
      UzgwVURrelpXVkhiRkpwV0cxc2FGZFRha2RXWTA1eFl6VXZiMFZWY0doNVN6bFdiMHBsYWxOT1JF
      MHdVVnAzU1VaV1IxQlhDamw2VGtwdlIwOXlhbWh3YUVReFVYVjJNVzlqU1ZFd2NraFlOM0F5Y1RO
      QmNscFRValpZWm01RlRrbDZPU3M1Ym1oVmFsWlRSazF6VGpKaE0wRjZjV29LUzJ4YVMwNW9ORlJW
      YkVrcldWVkhaMnRYWVVkSVoxRlViV2M1UWtKSFZGWmxWRVpHZWtwTVVHaGFja1JETkRVelVUVXlS
      WGw2SzBFeGNsY3hialp0U2dwUlFVNDVVbFE1TXpBeVEwMWlTMDFXYXpBM09GaDFRMjVrUjJjemQx
      bHZhVGd4Ymt3dldrTnRTV1ZpU0VGa01GWnROR2RKV1NzNU5sbGxRVlZ4VTFONENtTnNPRTFqY0VW
      b05tdHhOMDlXVUdSU2NFUldhR0kwY0RGMllVUkRLMmRUYUM5RFdEUnhXRUZOY0dkS1NtMVRTV00y
      Y2t4YVpHeFNUa1V4ZURrMVZtVUtaV2hpTW5KaFIxUkhhbTFRUVN0clF6aHhkVlpoTkdjd1luQkhZ
      MlpvTTFSR2JrVTBUWEo0VVdGbGQyTjVaa1ZGVkhSSFYxSlZibVIzTXpkRGNrVTJkUXBwVkUxMFEz
      WkNXV3A0UkVkVE5HOVRhekU0U0FvOWMxTlVXZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure systemd-journal-remote is installed
      package:
        name: systemd-journal-remote
        state: present
      when: '"kernel" in ansible_facts.packages'


# Disable Network File System (nfs)
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_service_nfs_disabled,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Disable Network File System (nfs)
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90850-9
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - service_nfs_disabled
    - unknown_severity
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEVRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      UjFORkF2YWpOVGNXUkZhREZCUkhGS1dGZzRVMEo2YmtWMEsxY0tTSGRzZUhsVmQxRjBZMFJ1ZEha
      amFFaDVTalZRU2prck4zSlBjR0p4VGtGVU5HbzFTRTFUVEU5TmNWcDNkR3RuTm1wS1RHUTFWbTR2
      UmpOd1RpOUNMd3BGVmxVclNGRk9OSEJSVjJvMGJIUllOVVJzZDBWRmRWZEplVlJrVFVOVk0yUmxO
      M1l5YjJOVmQxcFVXazlJWlhBeVNtUjBLMFU0V2xoblFYZ3hUbkp3Q2xSRGEycEpSakp0UXpSWlZs
      ZGtUa05OY1VaaFMzRXlUbEk0WlhWeFdsVnViSGN2VW5kamFUaE9UMjFFTTIxV1R6VTRNMWRqZEZw
      NU1VOVJlV3RFUnpjS1l6a3pSblZrTUdWMU1HZEpaMmRuUmtWemRrbFBOMVk0VUZwSGRrNDJTMWh2
      TUdOcFIxSTNUbXRQUlVkalpucHhiMnBSTmsxSFJHdHhhSGhDYUVsNVlRcHRZbTVDV2pGV1VUTlBM
      eTk2VkUxUU5EWm1TV2R3VjFsRk16SXZURk0wVUhCME4wNU5RekI1ZUhKaUsyOXBhMUJ5TDNGbVVE
      UTROalZ3WWsxdGEzZFBDa1pVVFRGNldGUlVWVzlPUzJWd1p6ZDBTRkprTlcwMFltczFUWEU0VEdZ
      NGJubEVhVEpwYTJSWFVrSXdUV2RpZW1sRWVsSklRMDB4T0RGVWNYZFliM1FLUm5GTFIyVXdWa3By
      VUhCcE5HOVRabWRvZEd0TFMzQlhjMkZwTm5aWGFFOTFNVloxVHpZeGVIQnVjV05rTjBSaE56bEdh
      azQxVURSbFJFOVNlRzF3TXdwaE1rUmhhM2hwT1dkUWJVaExTVzFJWm1sUkwwNVlieXRoYjJWblV6
      ZDRWVkJtVVZZd2VVRk9PVXh6T1ZCV2RqbEdUR042WVVKQ2VERlZSVlZKZW1NekNqZzJOelpSY2xo
      WGVHVkhVamMxVFcxb1VqRlNhVFZzTlVoS1NVOU5ZbFF5Y21WV2FXZGxTM1ZQTkUxa0swdHFhVnAy
      U1RReGVFNUxORFZNYUZBNVRqRUtaV1JTTkhOVmRGTllhbFp0ZFhsNWVHVTRhbHB5YkVOQkwwdFhT
      bTFvY2xCMVUxSkRVbkpEVEV4UFpGSXdUbTQ1VUVodldGQkdUM1JTTDBwU01UWnBMd295WkRSc0sy
      eDNjWEI0YUdWMmFFMWhWbVZ3WndvOU0wcHZVUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable Network File System (nfs) - Collect systemd Services Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable Network File System (nfs) - Ensure nfs-server.service is Masked
      ansible.builtin.systemd:
        name: nfs-server.service
        state: stopped
        enabled: false
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - service_exists.stdout_lines is search("nfs-server.service", multiline=True)

    - name: Unit Socket Exists - nfs-server.socket
      ansible.builtin.command: systemctl -q list-unit-files nfs-server.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable Network File System (nfs) - Disable Socket nfs-server
      ansible.builtin.systemd:
        name: nfs-server.socket
        enabled: false
        state: stopped
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - socket_file_exists.stdout_lines is search("nfs-server.socket", multiline=True)


# Disable rpcbind Service
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_service_rpcbind_disabled,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = disable
# complexity = low
# disruption = low
- name: Disable rpcbind Service
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-84245-0
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.4
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - service_rpcbind_disabled
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEZRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      ZHJkMUZCU2t0UGRpOUhZV3BHY2xWYVdrdHFjemRHZUdvM1RtMEtSVFEyV0dremRWQTVRVUVyUzFv
      cmNtZHBjSEJ5T1RkamEyZ3lka3BqYjNOUFJYcFhaMmRCV25WUE1HeFZNR3N5UjNKaFMxRmFaems0
      UXpCcWRVdDBUQXBJVmtkak5sRmhla3h5TVdaT2IxcDRjSE5pWTBSdVJYSmtkR1poVmxOcFQzZE5V
      RlpRZEdWdk1FVm5jVmxQT0ZWSWVqbENURzVKTmtKQ1lXVlNNVXBSQ2psWWN6VmljRXRtTlZkdFdI
      QXZZbWRGZUM5YU5XWkdVRzV0YW1vdlZWcGFlSGR0YlN0Tk1FWnRORmMwVVZkTVQxSnFOVzVYZEZO
      RlNUUmFSMUZPUld3S1ZrOU5iemRWWVZCQmJIUllUbTVVY25BMVJTOTFOMmsyY2tkME1WRjZWSE5C
      WTNGcWVYRk5jak5SU0dOTlYxUXhUMEpxSzI4d2JWVm5ZakoxVTBkSUx3cDRlSGR2Um01SEwycHlR
      a0ZPYzNoVFIwbE9jbXhRTVVaUk4wWnBRVGhSTlVSUE1WSjNlblJ3UnpoQ00zb3JTaTlDZEdSRFky
      RjZVMDAyTDNwTVdFcGxDaTlIVDNKSFV6UlZhRGRTZFZsNFJVZERVSEZXTlZrMVUzSklUWFpQVkds
      eldtRXlTbFowVjFrclkycFJUM0kwVFN0Wk5rODVVa2h6U3k5RlluaHpPSEVLYW5ScVdubE1PSHBC
      YzJJMGFYbFVaMmhHVW5GbFdsWnNjVlZ5TmxGd1NXdHhiREY0VjFNeFNGb3JkVE5CVHpCSVlVZzBl
      WEpUWkRFckx6TmtZamxoY3dwc01tRk9URGRKV0dWUWVXbGlUMFV4VEVkUVJHVnFVbXRXYUVsSFVt
      UlVWRGRSVkUxUWVYazNZbGgyT0ZwT1ZFWmxURlZJUW5Wak5uSk5iVGRrYURZMUNpdHVORzVMTkN0
      T2JqazNjRTl6WjBFek9FMU5aVVJVTVcxMk1FRXdWSEpZYUhKWWNYQjJhMGtyYWtOVVNIRnJPVkZO
      ZGlzM2IxRTJNM0Z0UkZObE1VRUtkRWs0V1hvellVTXhWbTlyZVRGUksyNTRVSGxNWkU4NVMwTlFO
      SFZUYW1OUGRqTndUWGhuUjJsTFFYVm1TRGRMYmpSd05rdHRWRlJKVHpKVlRXVkVlZ3BhYTNSRlVs
      bFdkM3BCV2s1U2FVeGhXa0ZZUlFvOVJuTm5TZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable rpcbind Service - Collect systemd Services Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable rpcbind Service - Ensure rpcbind.service is Masked
      ansible.builtin.systemd:
        name: rpcbind.service
        state: stopped
        enabled: false
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - service_exists.stdout_lines is search("rpcbind.service", multiline=True)

    - name: Unit Socket Exists - rpcbind.socket
      ansible.builtin.command: systemctl -q list-unit-files rpcbind.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false
      when: '"kernel" in ansible_facts.packages'

    - name: Disable rpcbind Service - Disable Socket rpcbind
      ansible.builtin.systemd:
        name: rpcbind.socket
        enabled: false
        state: stopped
        masked: true
      when:
        - '"kernel" in ansible_facts.packages'
        - socket_file_exists.stdout_lines is search("rpcbind.socket", multiline=True)


# Disable SSH Access via Empty Passwords
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Access via Empty Passwords
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90799-8
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255040
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      MUxXVkF2TUZSSmFTOXhTRFJHZUVkc2JVb3pkblZJUm5aR2NrY0tiaXRuVDBjeVIzVllaelF2YkVG
      U2RIQTJZV2RUU2s5TFNrcFdOVVpNY0hOUlZrWmlSVVF4VmpkU1MwdFRaR1p3VUZCRFdIQnhiRTVL
      Y2pORWNqZHpPUXA1U0RWbk9IVXhZM1l6V0dSVmNXVjFiMjFvTjFNM1ZubzJWRTFNTDJkNmIyVmFk
      U3RKVG5ZMVYzUk1lbVZ3YTJGR2VFY3paREI1TTBSVE5tZFlhbmQzQ2tjemJEY3dkVzFrYTJWd05H
      eE5WekV3Tm1oR1lWUjFaVEE0YTBoTlVuRnRiVkZWV1hoSU5HbHVXVkJqVVZNd05FUmtWblpRWVRo
      Vk5HWm1UamRFY1VRS1VGbGtjekE1Y0doMVIyNW9SbkYwUkhKTVpFeEVWU3R3U1ZWaldWQnhMekYx
      ZUM5MU1XZFdOR1JTVlhoRk1WaEliMnRLZEdsaFJuUXhOalY0ZWl0UVVRbzFNRlpzVkZnM2NYTnBk
      RmhuU0dOMFIzcGtUMjl3SzBvdmFFVXhjMDByVFc5aVRtaFpWM1UzZVVKeWVFcFZlbFoyU2poUmFU
      RjNUVkEzVkhscmVUZEJDa0pZZGxOUGQwOW1RV3RJU0RNM09YSm5lRkp1TkRWNldqQm5hR1ppYkdK
      cFRuUjFRbmhWZWxCME0wbE5ZbUpsUVZKbVUwRTRLMGx2YlVWclFrRlJZbGNLTkc0eFRuRkJPREJE
      WldodVMzRm1ZVWRJTVc4M01XSmpPRUp2VW01cmNISmlTemxvVFRCcmRtSkVVVGhUYnpCSGRVSnhU
      bEZZU1daSFkyeGhRVE5DVUFwblkycFdSSFp3V0habGVGWXdRbkJqUld4dU16ZHNOakpOUzNkbFEz
      a3phVmhuWnk5cGRuWlFkRVZKTjJ0U2J6VlhlV0V5ZWpCSlIzZzJlblUwYlZkWkNuY3JjbWhOY0dW
      R1VHMTZhMjh6YUUxYVVrSmpTazVNYTFsMVVqUTRZbG95UTI5VmJETjZlR0Z5ZUVsSFRtbzBSWEYx
      U1ROSVpUSkphWEUwUlc1Q1Iza0tlRkp5TkZscWVTOVROMWhEV0VwR1Ewa3dZM0Z4WjJWdk9EUnlW
      VVZHVVhCM09WQTRSbEZhTWpGcWVXbGpWRWczZFZSTlRUTllkRTFxUWxwVmEwWlNUQW9yTW1nck1r
      WXJObXc1ZENzemNFSTJUekZyTVFvOVRqZFpaZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Access via Empty Passwords
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter PermitEmptyPasswords is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "PermitEmptyPasswords"| regex_escape }}\s+
            line: PermitEmptyPasswords no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Disable SSH Support for .rhosts Files
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_rhosts,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Support for .rhosts Files
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90797-2
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255145
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_rhosts
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dFRkMUF2TWxvMVdUbHFURU5ETVZkbGRWcHpLMEZFWmk5YWFrNEtXSE4wVnk4cmRFa3plV2t4UlhS
      TFEwMUVNM1pTWkd0eVVtazBkMEZsVG5CaVFVaElSSEJVZEZWb1VWRXphSFJNU1hOM1EyNXphR05h
      V1VkbU1FMVdjQXBFUWpWaloydHZWazV3SzFSM1psTndWMlI0WTNsV2NYQklla0pFTkRnNFJEQnpU
      RmswTVZObE1GSjJXRXhLU0U1MFUzRnZabFI1YVU5QlRXSXZNell3Q2lzeFZVNDRXaXRGTjBwUVJH
      VjRXamRWY0M4dlpqZExMMUV2YVhkNlZYTkJXSHBUVm5kcmVrNXpNVEpXT1VVeGFGaE9hRmxXVFZG
      eFIxTkdkMlV6YW1FS2FtMUxPRkZvU2xkeFpuZzNkblp4UjI1SU1XeEdNaXREVWtwRGJXZ3ljMEZO
      WmxSSlEzUjRiazlUTkdOMlNXWlFVVzFHZHk5alFXSkxabEZNYjBkVVRRb3djbnA0ZFZCVVpsb3lW
      MmhZZUdjNVRYRmlSVEI2TmxaS2NTdE9ibXAwU1VkM1lWZ3hUMDV4ZW1wMEx6aEdUME55YlVGSWMw
      aDBjbEpQU2xVcmRrRTJDbHBOWjFKNk5GZDBiemtyYTBSaFZWZzNXaTlUWlUxTFFVaEVRWGswYWtj
      M1MwcHVZbmc1YnpSSVNrOVJOMk5XT0VWRFkwSnFRMU5aZDNKQmVHbE9VbkVLUkRVMFpra3hUVmh0
      Tkc1SVZVdzVTRkpsYjNSVWJpOU5Na3hEZVN0bldVVXZSMHB4TldKSE1ETm9UekpWUW5oS1IzSkRi
      VUkwZUZOakwxUlNWR2N6ZFFwVWJqTldjR2RtVW05YWRTdDVURXczT0ZRelVqbEJaeThyTmpWd1oy
      OU5iMVp1VVZaUFoxazVVbkZRVnpGdVJIUjNPRlF4VmpOVFNVSnJZa2hHT0RoeUNqRlBWMkpEWTFs
      SVJrRkJTVk00ZWtkbk9EVnNNMk5WYzIxbllUQmhTbkF5ZWsxNVpUbHJZMk5vUkhOUFYxQnlWR3hJ
      Ulc5MVNXWnllV0l5VVVWSkwxVUtaa2RyT1hvMlNWRkhlV1ZhTVZkRGFXTlZUeThyYmtsVFJuSnFk
      aThyWVRnMmIwMDNPVlUyZVd3ck9XbENWRVJxUjNOeVEzQTFkRzV2ZFRKVVZVeHVPUXBoUkU5SE5u
      QjZjMmxZTlVsc1RTOXNkVGgwUkFvOU1EQlNVZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Support for .rhosts Files
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter IgnoreRhosts is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "IgnoreRhosts"| regex_escape }}\s+
            line: IgnoreRhosts yes
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Disable SSH Root Login
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_disable_root_login,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Disable SSH Root Login
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90800-4
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255045
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      UktjMUF2TUhsU1dHRnljV1JKZDBOVkwyVXZPRm9yTm5GMFJuQUtkVk5uY1VoRVYwWllZbGxTVnpV
      clIwY3pPVE0xV2prMWMwdERUa2RTYTJ0TGRTdExRbmg1TkRaQk5FaGpTVVZVTWxSdGQwcEhlV1pD
      WnpKdWRHTjRVUXBYY0dSYWMzVnlWVGg1Wkdka1ZtaHNaRkJ2WWprck0xSm5ZbWQwZHpGNlpGQnRk
      a1ZsTDJWUVZXUm5USEZuYVZGYVpTOTZhR3B4VURZelZWSldWbUZ3Q2poNU4xY3lTVlkyYjJ3MGNH
      NUdVVEZaVFV4dWNtOTJZMk5YUmxRMFFpdDNTa1k1YkZCRlUzbEVhazRyV1VRMlFUaE5NMHA1UzFs
      Mkt6RXllbGxuTHpNS2VEaE9iblF6YjNCTlNtSnFjRU5qZVN0MVNDOUdhRVpVVDFvclZFWjJiMmRR
      TDFwUU4ydEhURmRyTm1KREsxZHBSek4zYkM5TGFXMWhLMWd2Vm1GemNRcHJZbkZYZEVrdmIzbERk
      WFl5VlZrME1XSlRjRGhrYWtsMFQxSmxZVUkxT1haVmFucGFiVkV3YUcwclR5dHlVMG94VG5NMksz
      UnpTbnBLYkV0WVVFWkxDakZpV2xkVGFEQjFkR053YnpkVUx6SkRRa3hhYmxGUk9URk9hMUJxUkdN
      NEwwSTNURVZPWTNScVdXWTRiM0pWTmtOa2RsVXhVVmxFTTA0clFUZHVPRFlLY1dWdmRGVTBRMXBF
      UVN0NVYyaDROVEpZUVdOTVowbEVWV2xVV0VoWmVFYzBXVzFQWVVRM2QwMUplRUkyYW5oRU1uUk1Z
      VUpZZEdOVGNreDBhbmhpVndwbWVVeE9UbXcyZG5OYVFsZEZiMHR4TWprMVFpOWFiV3BhU2tWd2JG
      bGlURXRTVTJSNk1ISlNUSEZ0TUhsMldsZFFaV3RuVW1sSmFVZFZWSEVyTjNkdUNtSXlXamg1T0RV
      dlNsaGpkakZrUjJkSlVIVmxMME5IVDNkbFN6VnVUMUJaTUVwMFdrTXZhakI1WXpnMVltZE9ZM0pI
      YW10aFMzbENUbXBhUTJ4QlFrZ0tVVTF1ZUVKdFlYQTVWVkpyTXpaWVkxUkJhbkJXTjI0ME5ESmxl
      azh2Vmt4UFdWbFNXRlJHWlVkUllrRkJVQzlTZURCM2QxWlpibFYyVDFWWE1IcHhSUW96TUZrclQy
      VTJOVzVhYlU1VGFYWm9VSEI2ZFFvOVpVeEdOUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Disable SSH Root Login
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter PermitRootLogin is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "PermitRootLogin"| regex_escape }}\s+
            line: PermitRootLogin no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Do Not Allow SSH Environment Options
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Do Not Allow SSH Environment Options
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-90803-8
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255085
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEdRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      RllUVkZCU21WdE5rVkdMelk0Tm5OT1JrRmtVQ3R3T1VGeVIzWUtaVEJMYTA5bWJUZEJTa1F5ZDBs
      cWFHOTZSVWh3TmxBeVlqQm9iakpET1ZKSVdXeFFVSGRIUkdaNVRWcFRURWcyVUdaVE1FYzRTak5u
      YURKa1dFY3pid294VjB4WGREZERhaTk2VmpRdldWQlNORll2TkVkNU9HRjFNWGhFUjNSTGVtdDZX
      WGQ2VWxsMmVVWlVNRlJwVkhZM1ExQlZNWEIxUzIxdlJFWnhkbXc0Q2tOYU0xaExXRWd3ZFc1cWJY
      WkNWall3V1V4UmRpOXNaVWhPSzNCaUszWmlUR1JpUVdSNmVrMVBhek55ZG5CSlVGcFlTMDV0Tmxa
      UGExQkxVVFJIUlNzS1pXaFJUWGxtYW1JeVZEbFFRamszTVhJeFJYQXliVGgyUjBOSU5XeDFjVE5T
      YWt0UGRXaFhNbVptVlhkMmRXWkxlVlZpV25rM2RsQXljbkoxWkdKSU1nbzRUa3RJWkUwMVNEWm5V
      bGxzTW5ab1JHUmlOalZ4Y0RSWWRqZHBjemhZTjI1aVYzQmlMMmt6TUN0M01YVm5ha3RRU3pCUGJH
      OVlXRlpsYWxwVFZXMWxDbU13TlU5QlVXeGlUMnBVYWswcmNVdElSbFpXVTNOV1oyOU9SV2xSYlZZ
      MWRVOXRMM2R4UjFWRlZVTkxiMDVuWTBRdlYzWjVZM2xVVkhkVWRYaHZXRWdLWkZoa1IxTkpNekZs
      VWk5NlpYZDFjMWx4Y1U4d0wyVnhTelpwTVVKUWFsRlplbkpIWmtkQ1luUnpMMUpzVG5CNFlWcFlS
      bTlWYkZsVVZ6WjFSVlJIVHdvdk4zTlhkRkE1VDBFMVRsbHFNVTlpZGpCT2FXTlFUVTlQWW1nNWJV
      ZFNRbmh0VHpGUFRWUlpTVzg1TXpCM1JteGFhVTVVUmtGcGJXaEJTME4wZGtwMkNtMDBRa0p6Y1Zr
      NVpqVTFlRkJ6VVZGcUswUmlLMVppVEU1YVIyWmFlVkZZVFV4Vk56VjVSMDFvVjNwWmRXUXdNMEZD
      YUdWUmJqRXhTaTlxUmpSV04yb0tkV0YwV1hBMldYcFdiVWwwTVhKb2FXSmtlbVo1Y1VoMkt6Vllj
      Vk5sTjJOellWUnJkekZCT1c1MmRuZzJZM1ZKUTI1clVteHdibUo0Y0VGc1YwTXdiZ3BrVXk5aE5s
      bzBURTB5V2pjMVpqVkRUWEl6UmdvOVFWQjNWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Do Not Allow SSH Environment Options
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter PermitUserEnvironment is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/01-complianceascode-reinforce-os-defaults.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "PermitUserEnvironment"| regex_escape }}\s+
            line: PermitUserEnvironment no
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Enable SSH Warning Banner
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner_net,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Enable SSH Warning Banner
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-87979-1
    - CJIS-5.5.6
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner_net
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      cFVPRkF2YVRVeGVHVkZNRVZ2UjJKVFFXMXhSMDVNU3pScU1EVUtkMEYzTHpCd1ZIZHNiM2xITWpo
      UmJrWnRMMVZDT0ZSalFubGxTakZhU214UWVHeFZVWG8yWnl0MVJrRndka2xvUlRWWWRrVldTVkpX
      TXpaNVJIUk1ZUXBHZUU5VGRESkNVbVpuTWxCRVpYWjJZMko2V0RockswNVJTM1oxU3pnek9VVmFl
      RU5tUWxkS1JWRXpjM3BHYlZBMFFXbEhjWFpNY0UxU1psVkNhemwzQ2xWUldtdENabVpVU3poVmRV
      MTVlVzFvZHpGYVRHOU9aamh5WWxGbFpYaFpkWEZvVTBVelFVOTRkVzlxUzAxMlpIZFdkVU5NV2xG
      clJISnFPVTR3TkZnS1FXSkdXVUZzTVcxSlJWSjFjWE4wTVVScFdFUTJabmhJVEhCS2JURjJPVlJt
      TlhGU1VFeDNZVVJuVW1wS1dHZG1VbXREZDNaM2MwWldUVzFVVUVFMWR3cGxPRkZUYTBaWVdtY3ZX
      VXhvUm1Nd2FsaFhTV015YUc5bVdHeEpaRlJuVFhod2NGTnVNSGRWTDBSbVYyOVlVa2gxYVd0UFQx
      VmljVkptUlROVGRXcEdDa1pRVkVVMk4yVlZNRzVVU2s5aWRIbHRkMUF5VkhZelZIWlFiSGRGU1Zj
      eU56bDBVbVp1YzNZM2JrWlpWalJUV0ZOT2RFWkdSeTkyVmtKMlFpOXBjRzRLWVU5WFVDdEdOVm8w
      YWtkR2JHSk1iMjV0WnpGV1FVcDBVa3BCY0d0TFJHeHFha2h1VkRVMFJHeDNaU3RUTW1SWFNXZGlk
      VlZOT0hGR1NFOXdOMmxyU2dveEswcHBURTVNVlROMVpVMVJUek4wY2s5elZHeDFlVTlaUjJkU016
      TTVkMUJ4UWpKNGRqQjNhV3R6YzNWelYxcElOMHhQV2paTmVGcElabnAzV0haQkNuSlhiVW92WjI0
      dlIwRnVaRWQ1S3pKQ01GRkhOVmMzVUVOV1ZpOVBhRVZ0VlZSaFFsaG9kazVHU1U4dlFVbDJRVzR2
      Tm5ReE16ZzJObHBJT0hJNE1Xb0tka0kwTkhWeVJrdFFVR2wzYUhOTmRrbGtibk52YVM4ek0wWTRU
      azkzVG5WMFoxUnVWa3htVGpOblNEWjRVakkwWWtZdlN6WXdXVEZhU2pFNU5scHNTZ3BNZW5aTVJ6
      ZHZhVzQ0YVdvM1RUQndNME5zTlFvOVRFMVFVZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable SSH Warning Banner
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter Banner is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "Banner"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "Banner"| regex_escape }}\s+
            line: Banner /etc/issue.net
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Idle Timeout Interval
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Client Alive Interval
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sshd_idle_timeout_value: '300'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      TnBVVkF2UVc1TVQwZzFSa2gwWTFoRVNsWlNaVU12YkhCM1lXb0tkM04xZVZOdk5FbzBUbFpNWm1K
      aGFVcElRM2hMTmtobk9HZ3ljemhQTVRWc1UxaHZNR3hOU0ZaVU9DOXZNMUF6ZVRSalpFMDNXRGR0
      Y0c5NGVrWlhNZ3BtWVVweFZVOU1NMDl3Tmt4TlpWaEJPSFpZYURBeWEwSnZSalJETlVORmREWnNZ
      azFUYVd0aFlVaHViRXRCTnk4dmJtdEVaMkYzUTNSQmEyRnlNbmx2Q2pReGEzbzNUSFZFZEVKdVFt
      NXVaM0ZHVVU1RGN6aFJVRFF2ZFZkWVYxWlZZV05PTTNaUlZGQmtOMnRPYWtNeGREUmFiVzU1Vm1a
      R2RXOWxiMDh3T0RnS2NXcG1Wa3cxVlVNd1JYVkxVeTlLTWl0QmNuQm9SVkJhUzIxeFRtaEZNazFu
      TVZwVmNpdEhhSEJVUjBkWk1rcHVOV1JCTDFORGFFbzFXbUV5YVhWcGN3cENXa2xyYVN0S1oydElX
      bkpwTDFOVlRIbzFVbEV6VW1sTE9XOWFRWFp0YTA5WVRpdHlXVW8xU2xaRVJrVkdXRFIwYVcxcFEz
      TndNV0Z2T0VobGEzSmxDbTFrT1dkMlNERlJTMnRXYjFKTVEzSk1OWFZqU1dKU1FqSk5helowWlRW
      WU5WUndZa0pxVkRkWGFWVndSVkFyVkZrd2JVaG9SM1ZJV2tsQ2ExWjROVVVLZDNVMlRsSnFjblF4
      YzJjMGNtNUlTM0pzT0U1VVJUaDZVSHBxWkRoT2JtNDNUakZvYzFkYVkxVTJZMVl6YVRsRmJtRnNU
      VWhHVmtWMk5WcEZSVXd6ZWdvek5GZHBZMjVIYjAxVFdVUktSRVZsYnpKeGR6bHVZVUppYW01dldF
      WnZSaXRuYmk4dmVtWlJUM2REVFU0dlQwNWpVSGxJV1ZRNFdYZzFXVTFQUjFwaUNsaGFTbXhST0hC
      YUsyUjVPRk0xSzBwM2RtbG9jRzFVUmpSbVNYaEVNMkZwWWxGd1kyTXlSSFY2V0N0c2FUVmpNVWhM
      ZEhabU55ODBWV0ZwUVVKYVlXTUtTakZHUjJSVGFsSjRSMUJrTTAwMU5HMW5jREJpVVdneGRHbFRZ
      MUZpZGtGWVpFZzFSRmxDTWtaQ1VTdDZMM1psVVRSRWVrUlZaelJIU2tndlV6ZFdjZ3BqWjFBMFJI
      aDBNSEZrUTNWNmRFOWpWMXBxVXdvOWVtZFZWQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90811-1
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255100
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Client Alive Interval
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter ClientAliveInterval is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "ClientAliveInterval"| regex_escape }}\s+
            line: ClientAliveInterval {{ sshd_idle_timeout_value }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Client Alive Count Max to zero
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_keepalive,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Client Alive Count Max
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_keepalive: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      NTRiMUF2TVVGUmRERktibVJrZDBoTlEyRkdPRzF6YkRVNE9XWUtla05PU2xCRlkwUmFOVkZvU0ds
      YVJqUXlMM3AxT1VseE4yZDNlVkZJT1dkRFpXVkxlU3RpZFRGelVUWTJSVWhVZFRWcGRUZ3lVa2xy
      WWpaWFVFTkNXQXBvWTJVclRtbFNaRlZOU3l0UldEUTFUVFZzZG5vclkyZGxhVmhvV21sb2FqZElW
      VlExUXpaa1JXVlNWQzk2VTJNemNUWnFNbWRUVTA1VGRIaDJXVVJsQ25kU01IbzNUMjFwWjNGbWRE
      Wk9aMVJsUm1OQmFuVnNNUzlyWlUxaGVtSktWbEp6U1Zsc1NDOTNaamh3VTBKT1YwMVlSMjl3VWpC
      MVQxZDROVGQ1VFZFS1pFdFZXVVJKU1d4QlZrYzNOSHA0VGxSWU0yRnBSME5LZFZwWFNtSXZjMFZZ
      V1RZNWNTdDZOMjVtT1daeGNYcE5aRXRFVnpSVGR5OTJUekUwVkVRMlR3cDZhMUJOVlc5WVFrMUhZ
      MFJJU0ZrMmNETTNSMUJuWkRSSVRWSXdVMnhyUlZweVkwZDFVMmxCWjI0emVrVkNUbGcyU1VSSFUx
      aFhOR0psYWxKRWQxTktDbGxQVkU1S2RFUXhVVGgzU2xGTGMyVjRjV3h2VEhZeFMzRlNkaXN2V205
      M1pETTRSVVJEVDIxV1pqTkZlU3QyU1dkRVN6ZGtPV29yYTJ3MmFrYzVjamtLYjI1TE9WUkVNRE5u
      ZG01WVdVOW9ka3hOVUdwd1NrRmFOeTgwUnpOd05EZDJVbFpMVUhJMFVYZHFaamxtYzFoRmFXaEZk
      RVoyUWtkQk9HaDROR3BGY1FwMGFYVkZlazFMY1RJeVVEYzFhelYzVG1rM1pHVkdaVFU0YTFSRFNG
      WkNaWFpDZDNoQldqQjFaRGh2UlZWaVV6QkdSMGRGWTI1R1Z6bE9NbnBZVEVKbkNraDRaeXRYVXl0
      dEwwNXJUR0pPY3pkQ1RtNUtPWFJPU2poSEszQnRibkphZFM4cmRrUTJOR2xwVUdsQlZrRnBVSHB6
      WnpWdFIyUjFhWEZEVFNzeVJrNEtiVVIxTkdreE4xVlpSM2xNZFVwT1IxZE5lVTlOY0ZKUFltODFU
      Mnd6Y1ZWdlZXSm1PSE5IVkdwdEwyZGhlVGhGTkhaeUsycEROM1pUV1RWQmNrcFlkZ292VDNrME5T
      dG1NMUF5Y2pGS2RraFVjMEpYVlFvOWFIWlVXZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90805-3
    - CJIS-5.5.6
    - DISA-STIG-RHEL-09-255095
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Client Alive Count Max
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter ClientAliveCountMax is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "ClientAliveCountMax"| regex_escape }}\s+
            line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure SSH LoginGraceTime is configured
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure SSH LoginGraceTime is configured
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_login_grace_time: '60'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      RkJWVkF2YVZjckwwSlpUR0kxY2poV09XNUtWWEprTmtWWmFFY0tRMFV3V2pCSllXUTBRemhZVjFS
      alkyazVSSEYyTXpSNFNGWm1kWFF5UmxaeU1TdEVNMnA0TVVOc2J6Uk9iMDB3ZVRsbVl6RXpORGd5
      TmxwbGFIZ3dad3BxZFM5UEwyUXlhWE5IU2xCdVpqUklhVEY0Ym5KWk1XUldOWEZqZEdseE1tdFJa
      VUZhY1dWU1pVbEdUekJhYTFGdmIzbHVVeTlwT0M5alFXdFlOWE00Q2xwVVdVdERlbEV3UkhwUU1X
      Vk9XVXN6T0dZd1dUTkljRXhQUjJSMlNHdGFkMGwwYjFobU5rUkdOMk0wTDFoUU9XSmpjVFpVUVRW
      cWFURldRa3hpVmpNS2NWYzBhVWsyYTI1aE4xZDNZMHhaZW5wT05FWk9PRVkzVGtWa05WcHZUa2wy
      TlROeFZXdERTaTh4U1hKU1duZFhTa2h3UkZOaGVuTXlSa05MZFRCTGNBcFBSalpqYWxrcmNrOW5a
      RmxpWkd0VlpXOXRZWEIxY2xKRWQwWkZSbmRrYVU5WlYyZHNOMmR5Wm1WUmNuY3pabE5zY0hWclpV
      aHhPSGszYW1wTFNtUlNDa1ZtY0VGNVRucENhVloyZURoUmJWRnZWR3Q2WkdabWVHeDJOalJUVFRC
      MWRtUkRXSEZ0YVRSMU1raEtiWHAzTVRsU1dVaHpLekp0V0ZscVNUaENhVzRLUlVnNVQweEpVRTlC
      TnpGMFNsYzRSa3hvZFRWcFVVZERVbVpOV1haMFRFeDJVbGsxT0ZVMlVrTjVVMlZ5VlRKeFNtRnlP
      VVp1WWxScWVraE1XV2xWZUFwNkx6bFNlWFZDWVVKVmJIUnhkSGRsT0RSb1V6RlFaVFJYSzJodloz
      VnRSbVY0VjNKMmEwcDJlbTVJWlUxSU9DOW1OSFJHYnpOdGRpOUxiMkZXWjFkVUNrcEJhWE56THpo
      TE1XbEliMFV3WW5GMGVqbEVkblZNYkZCTlZrSnRiVTkyWWxsblNuWkJjMmd2Y2xKTU9WaFVlREUx
      ZERRcmRXTlBWMEkwTkRWTVN6VUtRbVpET1U4dk5DdDVSR2h6Y2lzdlNrMXpZbEpQT1RFNFpsaFBT
      RXAxV2tkMlZISmFSM1F6Y1VWRWVYUkhXWEpHWTJaMVppdEphRmh2Y0ZOdGIxaHVaZ3BEYjFnNGFH
      UjBaeTlXT1ZOd1ZqVjFjWGx4YndvOWRscEViZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86552-7
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_login_grace_time
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure SSH LoginGraceTime is configured
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter LoginGraceTime is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "LoginGraceTime"| regex_escape }}\s+
            line: LoginGraceTime {{ var_sshd_set_login_grace_time }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH Daemon LogLevel to VERBOSE
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH Daemon LogLevel to VERBOSE
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-86923-0
    - DISA-STIG-RHEL-09-255030
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_loglevel_verbose
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      Sm9aMUF2VWxGdlRrZEpZbEZLWVdNMGNTdDNWR0pKZFhsMVRTOEtPRzE1YVU1SGRtSXlUME51YW1W
      cGMwSjRSMFppVm1KNE5qRktWSE56VHpCYWVuVlBORTFKTlhkMVJXVTVTWE40WkVRdldFbEJZWFJZ
      YlRSV2Fra3pXUXBIUWl0dlpqVjFZVTQ1YUhGMmEyNDFOVFpNTW1neE1WWlJZV0o2SzFSeVMwVlFN
      VTluZVdwSFVsbGFNamxCU205blYwUkZNMXBOWVM5WE5XYzRSVkJtQ2pNemIwWjBja1YzVlVwRmFq
      bEhhVm8wVkU0eldrZEdjVXBYUW1zMmRERnljVXhYTm5GT2NuRlBUamgzZDBremJVVm5XbEJRT1VF
      elYxTnFWaTk2VFVvS2NqTTNTbnBDVDFKNWRVeFRXREpoU2tkd2VUYzBOM1JEWW5KbFpYVjFWMlEx
      U1ZoV2JUTnVjVzk0VTBRMVdYUnpaRlpqWnl0RlVGZ3ZkVEZoTm5Rd013b3ZOamhSWTBwd0szSnha
      RTFyTlhOclZETlBlR1I0YkZadmRtZHFjak5sWmxRdllXcFlZMlZ4WWsxd2VqYzVkQ3RaWVdORFpY
      aFJOVkk0VURkV2RGWnRDbmxtTjA5S2QwWnpaamx6SzFsaU1EWklPRUZDWkhkdldHY3hlVVowWW1S
      SlNtcEJhV2hhTVRkamEwNHhjakpPV0hvMmNGTnRVa3N4V0d4T2JsVjBOSE1LTUhSR2VVZFBSVWxI
      Y0ZneU5GaFRVVGRDUjFGTU1tbDVSREpWVmtKaVFtSkRORFZXV0d4cVdGQnJablZPZVU4NE1HeHda
      RlpKYjJWVVYyeGhhbXhYY0FwSlZrUkdOMDF3WkZSVWIzSTBSR1IzVlhkaE5qQm1ZMGRNZW05dVVX
      RkxVMXBKV2pSUFpXSkhUamxaZEN0SFVXOXdkMHhJS3pKSkwzTmxhM1kzVHk5RUNrVTVTRVJTYUVW
      R00zZEdieTlFVEhSd09VeHhkRzQ0TUdNMVdIbHVkVkZHVEhGdU1UTnZUa05wYkVGdVozaE1hbk5o
      Y0V0TmFVUTNlSGR1Vkc5WFpUVUtXVnBUVFhWcGVXOTZLMEUyYTNGa05tOU9iM1JRUnl0SUwwVlNW
      elZ3WlZGMFRtcHhaV3AyZFRsQ2IxWTRZbTU1VVcxRVpFSjRSM2xDY1U1VVJFWkdSQXBPYjBVMk5s
      bEpUSFl5SzNGa1FqUnRjVWd3VmdvOVZUTmpSUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH Daemon LogLevel to VERBOSE
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter LogLevel is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "LogLevel"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "LogLevel"| regex_escape }}\s+
            line: LogLevel VERBOSE
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH authentication attempt limit
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH authentication attempt limit
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sshd_max_auth_tries_value: '4'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      TkJUVkZCU2pOTFdDdGpkRVpYT1ZocmNGSlRaSFJrU1VWb1dVY0tkMkZuVlZKWVNWbDFRWEJhVlhW
      R1dsSkhZMnBHUVdwQldYSXlURFl2YTJaa1NUSkVSM2RZZW5rNVRESm5VVmxPUjBSRU9UaExOVWhy
      Y2pWd1ZtMWpLd3B6UWpOTlFrRlVLMUpvUVdsRUswNTVhelV3VXpadFVtcGxWbWxtTWxRNVNtTm9W
      bGg1YTA1elNEZFZaRTFWYzBaWFNtbEtjMHhxTDBwRU0xRmtiVVJrQ2l0b1MwUlFZVXhVVUZwNk9Y
      Smhka3RYZUdWT1NESnBNVWRsTTNCclZXWnpZVUoyUnpKMWFUSnRPSFo0VG1jM1JVUnZNekpPY21k
      NlEzZG9WR2t4Y200S2VWaHRNRXhrZDJVMFZtNDFSVFJEV1hCck5WZHBORWhpWkZORmJrVkxjVGRW
      UzJSak5GbHNMelJIYmpaelJFRldNVFJRYWpoM2JFaFRNVk5TY1dKWVpBcDBaVU0wTjAxamIwSlRk
      MUpPZVRVMFpVTXdRMVUwWWtOT05XcElaSGhLVlRSeWFVeEpSV0l6UkRjd1prY3pjalJKYlVaNVdr
      SXdjM0J1U21sSWJIZElDbXQxYURKQlJuYzFlUzlDVFVkSFNHaEdjRmx6YlRKVFFYUjFjbVpFV1ds
      VVZUQk1XRW92UlVST016QllSMGhSVVd0cUwzb3pSRVp3VEVGdk5XTkthemdLYW10Tkswd3JRMDVa
      UzB3ck1VcE5iRU16T0RKTmFFeHNkWFZIWml0WU4yVmFWM2w0YkZWeWNWUlFRbkZ3WkZCb00yWjJO
      ak5OYUVablRFWlFTMHByTHdwYVZYTkxiRkpQVW1sSGEwSjBlV0ZJUTA5cVJVbENNa2gwUVVKT2FH
      Vldla0o0VUV0RU5qZFBabkF4WTBSTlZuVTBUVkoyTlZseFJVMVNZa2hvYWxaV0NpOWtlRWN5U1M5
      TldWZ3JRa3AzVm5CVlREWjJWMXBLY0RSbWJrUnFVVVZvUjJnNGQwMUZaMlk0ZVhwdVNXZHRNM2hs
      WjJwMmFGWmtXSG92YlU5MVl5c0tlVE42U2sxVldHbDFia05XUzJkWFpsWXJkWEZRYzNFeVoyTnRi
      SGh5VXpjeVlVcEJWMUk1Um1kTVVFNDFabEJ0TTB4blZrSlJlbmwyVm5CemMySmFUd3BTV0c5VmFV
      aFZSWGxuVkdSMmJVdG1OekkzWVFvOU1FOXZlQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90810-3
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_auth_tries
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH authentication attempt limit
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter MaxAuthTries is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "MaxAuthTries"| regex_escape }}\s+
            line: MaxAuthTries {{ sshd_max_auth_tries_value }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Set SSH MaxSessions limit
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_max_sessions,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Set SSH MaxSessions limit
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_max_sessions: '10'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      QkdiMUF2TTBJMU5UWXZURmh2TDBadWJEQm9lREZ3YVM5eGJWQUtSV2gzVUc1dVRsSTRWMlFyV1Zs
      TVJVWnRjMncyWWswcmNESjFWVEJTWW1WTWFUbHphWHBvTkN0b2RreGpUWFJyYVZodlNEVlNUekJY
      TTBNd04yRTROQXBTU1Zoc2RqUlNXRE5NWlZKcFprRXdhVE5VTmxweVJ6WmtaWEJvYWpkUk1tcEhh
      bkkzUVVKaFJ6SnhVMVJYZWt4b2JHTjNTMFZCY1ZvMlkwTkRjWFU0Q2toVE5VMXZOMFJ1UWtGQ1pF
      cHJPSFZoVG01b2NVbDVUbVEyTVROcWNXWlVORmx5WkZsNE1rbHRaMFJLUnpoRGRISlNRamQ0UTFk
      SFUxVXpOVFF5UmxBS1oyZE1Wa1prVEZSUk0zUkVNMWxPU0VNd2RsUmtRbkE1YWpkWVdYRkxiMHhI
      VFRSbWVHWjFTVTVaVEd0MlVqZFNhRmRHWW1GQllXODJlWEJwYlVVd2NRcDJkV2x1VTFsd2FGcHRj
      MVZqWXpWdE1sSk9TMEZFTDFCWk1tbzFLMUZWTXpaNFJIbGFibEZuYUVGd1lXcENWVnBoV1RCRE5U
      VkdZMHQ2WWs4MmFHVkJDbE5qTUUxd1ZIWmtlbFZTTUZVeVUwdEViV3BUYTJGTFdXZ3dOamhPWjFk
      V2F6aGhkbkVyVTBKUWREZzRTRk00ZG10YVNIbFhPRUpGUTFaTlExUkdkRW9LTW1rdk1XbzBWeTh2
      Y3pWRVdrTm9SeXREVkN0aGRucG1hWGxSWVZKUlpuUnhRMjVrV1d0alJHeEJiRzR4VUhrelQyeEZP
      RE5ZTWtoWGMzSktOREZaYkFveVVuY3ZhblozYVZoTGNXNU1jV1JSWmxsaVoweFFWbFJOVFdoSUwy
      ZElXVGcwTjNOV1ZYZEZSV0ZTWTIxbVUwaHZVVVp0Wm01dlluTjRiM2xYUzFOakNtZ3pXbXRzVUVa
      dlUxUnRPV1p0VG01ck0wdHNWbWd4WmxBd0wwSlZkR3BsYlc5dU9VSm9aRU5XUjJwVmNGWjJibEJM
      VUhJeFQwVlpRbXhWYjNKeGJHUUtNelo2Wm01YU1WcHpabk5NYTFGd1lXTXljRW92ZEU1RlVpOUNW
      MDEwVlZsek9WWllNRWR6U2tJclFYcE9OMUUxYWl0WFlXczVXa1JQVVVjd05rTk5aQW92VVRCcFRH
      ZFdUMlZFTUdGR1JUbFFaREF3WlFvOVdUVnhTUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84103-1
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_max_sessions
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Set SSH MaxSessions limit
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter MaxSessions is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "MaxSessions"| regex_escape }}\s+
            line: MaxSessions {{ var_sshd_max_sessions }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure SSH MaxStartups is configured
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_set_maxstartups,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure SSH MaxStartups is configured
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sshd_set_maxstartups: 10:30:60
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEhRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      ZG5UVkZCU2xVMGJrYzJWRlZQU0dGUk5YbEdMekkxUlc5TmVsa0tOSGRyYjJOREsxcGljakpPWVRW
      VmRWWldSMUZrUkhGTFMwWXZWbk5xVFRGeFpVY3pkbFZZU1RCSWVFMXNVaXQzYkRjeVJ6ZHZPVmcw
      VEZsVWNsZG9VQXBIU1RSVVRHb3pSV3RVWW1nMk1scHhkVlpQTWt0NU9YRlRkVEl5VHpkeFJGcDVl
      VWxFYjBWeU1qWktSVmxEY2toSWVGYzFlVFpJVVVReEwwbEpMM0pXQ2xGSFZYWlNUSGREV0hOc01F
      RlFaRkF6VEdSc1QxQTBaMUkwTldaRWJubHNUazlKTDJ4NU9XbEVjVGgyWkNzMFpsTktVMmRhYkZW
      MGJVSklSazltV1RjS09HbFNVMDF5TlVoMlNUbGhhR1JtY25OelJpdFliRkpZWVZjclQwNXZObTlw
      UlcxV1YyNHJNRzlvVm5GblN5OXRNbmRuUXpnMlExUnFPVXd3UkZkRmRncHBSRTVaZFRSVGRtaENl
      V0ZTZVVWWU1qZHJlVTVvVGpGeVVXODRNamw0UkVkWGQxZHZjRWxtUm1FMlpUbEZiazQxTkhCYVZt
      RkhTWE5zYXpWMU5GcDJDalZHYmxaTVdYQTRVbE12VkZReGMyZEdXV1JLV2toaWNVRk5jVEZEWTJ0
      RFNsZ3JSM1JpYjJzeVVubGpSMUkxVjB0WlR6SlNVRUkzWkZoWlZtZGhabUlLVHpWWFFXWmtabVo1
      T0ZGcFpuWXpUU3R0UjNOU1NESklURVUzTjNkcU5GVlVUbU5KU205UlMxRnJSalZaU3pRd1JVdG5l
      V2xVZGxGalRucE1jMWt3YXdvMmRDdFhLMjE0VnpONldUWkhMemh6U1U5S09IQnRiWEF4YW5scFpF
      cE1RMDAyTVVNclNISklSMVZDYW1GMFJGSTVlRkZZTWxKeFdYZHBUMGRPY2pJeUNtZzRaRUpOUkRS
      TmRVaHhNa2MxVEV0SWVEZHhkbkZOU21KemVtSkhiblJMUkZGWFlsTk9jbmhQVkhOclV6QlVZa0kz
      UTBoYVVIbG9VVU56YW1oNVdGZ0tielE1VDNWc1lqSjJlSEZEY0ZFNFRHOUpSblZ0UW1WRmRITjVR
      MmREVUVsd1EwTTNSVTR3WW5KalRtOVRNMDEwTUd4bVRUSkpObWR6UlU5d1ZFcEJXZ3BSVDJsb1dW
      Z3lOazVWZGtOTWIxVkdSbFZVVWdvOWNXOW5VUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-87872-8
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_maxstartups
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure SSH MaxStartups is configured
      block:

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
            state: absent

        - name: Check if /etc/ssh/sshd_config.d exists
          stat:
            path: /etc/ssh/sshd_config.d
          register: _etc_ssh_sshd_config_d_exists

        - name: Check if the parameter MaxStartups is present in /etc/ssh/sshd_config.d
          find:
            paths: /etc/ssh/sshd_config.d
            recurse: 'yes'
            follow: 'no'
            contains: (?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
          register: _etc_ssh_sshd_config_d_has_parameter
          when: _etc_ssh_sshd_config_d_exists.stat.isdir is defined and _etc_ssh_sshd_config_d_exists.stat.isdir

        - name: Remove parameter from files in /etc/ssh/sshd_config.d
          lineinfile:
            path: '{{ item.path }}'
            create: false
            regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
            state: absent
          with_items: '{{ _etc_ssh_sshd_config_d_has_parameter.files }}'
          when: _etc_ssh_sshd_config_d_has_parameter.matched

        - name: Insert correct line to /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
          lineinfile:
            path: /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf
            create: true
            regexp: (?i)(?i)^\s*{{ "MaxStartups"| regex_escape }}\s+
            line: MaxStartups {{ var_sshd_set_maxstartups }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Use Only Strong Key Exchange algorithms
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_use_strong_kex,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Use Only Strong Key Exchange algorithms
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sshd_strong_kex: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE5RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      SlJTVkF2TW5aNlUzZFFaWGh2U1VGWmIwMWlkWEF4T1RsdE5rNEtVRVJoYWxWRlZVMUlOVzVtTkVZ
      Mk1FRjFaR1ZQZFVSdmIxWTRjVWszYTFWSFlqYzVkRXR3WVZkVVRXcDBiWFZyUm10a1ltbG9OblZW
      U1dsNmJWbFRjQXA2ZDNSaFduVklkRWxSZGtJMmJXcFRjeTlSTjNsWU9YUTRkbkZ3UWtkUmQxb3la
      MFJsV1hST1JsVktOVVpRZUVsSlVIRTNiV2N4T0ZGUk5XdG5OSEZaQ25sTVFWWm5WalZtZG1SMVdD
      OHdRVGdyU1hSSFNYUkVaWFJGU2l0aFJVMHpZMnhJZFZGS1RGUnlhU3RaTVM5clMwMDRVMmhuTmt0
      bmEySjNhbnB5WVcwS1FuRmtSVkF4WTBwWk5VMTFNbTFPVVVWNlNqaHdaRU42SzJwNmFIcGtRMUJE
      V0V3MU9FUXdhRTlSTTFOSU5URlVPWHBzTVdKSWEyWjJWREpYZFhoV1NncHJSbkV4VXpOT01FOTZW
      VTU0YWxwVFZubDFObUpCTVN0TVRrOUVlbk5RTDJOS09TdENZVU5ZWlVkdWRYbHFLeTlzUzA1VFpG
      RlJOSFpEV0RaVVRsRmlDa3RCZEN0ck5XbFFkRGh3V201d1JtNWhkbWd2YmpOelpEUktOM0JzVFVK
      eFJYUm5kVVZCZUhGeGRGWjRaWHB0ZFdscmVYbHJkbFJuY214UGFtdDVlbTRLSzNkclRUTjBNa3Rz
      S3k5bVlsTmpjazh5ZUhZeUwxbFJaRFkzYURsblIxUlhhV1UzU1hSSlZuRk5jMjF0ZVRJMlNHcE1l
      R2xwYVhFeFZpOW9OSGRuYXdwcE5ETTBhWE5rYnpCcFNVaExiaTlUT0ZKclpEa3lRa2xqY0RoUmNV
      RlVNek5YWldWMGVGVnZaU3RXTmsxUGNrcDBibTA1VG1kS2VuTnJlVlZPYjFSTkNrbFpLMHROYURS
      eVNFazNjMGRTTXpKeVYxazBWakpLWVZFdk5rUkxkRFpUZGpSMFJrdHVVaTl5VkdsbFNtVmlMMU5r
      VlVsNVVGWlhjWE5FYkdwV2RsUUtabU5XUWpaT1pVVjNTVFZpYlRRMlRXRjNVblpyTXpsVWRrdDFa
      SEl2Um05Mk4xUTFjRXczUm1seGMzVXdSMk52ZFN0cWJ6TkhRUzlEZFdWelJHaGpRZ281ZG5OQ1lU
      Z3dLMnB6ZVZVMWMyaDZNMVZLY2dvOVpIbExiUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86768-9
    - PCI-DSS-Req-2.3
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_strong_kex
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Use Only Strong Key Exchange algorithms
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*KexAlgorithms\s+
            line: KexAlgorithms {{ sshd_strong_kex }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Use Only Strong MACs
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sshd_use_strong_macs,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Use Only Strong MACs
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sshd_strong_macs: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE5RVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      bHpUVkF2YWpsVGJsRnZiMUpJUlZaM1J6TkhiR1ZQZHpSU2VYUUtORkkxV1RGelpHTnZZbnBVUkVo
      aVpESXlXV2hpTkROTlowMHpUVWcyWjJGWlkzcDNSRE5QYURoMGJFVmhPRGxGUTNWblZua3hZekpO
      TW5JM1RrVlJWUXBhVm1zNE0xbGtVV2xUY0RGM2JuZzVTMEYzTkZCcVdtZE5XbWxEWTJ0c2NrODFW
      MHhUVFUxbWN6QTNNRU54UkZOemNtdDVZbWd4Y2pKWFpVaHJkV2hHQ25kalRuTk5Uelp2Um1nd2FH
      dExhbXhxYTBrclZtVmxZMjkwY0hwWGNESlhjVmxqYkRSMk0zTkZZMUZ2ZUROeVNXSTVaVXBpT0Ro
      dGJUUkxOVXBNZFdrS1dEVnhTMk4yTWtwdGRIQTBUMVJGVkRSb2FIcHRPVEJyV0c5VlZEQjVlbTF3
      VGpoUVJtZEdlR3RvVVZGYWRsTXphV2RVTkdWNE5tVTNjalptWm1WMEt3cG1la2syTldSalVVeEdV
      MHg0YkdkemQyZElVblZZVTFaVmNVRnlVMVJCVDBSMldHVkhTWE56ZUVVMGRUUjJhR1ZqS3pCWVJq
      SlplRWgxVUcxalNUbDNDbmwzYWxKdFNERjRVVmg1VDFoWU5sRlVibkZKWkdaSmVVeEtUbkJRUnpC
      SWJXc3ZjRUZwTjJFNFFYbGlNVGRsYW1WTU5YQnpNMkZzUm01NmVEaDFVVWtLTUhWak5GSnpTemR6
      Vkd4MmQyaE5SMVI2Wm05cldURk9SaXMzVjJOMk9XSkVkbUoxTkVwdU5qVjNha1JJVFc1WE5UZ3dh
      VFYyZFV4SVRXUjFRalIyU2dvMU5YTlNLeXN5VUhSU1NXcEZkMVpPVG1KeUszcDJaRUlyVkhONE1r
      SllLemQzY1hRcmFFSTJZM2RsVUZSNVEzaHhiRUU0VjFsSlluUTFSbVJKVEVKU0NrSmxTMHRVSzBO
      WVRXTjRUVnB6UWtSWGMyNVVRMFZOSzJkd1JrVkhOSElyTkVOaFdHMUdiMVZEVWxaaVEyTk9TRzVW
      V1RCc1dGYzRaamRsTjBkYVluSUtjR1JhTDNOaVVsZDRSVlJKTHpWU1FsTkJkSFZ0Y0VSb1JrWkNO
      a0pYV21WbGJuVTFjbGcxVG5GbWVYTklja1J1TUc1NGVWUjRSMk5TTDJOUmRrRnlUZ28yYWtjd1VV
      dDVSVlpsZUc4eVJpODFPVk5GZGdvOVlWbzRXZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86769-7
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_strong_macs
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Use Only Strong MACs
      block:

        - name: Check for duplicate values
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            state: absent
          check_mode: true
          changed_when: false
          register: dupes

        - name: Deduplicate values from /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            state: absent
          when: dupes.found is defined and dupes.found > 1

        - name: Insert correct line to /etc/ssh/sshd_config
          lineinfile:
            path: /etc/ssh/sshd_config
            create: true
            regexp: (?i)(?i)^\s*MACs\s+
            line: MACs {{ sshd_strong_macs }}
            state: present
            insertbefore: BOF
            validate: /usr/sbin/sshd -t -f %s
      when: '"kernel" in ansible_facts.packages'


# Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_add_use_pty,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83538-9
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_add_use_pty
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      bGtNRkF2TVUxak5HNUhlRW96YUZaMmR6Ulpja2d5TUcxSU9Ua0tTMEpKY1ZWb09XdFdTMVpNTm5C
      bVFURTBXSG8yUXpKU09XbEJURlU1UXpodlZVRlFOVFZxTW1kaFZtTTVNM1UyZGpVdmNFcHFkVnBJ
      YUdWRVVURjNhQW9yVGtGRGVHUnJTM0JSV1hOSlRrSklTWGR0UzFkUVJVcHhVSGswUkhkVWFYZGlS
      bEpCU0RaRlEyTlJOa2hsU1RKUFpEWnRlV2x3T0hKMmVucHFiMlJFQ21SS2VHWlBTMGxWTXpaU2JG
      bGtjbFU1U2lzdmNsRTVSMmRRVlRaWk5HVkNUMmsxVFhoemFUTmpUWEZaVnpONFRHUjFOM05ZTTNF
      emRFODJkbnB5ZUhNS2JVMTBiR2xZVkc5blpqSlBkMWRVTkdSSVVVZDRkVUpZTXpGNlNDOUxaaXRP
      V1V4VGNIbGlOSFpaTTBOQ1RrVjZkVVkySzJwM1VXWnNTVVJsYzBNMFZBcHBTMjlQY0RVNE9VSk5V
      M2h2Wm1GQ1FVUk5WMGRNV0daMk4xaFlTVmxyWVhoUGIweHRNWGQwWTFGeWFFbHFObFZQTkV4eWMz
      SXJXRzE0SzFkTFZrTndDbWxqTDNsNk1YbDJSWGREUVN0WE5XeFJOMlZJU25JMVowdHhSMGxHWTJG
      MU5Ib3dUbWxRTjNSblltcG9SSGx3ZFdKdlNuUm1TVkI0Y0hSallqZHhiRmtLUWxGbGJ6VkhObTRy
      T1haaE1qVmFlbUpqYW1WSU16ZDVXalZEUVRsbk1uSmtUSE5MVHk5bFlUSlFSVkEwWXpsbGRHWnFM
      M0pPV0hSMGMwVXZSRlk0WXdvM2EybG5jV3MyUlhoQlNtWmpOVkl2VkVaa2JIWmpZbUl4TmpCMU5G
      STNRamRVVWtWMVIwdzBMMWRWUkZCRmRUZDBjRlZRV1hGUk16a3JkRGg0UzFaaUNtbE9aRVF5ZDFC
      WlJrRnhjVWx6VDJWQ2RYTjZlR3BVTUhnMVZuUTFOVkZsVFU5S1pYWXZWa1ZvYjA1d2RqQlJURWxY
      ZVdFd1ZGcFVPWGxHTkVGU2QwOEtWbWR5VTJKREwyTXZaMVpYT1hNek1rcDRXbEY0VXpSV1pEQjNW
      M0ZJYWpOdFVXVkhLMGxSWm1ScFRVaFFZekF3TkZGb05qQmthSFJXZEVwWFNHOUtaQXBJWW5OUFNV
      aFBXRUZWZFVobmIwRmtkSGRyYlFvOWVHTlZhd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure use_pty is enabled in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults.*\buse_pty\b.*$
        line: Defaults use_pty
        validate: /usr/sbin/visudo -cf %s
      when: '"sudo" in ansible_facts.packages'


# Ensure Sudo Logfile Exists - sudo logfile
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_custom_logfile,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Ensure Sudo Logfile Exists - sudo logfile
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sudo_logfile: /var/log/sudo.log
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      bGxZMUF2VWpWcU9HdENNVTlRUW1aUVZrRXJkR3R0U25KRGVITUtiak5qVG1seGNYSkxTRmhNVERk
      SlFWVlVkSEJZYnlzM1NsQndiVXhvWm5wcldsWlBiVXN2ZEVwc2VHWk9RekJsYmpoaFVqQlpWWGho
      Y1ZWVFdFVmplQXBqY3pGMmEwYzFlREJxTWt4dU5FOVZVVnBpZURoMlJFUm9SbXhDVFZoSlZrUm9V
      SFZZVkVKSk9XVkphbE50U2xwYVlsaFdSVFpUT0VOQ2VGTnlOMU4yQ2s5M05DdHhTWGh4VEdoblZX
      MWljR3hTZW01UVZWQjRkVlpXTlRoT1dXcDZTMlZvVG1sYU1VZzFSbmg2U0ZWSE5tWnlZamh2UXps
      MmFrdHRkakJETlZvS1dVMHlOMWRVUXpsdVRXZHdWWEYxYWtScWJrMUZaamhpVjBsSk9XOW1TVTVD
      YTFSS1JtOWlWMmxOU0dGWUwzcHFLekJWYm05bVdFMDFPVU5vV201bFdncFhLemh4Tms1VlJsWjRL
      MkprZEUweGEwWXpOM3BDTUU1U1NGVm9ka05hWm5jMk5ITTRhVGMzYlU1NVpXMXNjVGxHYlZoMWNt
      SnhSMnd5Y2xCMFpFaEdDa0ZhVW5SdGRGSkZZbHBhTm5KcWQwVkxXVlo1YWtKRU0zRkhTRVJzVDFO
      QmJuSndNbXhGYmtzNU9XOW9lbGsxTmpSbU5WbDVWelF4V1VOT1pXRm5SV01LVTB4VlVYcG5NazlY
      TmtOV1p6YzFVMk53VDFoekwzY3dNR1ZRZEdKUlQwaFVXbU51V0V0bFJUSnNUbGhtTUU5U1JHZElW
      VzlYVDBKdlp6QnNXVTlpVXdvMFZqVnZSa3RNTlRCbU1UVndORWhQU1ZoV1FtUjVVM1pwZDNGR1dr
      eFROR1JrTlZnNEszbzNMM0l6ZURVNVRubDVhRmczTldwQlVqRlFNM1JtVkZZMENqVk5TSEJzV25G
      WGJraE1ZVVE0YkZoU2NXNDFibXRJYURaUlVHSXdTSEJ3ZVhKSU5qUlVaR1JyYnpOUmVEbFFkbTVN
      UlhnNE4zVjFiRllyZFVOYU5rb0thSFptU3pKbk16QjNjblE0V1VKYVJFdzVkR3RoYUhwc1ExbHdM
      M2Q2VjA5S1JVWkhaMHBrV2twdFlURm9UVE5JU0ZKSVYyVXhTR2N3WnpKSVRITmFTZ3BsYTBoeWRH
      SmtSamx0U204dksya3hRbGw1VndvOVppdFplZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-83527-2
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_custom_logfile
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Ensure logfile is enabled with the appropriate value in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s(.*)\blogfile=[-]?.+\b(.*)$
        line: Defaults \1logfile={{ var_sudo_logfile }}\2
        validate: /usr/sbin/visudo -cf %s
        backrefs: true
      register: edit_sudoers_logfile_option
      when: '"sudo" in ansible_facts.packages'

    - name: Enable logfile option with appropriate value in /etc/sudoers
      lineinfile:
        path: /etc/sudoers
        line: Defaults logfile={{ var_sudo_logfile }}
        validate: /usr/sbin/visudo -cf %s
      when:
        - '"sudo" in ansible_facts.packages'
        - edit_sudoers_logfile_option is defined and not edit_sudoers_logfile_option.changed


# Require Re-Authentication When Using the sudo Command
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sudo_require_reauthentication,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Require Re-Authentication When Using the sudo Command
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_sudo_timestamp_timeout: '5'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      RlBZMUZCU1hCbUwyRnBOVUptVkc1SFVqYzJTalZLVGsxV00zTUtaWFJXVTFOdU5raHhibU0zYkhR
      elZHeExhR3huZVdsVFdWcEpibWt3YmpCMlNESk1ZMFpCY1ZOaVVUQm5lRzVCVlhRdmVVdHFNSEJG
      THpNMFpVTldhQXBrWkdKeVJYWTFRMDVCU0ZwblVsa3ZObmxGTjBjMFRUUlpabFJuSzNRcmMzZFRi
      RGcxTkZBeFZtTkxVa0ZGYVhNMVluRlJVVzVzZVc1RVdsQk5kR3RCQ214clduQnplVVl5ZUhGa1Vs
      aEdjalZXV2l0T01DdDVXWEYzVURWUWEwTmthMnBPWVRSWVJEUk1lVlYwVFROdU0zcFRkVFExZDJW
      c2RIb3pSemxEYkhvS0wycDBUU3QxWmtwc1IxVnhTbmMzY3pGd2NGZGhXVlZTU1VWWWRFbHhVRzVI
      YUV3ME1GVlFPVUZZV2paalREUklSVll2WkZWd1pqWkxNV1EwSzA5MWJRcDBkSEYwVUVwdVVqRk5l
      bk5rVTI0NVdrMHdUMHcyZFhSU1ltVnpValJVUkZwWlpUVXlVWHB2UjBJM2F5dDRjSEpVZFhsU1dr
      OU5VbWdyYmtoM01IZDJDa2t2WlROdk1DOXZPREp5TWpaYVRHUlZPV1ZVUVdseFFqWjNXRkJPVXpG
      UllrNUxiRVUyTkhCeVJUQmpjWFl5YTNBMVpXaDNkMGwxZFM5SEwxZFpRbFVLT0RKak9XMVFRM1p2
      YVZSVFdWcE9XV2RDZUhaaWVuWnFWMDV4Y1dGNlZYVndiVkJWWmpSUlQwOXdZMFZ0V0ZkNWFIUlpi
      RGR0VGtaelRrbHVjVVZOU2dwM0swWXpUbm8wU1U5WVpqZEdNVEZ0ZDNsbFVWSklibXd3VjBKNFVs
      VTVURVpEVFRnelMzUnpUMnRHY1ZsRVVrSjVNbmhwWlZCeVoyWnVXVGw1WTBkVUNqZEdRVmhSTTBv
      MlYyYzNWR0pKYzBWblRETm9XV2RQV2sxbGFtMDJTV2xyUmpkck5VdDRaRk0zYVRWU01XTXhOMnBJ
      WXl0bFZWcDBMMDFtYWpoamFTOEthMnN4UlhabE5rbFVaVkJTY2tGNk1WbGpXRVE1VWtWcmJHRkVX
      RmhDU1hsQ1YxTjZNbFkyYTJVMGNERXZPSFpOTkRSVFZpOW5ZVkYyTkhoMldYRXhPUXBOWWtOblkw
      SjBURGxOZFZac09FbEtTek4yVGdvOVJWSkNTd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-90029-0
    - DISA-STIG-RHEL-09-432015
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Require Re-Authentication When Using the sudo Command - Find /etc/sudoers.d/* files containing 'Defaults timestamp_timeout'
      ansible.builtin.find:
        path: /etc/sudoers.d
        patterns: '*'
        contains: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
      register: sudoers_d_defaults_timestamp_timeout
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Remove 'Defaults timestamp_timeout' from /etc/sudoers.d/* files
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
        state: absent
      with_items: '{{ sudoers_d_defaults_timestamp_timeout.files }}'
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Ensure timestamp_timeout has the appropriate value in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s(.*)\btimestamp_timeout[\s]*=[\s]*[-]?\w+\b(.*)$
        line: Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2
        validate: /usr/sbin/visudo -cf %s
        backrefs: true
      register: edit_sudoers_timestamp_timeout_option
      when: '"sudo" in ansible_facts.packages'

    - name: Require Re-Authentication When Using the sudo Command - Enable timestamp_timeout option with correct value in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        line: Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}
        validate: /usr/sbin/visudo -cf %s
      when:
        - '"sudo" in ansible_facts.packages'
        - |
          edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed

    - name: Require Re-Authentication When Using the sudo Command - Remove timestamp_timeout wrong values in /etc/sudoers
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!{{ var_sudo_timestamp_timeout }}\b)[-]?\w+\b.*$
        state: absent
        validate: /usr/sbin/visudo -cf %s
      when: '"sudo" in ansible_facts.packages'


# Enable Randomized Layout of Virtual Address Space
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Randomized Layout of Virtual Address Space
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83971-2
    - DISA-STIG-RHEL-09-213070
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      MUlORkZCU25kd2EzVnBSMDlNYlRoR1RtTlZiWHBvT1djeVpHOEtSMjlPVkhadFZVYzFjSGRyZW1J
      eWFtNXBRbFJXYkVOMk4zWlFTMnRUYVhCcmFVMTNiRkV2WjFVM1IzRlVkQ3RuV1ZOdFVubHRTSEJt
      YTFCemRFSmpVUXBvZEZWNmMwbE9aMmRRU1dGd05rNW1kbEJDZDFCbE5tWk9UVVUxWVVkcE5HMTNW
      MEZOZDNaUGNsZHpPVFV2TUVabmNqWXdaa1p5YTNZeVlVTlJibEEwQ2tSWWJ6bEZiVGhWWm5kc01U
      Y3hVbWRvV2pCWVFqRllaVTFyZEdkRUt6WkxkRGxvYldsVVFUQlFWMDVuTVZGNE1ETm1VSGxFZVdK
      U1RsaHlOVkpMVFRRS2VtWktjbVpHTlZsbFNHeEVTV1pLT0VKVlZtZDFhMWxxYkdWUlUxZEVLMFpI
      YVdkTWFsaERRbFJxVFcxNU1rMWtkbWRFSzJOQlptdHZhelFyT1RnclV3cE9WbU5tYUdGUVJITnBV
      MU5aWldkeFZXaHRSWFZqTkRsUk9GVmFkM1JXYVU1U2FYTjJiSFZtZHpSNFNsUXJXRU5yYVdaWVRt
      VlZNMWRvWm1OcmJrbzJDbWhaTDNoMVVrVmxTbFptTVZsM01rVk1ka1pLUkZGT2JHOVNVMmhDTVhK
      Vk0yVkxWRmxaYjA4MmNpOUtObVY0UXlzMmMwMDBiMlJMTTFOR1YzRjRUbklLWWpkb1FucDNTWFJZ
      ZVhsc2EyRlZaazFvU1ZsR2Mwb3pTMHR0VDFWelQwTm1ibTFNUTBacmNqbExXSFkyYTNsUWRHcDRj
      MUpCTUVSNVZGWXJka3BuVGdwMWVEZGFTM0paVkdrck4zTjRTbTlaV0doTWQwUlBRMlpRWWxseFRX
      TmpWV3RqWkhObmVITjFVMUZKUVcxa2IwazVZek5oVlZrNGIzbFNSMGRDYjFwUkNrZEpPRWtyTkdw
      WFluWnFWMjgzYkRoeUsxbFRjRVptVEROMU1HODJhMGhYUlVaV1VYWktVR0pVU0hkMGIzaENWVXRW
      T1d4NFFXODNSbU5OVUdRdmVEY0tlbk5LTVcwNWRYbE9kME5XUml0cVdWaFFja1Z5Y2pKb01ISnFZ
      alJ1YlZkNFJrWnRTbXRqUVdsMFUzQnZjRWgwYWsxUmMwWjRkR2c1TkV0cmQzWkRlQXBWWkhSVU5V
      aDFWMGhwU1ZGbFYzRnZWV012ZHdvOWNGcHhOUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*kernel.randomize_va_space.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of kernel.randomize_va_space from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*kernel.randomize_va_space
        replace: '#kernel.randomize_va_space'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl kernel.randomize_va_space is set to 2
      sysctl:
        name: kernel.randomize_va_space
        value: '2'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Restrict usage of ptrace to descendant processes
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Restrict usage of ptrace to descendant processes
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83965-4
    - DISA-STIG-RHEL-09-213080
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeE5RVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      OW5VVkZCU1ZOcVRsUnNhRmRPUlV0SWVWSmlURmMzYjBKWk0wUUtaMWdyT1ZncmIzSnZSbWRJZUhC
      aWJWZEtWemRzUkc5aFIwdFBPSFJoYm5CRlJqbFRia05UUjJORWRqUm9PV1JMTWtRd1VYTkdZeTl5
      V0cxU1JVNU9NQW8yWmpRMVVqVjNNakJ1Wm1WVk5UZFVZbHBwUjJoaWFuWjNPRk55TW1ONWN6RktN
      bU5wZFN0MFNISkdOM2RQZEV4eU0yeGhWRWw2YVdoS1NVMVBaamQ1Q2tSRFRYVm9RbVJyZGtsU1Ns
      ZFpaVWgwVjFkak5tMWpUMDFsUzBaUFkyNU5lVTB5Tm5oVFRIRlRRVzlXZWxKdFRFRnlTM00yWkhO
      cVYzWlNhWEJvZFRZS2VIbFFXRTVuZEhvdlptdEJVRVZrYVZKVlduSnZkWFIyUmpRNVIwOXNOV2xD
      VG1ZNE1XZEpZbGczTW1kRmREWTRNR3BIU0VFNGMzcDRWMlk0ZFhSbk5ncHVXbXN2TTFFclJqUTNO
      a2RIZVVKWFJscGFaVXBrYURRdk9FcG9WVVZPVjBOaEt5OTNWVVJSTlRCdWFVbDFZVTFTTWk5Q01V
      cHFNMEZMV2tGNldVcGtDa05oVFdSc2MzUm5jV3BNVEdGSmNHaG5UbU40YVRKRFkzVmlaSGhyVVdw
      VFl6VllWMUZRV0had1RXTnZOa28xTDNKeVUwSlhPSHBSTURVeVowWmhVMmtLT1RKdVNIQk9iVGc0
      VjFoV1dWUnhZM2RsZUVGekwxWlJXVUoxWjB0Q05FcFJlVVZVUTNKa1NtbHFWa2xFV0UxS1Iza3lN
      WG92YmpaSVdFZDVXbk4wUmdwaU5taHpiMG95WTJJMVozVXZPRWRQWlRSNEsyaDRhblZvTmxjeEwy
      RjRWVkYxU0RKT05TOVdaRGRtVVRFME1WWk1jREZEUTFoclVsZHNLMWhpY1hObENuWk1Ta3QzTmxR
      M1ltZG9UbHBSZVdFdlNtc3ZWbTkzVHpaMVZVNXpkWFJpVEdJcldrRTBSVGN6ZGxaUkwxTnRWa2c0
      VW1KNlowMDFZVVJhVmpkRE1qWUtkM2QwZWtaTE5tUXdUMWRMYlUwMFpqTTVhbVp1VlZnNEwxSllT
      UzlXYjBkemEyOVdVbXhaTTI1eFdVZzRObkJXVVhoRGNYbE1Sa1JISzBNMlkxSnVUd3BqYW5GQlYz
      Qk1kM1k0TWxSQlZHWk1XVEY2YWdvOWVEYzBjQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*kernel.yama.ptrace_scope.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of kernel.yama.ptrace_scope from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*kernel.yama.ptrace_scope
        replace: '#kernel.yama.ptrace_scope'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl kernel.yama.ptrace_scope is set to 1
      sysctl:
        name: kernel.yama.ptrace_scope
        value: '1'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Disable Kernel Parameter for Accepting ICMP Redirects for All Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting ICMP Redirects for All IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      SnJPRkF2TTNWQ01WTnhkMjVLWWpkTlVGWnVNRFZFWlVKRUwySUtSV2t2U0hsTWFYVXJPR05xZVhS
      WWJqbGlWMUYzTUZNeU1WTXphR3hVUWxsemJscFJSakprYnpZdlYwOUtja2RXV2xOeGNVdHJiQ3RZ
      YVZjNGNIY3pSZ3BDVkZJNGIySklVRmt4WVdWMWIwNHdXSEJ1WVZCeWRWbEZiVnBOVjFCelEydzFZ
      WFI2VGtOV1ZsTTFNMjF5V1c0eFdEWm5VMlJVZG5JeWJGaEZZM2x5Q25vd01WZElkRVl6U1Zvd1pY
      bFRlazlYUTI5VVprSXdhSEVyTVhaV2VsZDBNRUY1TDBRNVVHcGtRVGhqWmxSeE0xVldXV1JOU1dW
      YVdFTTBRbXBRUVZJS2Iwa3pkWFpPVFhGNE5VdFlUMmhuY0ZSbWQwTk1XQ3Q1ZWxSM1RGRjRWV1JN
      VlRZeVJGTkNRMjlCV1VaWWQxQkdVMHh4VlVzemRXOUpXa3RtVXpaemJ3cDNaM0ZqUWtSdVUxUk1N
      bGR6WldSellYWmhXbkZIYW05VlJHcGtRMkVyYXpoWVZETjBlR0ZsY1ZsVk1sTndVV1ZUV1ZCV00y
      SXdUSFpFZVV4cE5sbHFDbFprZUhBMllqbHdUWGhqYkZSV1dqUndLME5VZG05RE0xVjNLMDltTnpk
      M05tTjVLMVpsZGtwYVFqVnlSV3h4V1hGak5IQTNaM2RLYW1wWlJtWnlVSGNLZFd4bmVHTlNlV3Ba
      TDI5TFNHbHZORE5sYVRGWlYxQlNlVk5EZURZM1JVdEZPRnBZTHpWaWRtWkxOR1F6YmpKdGQzZFpN
      R0Y0VFRoS09WaHhiMlZwT0FwUWNXb3ZUbVZ0VGsxaVRtaFhkM2x1VlZoWmJHUnNSVnBCYTFGdmNI
      ZGpPSEZ4YjNGUFZUQnRPSEZCT1ZsYU9XRlRORE5aZGs5U1NGQmFlVUoyZUhWbkNsRlNUbmRHT0hW
      VVZHZ3JRekl3ZFVoUlRIZEtZMHcxU0hFck1rVlVNMlExZFRCMWRIWnFVbGhtYTNVMGVHRnpSRGxw
      TldoVWNuTmFkMWhZTDBWMldXMEtNWGR2WW1kVVUyMTZiRTFKVlZWM2FGTTVRemxJZG5Gd2FWZDNU
      MGxrYjJZeWVXSlhlalpsUjBwSU5raEZRMHd6VTFwMU9YcHVVemxvTVVrMWIyNXBPQXA2TURWQlJH
      azFjVzQzZWpsaVYzTjBSR0Y2TWdvOWJqSjVTQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84011-6
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253015
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
        replace: '#net.ipv4.conf.all.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.accept_redirects is set
      sysctl:
        name: net.ipv4.conf.all.accept_redirects
        value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      UjZkMUF2YW1sVlRFSktTRTV5YjFwdFEyVTViRmt6Y21SbVNqa0tRalpxTTFCSVdqVkhiMllyWlZa
      U01WZzBORmR2UXpSbmVHbFViVWswUlZWVVVrbDVPVkZCTjFFMk1HZHlNRGw2WmxkdFVXbHRTa1ZP
      WXpWQ2VFdDZTZ3BVVUd4S1Rua3lWakpSYjBSTlVtcDNTakkxY0dKbE1FRTNhakJQVTB0TmRFZG1X
      SEZWZEc4MWJTdERLeTh6SzFFMmVGQk1RMlpFWkM5c2VtbFJSVk5OQ21Ka2RHMTZjMlZUVjAxbE1I
      bFZZV3RPVEVscE9GUkNLMXBQTVdzeFFtOVJaV2hGV1d4R1ZsWktRWHB4VTB0a0swdHlhMDkwWjFk
      WWVXZDRXV3hPTDNVS1IyWlpUWEJpVTBaak0yUnNOV3N2YVRCemJEVldWR3N4YmxoRFRWbzFPRk0w
      WVdGemEzRlNibEZzVG1VMGFUUmlhSGROVVVvNGNYUllWMFpYVWpaYVN3cE1VRVpaYVdGdVEzaFRO
      bGxYZFdSRVZuRnJSREZvWnpaR1NGcDBUbXAxWkZwU1pXMVFRemRNV2pSVU5FbG5MekJqZFd0WlIy
      bDJNalJxUzBOR1ZXUTJDbmhoUW5WVWFsbHRha2sxTlhOMFpUaFhaelJKZGpsRk56VkNZbGRSY0dW
      blpWa3JXazV6T1hoVGRIUmthamRSZW04elpqTm1kbTFzU1hwT2QxZE5aV3NLY0M5elowNXpWWFZE
      WnpCWGVXYzVaV0o2VlVsSFlpdDRhVkJ1ZGpoUlFYUk9LMGcxYW5aUGRsaGhRVlZXZGswMGNHczFT
      bkJRWlV3d2FYWlNOMVFyWlFwc1lpdFRUR3hMSzNwcmFUSnZURmRNUWpkU1EweFZhbUZOUTNJMVdr
      bHNObGt6ZUcxdlFXNHZiakpaV0cxUFNUWXZaa3B5VmxOaVlXVndORmMxTUhsSUNrMU1ORzEwY0Vo
      aVVFOTJVR3RxWTBWWU5rYzJVbHBrUWtOVlZHVlhibXhhTVRacVpWQlFRMGhaU0d0S01EUlljMHRH
      TlhOV1N6TkRkWHBEY0RaSmJtOEtLMXBHZFRKaVFsWnRTa3B1V1VKWk5HMDBSemxYWVhvclpXbE1N
      MGMyUkVvMVpqazJjV3RCTDNJM2FXTktTMmh2V0dwc2JqRnZiRXBIVG04M2IzRXlhd3BIWkM5TlZt
      dEVZV0Z0VDNnMVlVSnVaMDkxU2dvOVVuRjFhQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84001-7
    - DISA-STIG-RHEL-09-253020
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
        replace: '#net.ipv4.conf.all.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.accept_source_route is set
      sysctl:
        name: net.ipv4.conf.all.accept_source_route
        value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_log_martians_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      VkJUVkZCU1hrNWRERjFkRVpUYm01NldVbzBVRzVtVG5GamIyVUtjMkZyTkZZMU1EWlFPRkpaZUhS
      WlVFWmFRbEJKWkdSMFNrSkdhbXBLYVd0VU0wSk1NRGhIVWxWQmRrZzVNbU14YVVkVlFtVlRSVmg1
      UjJodk5VZ3JXQW8zWVZNM2FWZEhhMDlCUm5WTVlWWTFObFU0ZGpoRGFEaFBNV1Z1VDI1WmNWZzRV
      WGxXYUZSUFVVNUlkbkJ6VVRCRVVUbG5WMnhDY1ZWSGVWRk1jV2hPQ2t4eFZsRkJSR0ZDYUdaaE5F
      UTBUVWhLVkcxemRHOWFRVEJhUjNWNlFXTTFRekoxWkZWTFUwVXZXWFJpWmsxT1ZscERiRk5ZVlVn
      NFZqZ3pjSE15U2xRS1JWSkpkMDl0YkdoaE4zbDZRbFprT1daNFkxaDNaamR2ZERSb2RIcERlRkpZ
      VG5WSlkxWmFOeTg1ZFhnMFRtVnJUR1Y1TW5SMVFXczRjbkpMTUdGMlpncFRjbWMwUWtScFZtUkhP
      RE5YUWt4QlRTOVVXbUpvY1hsbGNIQndWMk5DWVZWNUwwaHhhbE4wUVdwQ00weGpVMWwyUTNGaVZU
      WkhSRUZXZFhaWU5HaGlDa2xXTTBwMk56SXZPSGx4U2l0NWVDOXFNWEJRY2paUGVGZ3ZRM2gxU0dW
      Q1lWVm1halZVV1RkbU5sYzVXalp0VlhSNVZXTTJlRVZXVnpoaFJXbEhNMDRLWjJRclEzRnRZa2hH
      YzJoYVFYRm9VSGdyV2xaU1pGbEVkbXhTWTI4NGFISk5XbkJITWtkNlpGcDFPSGh2VUVoU09WWlNO
      VlZWZFdzcmFITlVRMUZ3U1FwMGVUSnpZMlo0VFVWREwzY3dSaTlaV1VsNlNYWmpSRUk1V25Wb2NV
      d3liWEUyYkhwalUwOVRTVmxvUWxOVFlYa3lSRlo0SzNWVVMwRkZjREF2VVZGR0NuUnhUa1J0VkZK
      TVVISkNTbUV4TVZKbGNEaGxZa0ZEWW0wMlZUZ3llV2xET1dFeWNDOXFlRlptTkZWV2FISk9MM2Rv
      V2paUlZESlpNamhFVG5kYU4zRUtWekZyWlVkQk0yNWFXVTFXYjNOalZtVkZibkpUZG1GUlZXTm1U
      Rk54U0RGbVJUSlJiakphYUdVemQyZFlTelJLYm5KVlNqUmFkbTV6T0RsbmJYUnFaUXBvVlRkUllu
      QjBXRFY0TDAxcmNVVXlRVXhNZVFvOVRUSkNZUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84000-9
    - DISA-STIG-RHEL-09-253025
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_all_log_martians
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.log_martians.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.log_martians from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.log_martians
        replace: '#net.ipv4.conf.all.log_martians'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.log_martians is set
      sysctl:
        name: net.ipv4.conf.all.log_martians
        value: '{{ sysctl_net_ipv4_conf_all_log_martians_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_rp_filter_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      ZGFSVkZCU1ZRM1FtVm9TbXd2WjNvM1dHcDBXbmQyU0U4MlJsUUtUekZsTnpVMlVIZDBNRE5KVDJa
      M1ZUaHVTVXBNZERkTmFGUnJZMDVOVVdoSFZISlNhR2h2WlVNd01XeENiVGhMWlhWTlNDdFhlbXN3
      UW5kek9GZFFSQW93ZVRSNlNtRm5aRUZsVTFwMk1ubGxZelJHZFVRNGNIVmxVWE5GYW5kU1RXdFhk
      akZUZFZCa2IzaHRLMEZLZGpCek4wcE9lbHB1ZW5wSVpUSmlTemhWQ25OeVpGZGtXRTk1VUZCdE1t
      MXBaR1J2VldsNWNHaE5kbXRKYm5sV01XUkpNRlIyUlhobWF6Wm1lVGxJWnl0elkyaHJlRWRFWlhK
      cGNuUnFSVmhoY0ZVS09XUklUMjVQTlVoc1UzbFVjVlJZWXl0QlVYQk5PQzltWm5SV2NtVkZOU3N2
      U2xoNWRYSXhXbkkzZVd0MmFGQndhekEwT1dWaVRWQTJkV0ZJZDJkVVJRcHpUVGszT0dnMGRXUlFO
      RGhhU0dVMWFrNVZRVzFGYmpCWU5tdzVkbEpOYkhaRVVHOXlWVXRaVEhwUlYwRmFTSFl2TkdKTFRH
      NVdXR3hwZEcwcmJIcFNDamhEVldoVk9FaE1lRGhpYlhScVIySnVSbWR3ZG1SVk1IUkNSbXhoTWsx
      aWFVZHRWMjB2U1hOR1IwdGlaSFl5WTJaVmJUaGxTMkp1WkdSbE5VWjBXbGtLWnpGdmFtSmhRVm95
      Wmpkd2VERTBWV3BWV0dRM1NHVXhVVzFIZDJnemRGcHdaekJuVVcxbldHaDRSVWgwUVhsNVN6UjJi
      M1JNVTBkcGVsTlVRakJaVUFwTWNXRkpTbWgxTUZkek0yTXZjelpGTmpNMk0wbG5ia0p0WjFFclFu
      QjFjemhTVFU5NE1tWTVWbEpWUVVWSWNreE5hbEJ2UzFKR1QxWTBlbVUyTDFKWENrVlRhMnBOTkc5
      RVJqSjJVMUpUUlROQlNuQnBhbGxrY1dodlkxaEpSRk5NYjFWTmNITndhblJoV2pSYVl6ZGFaMVoz
      ZHpNM1FUTllkVE5yZFhCVWQwTUtZamhHU3pCNVEySkhhMnhTYURjdlpsaEZVVlJQYVZrd1RrWnNN
      bXQyTkZSTVRFMXBTRFpWYkRaWU4zQTFhamhIVmtkdGNUQnpObXhPWlZCdldWZFJOd3BSV1RVdlUx
      RXJlalZEU0ZOU1VFOW9TR2RPTWdvOVQxYzJZZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84008-2
    - DISA-STIG-RHEL-09-253035
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.rp_filter.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.rp_filter from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.rp_filter
        replace: '#net.ipv4.conf.all.rp_filter'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.rp_filter is set
      sysctl:
        name: net.ipv4.conf.all.rp_filter
        value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Secure Redirects for All Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_all_secure_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeElRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      MUtkMUZCU25ZMk1sWm5VV0pTV0ZKbE9VOWpNV2RGYkRKeVozVUtOREV5TVZsa1JHTndSREJsUnpF
      NVRHeElXRmt3UzFSQlRFUjZXV1pSYW14Q1ozWnBVMnRFV21WSE1GcGFhV2hqTkZKb05pdENaRXRv
      UW5sbmJIVjFNQXBHZUhKblpVVlRWMmN2YTBzeVV6WllVMjkxZEM4dlIyVjViRXBHWjFNM2JHMXBW
      MGhJZDNGcFZVZENNRTFRVG1waFptOW5XVUp4VkdKRGQwbG1UVXA0Q21saldXdFZXbmxUSzJGaU0w
      dDZSVUU0WlVGSWRVVnVhVEpMVnpWMk5FTm9Tek15V21Gc1kwNXRUSEVyVG5FMFZrNU9kRU42V2t4
      a09ETk9XRVowUlVrS1pFVk5hVmdyUkd4R01rUkRlVTV0ZVdoWVZpOWlia2RrSzBRMlVpOUJkREUy
      YnpaQ1NtczJWVTVwTDI1c1pqSXdOM05aV21SS1RtbzJielZDZEdveVNRcDZURmd5Vm1aNVVGVjJi
      bWc0VVZrd1puQlBjRE5MTjNOeE5EaHBialZpZW5OUE1sUXhkR280VUdWRVRtWkJjMlJXVGxSeE5V
      ZG9lRkpIZERnMFlrOWpDazVhWlZKaVdsSkNNMGxhV25OVVVUTmxia3hWYW01VlR5OU5aVkpOT0VS
      Tk1UZDBka2h1U21aUk5FdElaMUJwVEVScGVXdEpOMHR6ZURCbVVFNVlTWG9LTVVkclozaFJkMkpK
      TVRkQ1QyNUZXVkJFVkRSTVRXcHVjbU5KV2xsSVkycEJZMmRzTHpnMmJucFhXRGxuYUdWWVJrbHNN
      RVJvT1RWQlJEaFhWSFJGUWdwb00zRXZTa3BoZFdJd2RuVmpTVzFLVldSQlRqRnBaRFJTU3pFd09F
      MVlPWGRuYlVnclZsaEJObVJrSzNadWFEQmFkVXdyWld4NFpITlhZMWRMTDFSTENrbFZVR0kxY0Ra
      WVdreE1PVmxUZFRWaFJEUnVRamRZUml0eVdWTldUa1YwYzNsUmF5OVpLMlZHYTNGTVpuTjBNbkpp
      SzNscVdFUkpkbFZpUXk5UGJtSUtRVlpzY1V0NFZqaFpLMk52UzJnemRrcEtRa1ZSTDJ0eFNscDNi
      Rmc1YzJKeVpVSXdNVGRXTkdSMFVGRXlaVXB1WW1SbGFYVnpSRTRyVnpWdmVGUnpaQXBVWVZOeU5U
      RTNTMFJsZGxKd1Mya3hXU3RrTlFvOWFEUjVXQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84016-5
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_secure_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.secure_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.secure_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.secure_redirects
        replace: '#net.ipv4.conf.all.secure_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.secure_redirects is set
      sysctl:
        name: net.ipv4.conf.all.secure_redirects
        value: '{{ sysctl_net_ipv4_conf_all_secure_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83997-7
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253065
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      bDJjMUF2TW0xQmFVRkZlRU42Vm1KQ0wyUk5VbFZ2TnpOSlJTc0tlVU5NUkdjd1pWZElTblZHWVVw
      NVpVeFRlVkozYm5FMk15dDRNbmx0V1doS1ZWZGFVMWhqUjI0dlFVZ3ZUamhHVFVGMlQxZFlOVkJx
      Y0hScE5XSlNNUXA2UTI1d1dUUnFUeXRqTmpOelNWWk5Rbk5oVldoUFNrOXZWbUZOVmtObmNEWjVW
      VGRaS3pRd01tTmllazUwTW1oemRtcHdNVVJzTjJWeldGTm9jaThyQ2xWS1NYUklRalJ1UjBocFlu
      aHNLM0J6YTNKdUx5dFhiVzFFWW5OTWVrOVBhRTE0UTJ3eFJVWk1Wblp0ZFd0WlNVRmhSREJ1YTB4
      RWVHMUJkSGhzTjIwS1dtSkVjemRsU0ZCUE9XOVlWMEl6Tlc5UlV6RmFUazEzY1VGb1kyVXlNRVZ5
      TVdoeFJHdFFhRUkxY0RseE5qZDBNWFZuYVd4UVFYRXZZMFJsVkdnNGFRcHdhMlF2YTJoc2RWZzVj
      SHBuYTI5NFZYVmFOVFZEUVhCUlpFSmxiRU00TUVacU1IUTFNbEZ0WmxodmVtTkNWWGh3YkdaSFdE
      QTVibXhqVFZrMWJVMW5DakpHTDFoRWRFZFRjR2REZDNsNVJscEZPWFZqTjFKR01IbExkVWhaYUZs
      RmNYSTFaMWQxVFdJMU4wZHVVbmQ2YW1GNVRVTnlVRFl2UTJaTFMzbDNhSFFLY25GcGFrOVphMDVx
      V1ZSeE9Vb3ZVRXRtYXpWWFRsQTNOekZNV1U0NFRuSkdLMjFqUTJ0RmRUSTBVSGd6V0RacFNWRnZj
      REVyZGtwdWJYaG1UbFl4WVFwSWVXOUZkVzAwTkhaelJTdDJlRkJ4VW5vM1UwcERaRGRMVHpaWVlr
      RmxiV05vTTJoRlJsaFhOV2NyUm5WVGVFMTFNRTB2Wmt4T1ZXSnFjM1JKZFRVNUNtMU1jbVl6ZUd3
      eGIwZDVRMnhDYzFCbVNtdDNaMjU0V0dwTWFHaDRNVlZYYWxWemIzVXlVR3BYVkd4ek1XZHpNazUz
      ZFZoWGJsSkpMMDlxZUZCSFdFTUtRMFJ5UTFFMFoxazJVRVpPYmt3cmVFTlBNMlZ6TTNSVmMyMTFk
      VzU1S3pCcGVqYzVSRFoyZDI4M1JHbG5iRFIwTlZCQ1RVOHZiU3REYkdwSWJGaHdXQXBFVGpCS1VF
      OURWbnBLU1ZWT2FGWm9kVkl6VGdvOVFTdE1XUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.all.send_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.all.send_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.all.send_redirects
        replace: '#net.ipv4.conf.all.send_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
      sysctl:
        name: net.ipv4.conf.all.send_redirects
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      TnBSVkZCUzBwSlNGWXliV0Y0U2paeFNXSmxiRFZRVFVaQk4xVUtPV0pSWW5JMGRGUmhVVGhyZDFo
      ak1WZEVOMnhtTkhwS1dUbHBjM2xEV2pCelJHbDRMMjVxYVVwNFl6TnhPRGhpZEZjMU4wRkRaRVpD
      VTJ4RU9XVkpaQXB3ZVVvNGR6ZDJNM1ZyUVd0UFZsQnZkRGh1TjJzeVpqQlFhbEJTVWxWNlRYbEdP
      SEpMVkRCeVlXRkhXRnBUV1dwRVVXWlFXWGc1Ym1SaWVFVmxhM280Q2t3eVpFeEhaamMyYjBGelIw
      TXpZbmd6VkdWV1Z5dFJVVlJKYUhaR1NtbHpjbVozUlhWQk9YUmtPV1ZFYzA5T1NHSTNiVkpzTjJW
      WllVcDZWMGhNY0ZBS2VXaHlXVlV2U2xOSmMwOHpWbmhqZDBwbWVFbFRUWEZyZEVkTlpteE5SbVZv
      SzJSQ1p6aFpObE0zT1ZOTWVrNXdhMVU1YjNCWGNGSjFWMnAzYjNCbVdBbzBjVzFITUU5YVJIRlhU
      SGgwVVdaWGNrNHdlRTVxV1VWb2RtaHNlbUpQVWpJeVdGQlRaRVkzU1VONVVXOHlXRVJOWlU1VE9X
      OUVkMDVLUjJKTlJURjZDbUZQZERFNVIzSjRaRk5vZFVsWGVFc3pMelJvZVU1c1p6ZHhTV3hYVHpk
      eWFXWm9jVmxxWVZwaVFsTjFaV2RSZGtkTVJrUkdjek5UVVdKclpWTnlOQzhLWmlzMldYbHhPV2Rt
      ZWtkM2FFWkpUUzlrTUZnNVlXaENVVnA1VTJWNmNGYzNWMkpDVEd0NmQwWjNaVmwzTlVsb2NFcFZN
      RGhEVTNobVEzRk9RbmM0VHdvM2RFNTNRM29yWVVkTmJtSjBOa3BHWjFBMWMxYzNUbGg2ZG1SUWJW
      aFNLM0ptV2xVM2FqSlRRM2gzTW05alZIcEpWelZLZURsaWFrUk9aazg0WmtSdUNreHNialJpUXpo
      cVZGbHFObmh5VlRSU2JWZ3phMmx4WlVKNFZWVm5Nak54WVhwSE1YVlNaV0l4T0VSRVIxbHdNM0p5
      UW0xemEwVlpPSFY0T1hjMlNYUUtjM0p1U0RNMWRuSTFZVlp1VFdZeVlVUmFjelIyTVZOSWFIQlFR
      MW93WTJ0b1FXMUdOMWxzV2taNVoxTXZLMVZ5Y3paaVNEbE9VMjlTZVZGWVdFeERZUXBLZUVVeU5U
      WjVTVEEwTkdacmVFWk1USGxzTndvOVEwZHNSd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84003-3
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253040
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
        replace: '#net.ipv4.conf.default.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.accept_redirects is set
      sysctl:
        name: net.ipv4.conf.default.accept_redirects
        value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_log_martians_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      cE5jMUF2TUVneVJXTkdha0V5UVZZck16UkZabFZuWVN0UU5rWUtkV2sxTjFWWGJsUlhNbGMxVEVV
      MWRsVnJVMW92V0VSeGVFRnpXVk5JUWtWeFkyeHZjekJCZW5SS2VESmtTSFp5UzI1Vk0xRTFiVTh4
      UW5CbVJrUnVZZ3BHUjJzd00wMUNXVXA2WVc5TllURkpXWHBxYlZwTFZqaG5TbkJXZWtadVRqVXhX
      REppYVdwUWVVOHlLM0JFTmpGR04xWndabFVyVjFaSWNGRnNNMWxxQ2taVlNEaDJUMGRQTDBOeVZH
      TlZTMUpOZFhSUU9FVmxRemc1VjBGbWJsbEJaMFJ5Y1c1WmNVWndXalpIVUVWTE5sZFdaRFJLZGt4
      MU4wTXhRMUZrUXpnS1JHOVphak0zVlZRMlRrTldjRFZKWjA1RFowNDJMMHN3TWpJNFEwVnVhSEZ4
      ZGtjM1UwZ3dTRkJqWW5Cc2NpdFBVRXhJYlVWeU0zcDRSV1EzVm5oWlpRcExZaXRrY1d3clowaE9Z
      emRoUXpjeFIwRkVMMWg0VGpsT01IUTFWbWhQWldaMVQyWkJiMlZDWWs5NFV6SnhiMVphU21WNU1Y
      cFhka0ZpYXpkQmNUQXZDblpOZDB0S00ycHdTRFZ2YTNNMkszSmtkbTV5WVhCaWVsbzRZbUZRYzJR
      eWNYQnpOVXhPWWxBemEybFhNMHRNUVhkMlExbzJSM0I2VVRoRGNYRk1jRUlLTjIxWU56Wk5Ra3RE
      YlVKd1l6ZERjVWhWUjNwaFZVbExTR2xoYTBvd2JtOHZSRU5XU1VGTFJYVnJNRUZ6Tmxsb05WZFRU
      RFpoTWpRMWRqWXdLMnAxWndwSmJWUnFhVWR3WlhKT2JUSm9UazV3T1ROalVFd3lRMUJSTWpodGMx
      b3daV2d6TkUxWU0yaDFUM1ZIWVhWUmVURnlRbXRTZEZOb1lWTkZVMUk0YjJweUNuVnVUVUprTkUx
      dlIyaHFPVFYxTUdseWFDOW9jWEE0Wm1JMU5EQlBjakJSUldkS2VsQkNMMFZPYkRScmFXMTBaSE5C
      VDFwQ2RYUm1VbVV6UWpaVWRUWUtUa0UwVTNCTmJsaHJkRUZoTHpGeU9FdzFTRGxEVWpKSllWTmpS
      MUY2UkZCdWMxQmpPRkZ4Yms4MlFVVm5Uemw0ZFVGWk15OW5PRTU0Ym1KT05tbEZTZ3BRUld3d1ky
      b3hNMk5tVTBnMlFWaEZWak5XU3dvOU5sUktRUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84014-0
    - DISA-STIG-RHEL-09-253030
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(3)(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_conf_default_log_martians
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.log_martians.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.log_martians from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.log_martians
        replace: '#net.ipv4.conf.default.log_martians'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.log_martians is set
      sysctl:
        name: net.ipv4.conf.default.log_martians
        value: '{{ sysctl_net_ipv4_conf_default_log_martians_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Use Reverse Path Filtering by Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_rp_filter_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      OVBVVkF2YVd4WlJFNTJibG8xZEZjNVlUY3ZkVlJuVlhWTk1rOEtiRk54VlVWRWRFbGxiM2d2WlZk
      S1NWSm9iME16UjB4bWRWVllVVTh5Y1ZNelEwOVFibk5qTDFkV2FTc3JObVpWY2tObGFGWnVTV1ow
      TUd4UE1EZHJUQXBtWVdkSFIyTjFTMDByVGpreFFtNVZVeXM0WjBzelIxSTVlalZzZEN0allXTnNW
      R1pEZDJKd2R6aGpOSGhKZEVkdE5uVndabXd4VUZOcVEzcFdORVI0Q2tSM0wwRnVUbHBDUTA1VFVF
      YzFORzQwVmpscE16UkRPVmhJY0hsTFpsQndVMGRGUlhwaGJHOTBSRVo0YkV4WFRqbGtOa1JoY1hV
      NVZVTm9WREZXVEdRS1ExYzBjRzFLVW0xTk1taElVMlpEV1dZNWNIcFJlWFZIZUVGSGJrOUdiMUZv
      UTIxRE55OWtMMFpKVUVkd09XSlljM1F3YTB0UmMza3pTbUZaZWtWdVVRbzVhV2x6UVdSMlprTXpX
      R051SzFod1FUQjFNVlI2V2pjcmEyMU5aeTg1TDFwTVMyb3hVbWhKWkhOYVNWRXlhSEV6VmsxaFJH
      ODNiRTloVmtZeU5uQnNDbFpHYURObFJUWm9aMGhSZUhnd2JHMTFOMmhESzI5dlZrUjBVSE5IWlda
      VmRqaG5hVUUxVDFjNFJGSjBhR0ZITVdGd2FFZHZNMGRZYkU1eU9HbFVTSFFLTTJKU1JFTnVhblpI
      V2tWc1FXZDJlR2RCWjNOSmNHaFdWRmxrVmxsVlkwSjJPV2hHY1RGblJXVmphWEZrWWt4bFVscEVk
      MUJZVkROUWFVb3dkRlZFVkFwcWRFMHhWVmwzVEVWTWVVRXhla1ZYVEhCcFFqbEZlRkZOV1RsaEsy
      SkNjMjFhYnpGSFNFZFJja0pLVGk5U09HcFhNWHBFTkRoc2QyTkVXU3QyYlhaUUNqVnZNa1IwUkhS
      dFV6aHphbWt3Um13elZWSTRWelkxYjFJdldUVlBWRVUxU0d0VVNEZGxRMjkzZVROU2VuUjBOemQ0
      Wm1SV1VEWmtZMHAwWW14U1NIa0tNVzh3T0ZWTWNGYzFUbkZCY1hoRlRHYzROV2hyVTJJM2QySlZk
      bnB5TWk5SFMwbGpka2R5V0RWbEwxTldNVEJoWTBSVGJrbHdlVVZXZGk5MVdXVktiUXAzU0hKbk1u
      QkpSVGtyZERSc1dubDNUM2RuVGdvOWN6bFZSUW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84009-0
    - DISA-STIG-RHEL-09-253050
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_rp_filter
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.rp_filter.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.rp_filter from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.rp_filter
        replace: '#net.ipv4.conf.default.rp_filter'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.rp_filter is set
      sysctl:
        name: net.ipv4.conf.default.rp_filter
        value: '{{ sysctl_net_ipv4_conf_default_rp_filter_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Configure Kernel Parameter for Accepting Secure Redirects By Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Configure Kernel Parameter for Accepting Secure Redirects By Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_conf_default_secure_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      bFNWVkF2TWtKdVNrRmFhMEpNVm5SdlUwVlZlbTlwZUM5S1FXOEtSMWhHU3k4ek5FTklSRUpGUm1v
      cmFFbE1jVmxMVDJOSU9YWm9jRUpwVEdWemQzZFdUVkZVZEd0blREUXZhbGRvWmpsWmRVTkZPRE5F
      WW5SbGVXaDVVUW92T1RGT0szUlNhRXA2WkV4Qk0wMU1hakpOTkhCaWRXWmhWamxrV1c1VWNGQnVi
      M0J5UW5VMVVVeHFlRFV4Wkdzd2FuazJOazh2Y1Rsd2FHNXBjRWgxQ2pVeVdITlZWVkJWTkhjNVZ5
      OWhVMjlUV2xreE4xVXZXbEU0TTFOUVNtNDJkRlJOTDB0Sk1VODNZM0ZIYkVaaVZTODBPV3RaWmto
      d1dEUkNRMmhVVEVvS1EzSjZTbFp3YzBWVE9VeERibXBDVFdKVVNqY3ZOREJ3UzNocWVrWnVWemd3
      TVZCdlNHdExkWGwwWW1wRU1qVTNSMGxPWTJORE5taGpVbWRIYTA5cFpRbzBlbGRsT0RFeFZYZFlR
      ekpXYkVoV1ozVlpkVFpGTm1VM01EZzJhalJ5VUhkRlIyRm5ObkJZU0ZsbFpEYzRlVXh6YWxCaE1H
      dzNTRVV3ZFhoV1ZHdEtDbVl4U2s1RVZXaDROSGRVVlhCVk1EWkRVWEF6ZWxoS2NqRnFkRll2THpO
      cFlrMWxlVlJtY1RaVFExSnpVa3QxWldNM0t6WkNkSGR1TlZKcVUwMXdaSGtLWTBkbmEzY3JhMWsw
      WkRoeFp6aGFaMU5MVjNBekwzSllZMFV6U0ZrdmVuZFJPVXBpTmk5c1FtZFNaVEppY213dmEzSnRh
      a0U0U0V4SGVXZDBSMUkzUlFwUmQxZHdTbUpDZWpsdVJHWmFWRnBPVUd0S01FVjFhVmRxZFhjemFr
      eHRSbVYxWkVWQmFXTkJLMGxMY21oaVFYcEVSbEJzV0V0V04wWjNTRzVHZGpWMkNtNUxjbE01Y1V0
      WWJpOWhTVTVQYVVWR1ZXNXdjakl5WkhOYU1FVkxibmRXUldNM2MxcFhXamxKTVVrME5VZzBNMmt6
      T1VGdlQzRjFURzlNUjNSdmJGZ0tUWGxLVWtSaVN6ZDVUWE4wVVVGM1RuZFFWa3BKYVRsamVrMVFO
      R0pOY25CNWMzUnBibWwyT1Vwdk5qVlBRbGwzZHpoalozUXpPVUoyZVVsb2NUTlljUXBGUVZSc05X
      RXpaRTRyTUdka1drSlBZazgxVXdvOWFDc3ZjZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84019-9
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_secure_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.secure_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.secure_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.secure_redirects
        replace: '#net.ipv4.conf.default.secure_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.secure_redirects is set
      sysctl:
        name: net.ipv4.conf.default.secure_redirects
        value: '{{ sysctl_net_ipv4_conf_default_secure_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83999-3
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253070
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      Vk9aMUF2YVhFdlFtdGlRMjlEWW5sYVoySkphVkZ0ZW5rMlRua0tNR1ZCTlRsMGJpOVFVWEkwV1Nz
      M04xSXlaRFJGV0dGS1VXTktSRGx2V1VGdWRGWlBVa2RrVVdwNmRIWldhblZxWlhKc1R6bG5hVlZN
      VlZoSVIzRkNTd28xWmswMFN6RkhVVU5yVVV0aVlUUlRLMWMyVVZOWlYyUnFLeXRsVFhCblF6QmxS
      MFpvU2xrMkszTnVZVWhPVDFKWlIwMHhSMVpqZDJ4ellrOHphbXQ2Q20xa05EaGtZbkJSZWxkNlYy
      Wm1kMUUxVVV0Uk9FRlNlR2M0VVhGV1VHZzRURVJvWTJOblFXbHNNRWxyYW05YWQwNVZWRU5JWWk5
      RFluRmllbFpLVFVRS1ZIcEtZWE55Wm05b1kwTXlUbXRsT0d0U2VEUmxUMnhhTDB0U2FFbFdhMGxo
      VjFoWFozbDZjVXgwVURKd2FESndNbmRVWVVSUmRrMVpSMWR0YlhsTFNRcDBWeXRoWTJnMlRXbFNO
      bGwyTUZCQlducDFPV1p4TkU5eU1DdERTMEk0WjFnM1F5dExTWE0wYnpSVmNETmlkMUJFUTNKSk5F
      VTVWamx2VTBocU1ITklDalpGYzFKV1RrSnpRVGRuU1hRNVJHMDVORTEwZGs1cGExYzVOR3AzV1dK
      eVpVSk9VMmhtUmxwNlFXTjZOMmhZZW5acVpWUmxXbEpWY25KUFNFdEtOWFVLUzNkRVlsYzJVR2hD
      VXpkVldpOXNWWFZUTm0xQ1pHUjVjMjV2T1c1QmREVkVLM2RNVG1SbFkxVm1kekJWV0hWYVdUZEJh
      MWx1T0VOcE5qQTJZMWhGUlFwUlJYRjZSM3A1Ym1Wb1Z6RjRVRXhXYTJkaE1tWTJOV0pIV25CTVVF
      eDBja2xYUVhFd1RHbFRWMFpRY0hSNlRXRTVRUzl1YWpKWmJWazBhVFEyYTNSa0NtdExjbVU1V2xS
      NU1reFNaM2xhYm05SFR6WnBWeXRaUjNWdk1GZGpUa05XZUZGS2VsVXlTMEZxVjFaVGRrSXZaVTV4
      VkRGYWFFMWtUVFpZY2s1T09UQUtRWGc1YjBGUGNtOUJVRkEwUkdoWU5GRkhNVE5TVTBFMU5YSmlU
      SGRVV1drNFRtWnFabWxzV0ZKS05tTlRPRVE0YW1ocWVXVnJNMmRaVVRnMGNqRTFaZ3BTU0dSUGF6
      WkhVMmN4TW5nMlNVWnZVRXQ0VUFvOVMxbERVQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.conf.default.send_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.conf.default.send_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.conf.default.send_redirects
        replace: '#net.ipv4.conf.default.send_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
      sysctl:
        name: net.ipv4.conf.default.send_redirects
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEpRVUZ2U2tWTmRuYzFPRVFyYWpWd1Ru
      VlBNRkF2YWk5bmIxTkNObXd4U0hWVVVYVXhibmd3Wkc5dVVYRUtXbG8wV25KblZIRk1kMjFRTURC
      R2RFbDVlR3QwZVhwUEwyRTBlREZVUlZkSmFqQkxOWFJOTURSVVpVNVpNSEY1VDFFcmFYcE9VVTls
      Vm1FMlFtSmFSd3BrT1hJeGRrTmtVSGh6UkVGVmRYQnNZbmxrUWtjMFZUUm5kMGN5Tm5sUFVIZHBR
      Mnh4Vm5SU0t6TmtPVVZvUTFjelNIVllhWEZTVEROMFYzWkdjazFGQ25Sa1kxSjZSa2gzYjBSbmNG
      bE1XR3REVDAxSE1qZEZkRGRTYzJGUVltRlJjaTgzTkRoalozYzVRVU5HYVRkdU0zZ3dVVUYzU21w
      eVNVeFJXbkl5WmtRS2JHWXdTMnByYURCMVZYQmxlSEJNTUU1RVEySmtUa1ZpYzFSTk4zbHVhMjVv
      T1hOS1owdEllazgzVFdoMGQyTnBZV2huVjAxRWREWXplbVpRSzB4Tk9Bb3lNblF4TDFWRVUySnFT
      RmhJUm0xWFdFdE9XbFJUZFZJemVscHlLM0J0UW1RNVkxbzFXVU5ET1dOUFFsTlZiMjV3WkZJelVW
      ZEtiMnRzYldSelNHMWlDbU50V0hSSWJXSnRaa1l6UTBWellXczJSalp0V1U5eGRuRlhaVzVySzFC
      NFFtTXpkVWx5VEdvNU5pOUZZeTl0Wnl0dmQxRk5lVXQxU0RKbk9VcE1SblFLVkdNNVZWUXZTRFpT
      U2toNlUyaEpkRTFNZDNFNVZESkxRa2hSTjNSTFVEVnVlbW8wTDFSYVVWTnBZVEJwVWtaVFZYWnZS
      SHBYVFRoQ1ZVZHRVa05UTkFvNFdVbHVOSFowZDNNNVRVZENiRTlDU0VKbk1VOWxiaTluUVRSc2VW
      a3ZSV3R1TW5GbFRDOW9RWEZaUm10RFdsWkZTREZyWkVSaFVqZG5SMngyVWtSb0NtTnFiVmd2U0VF
      d1dGTnNSWEl2ZW5VMGRrbFRialpaUTBWS2RGUjVZVkpIS3pOM1NEVkxOMEZvV0hWV01ISjZNMGxZ
      ZWpGd2MwbDRZell4YzBGWUsxUUtSVVFyZVVKMVNUSmpPVk4xWkZaMlVsVkpOblJHZDBNMk1EVklV
      azUxVjJaWlJYVlpOV0ZwU2pSUFUzaEpjSEJHZDNSSWEyZzFlbEJhZERJclNYUTFid3AxUzFjcmVr
      bFhLMDB5TW01SWJXWmtXbFJDYmdvOWIwc3JaZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84004-1
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253055
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
        replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
      sysctl:
        name: net.ipv4.icmp_echo_ignore_broadcasts
        value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      TmpXVkF2YVZjd01XUllOM1JUYWpocWEyWXpUWE4wVVZkaVJUQUtjM1JyYkdwc1owazROVGwyUzAx
      elpVbG1TRWhST1VneGFXazVXbkZ2TTIxdE5FNUpPV1l3YkRORWJHc3JSV1V3VERCRVkzQTFNVWxK
      Y1RsUGIzaHBXUXBCYXpsclZUbFhhRTlWT0VVMWNFSkpRamhVYkZrMlZGQkZWME5RYlN0dU55OXVh
      VEZoTW5VdmRIVTFUak5GYzFKR1JITlZhMU4zTkhwQmRISnZRa1JvQ25ac2FWTm5RMVYxTlZSRVUy
      NTVlRGx6ZGtkMlFXZEdhRlUwVnpCWk9IRnRMMVZ4ZW5WaWRWcHVla2R4U2xaQ1VrTnFiR2x4ZUdo
      eVUxVmtXa3AzYW0wS1pFcEVTWFZoWjAxclJYWk1iRkpSVEVkM09HSm9kRXhRUTNKMkwwbzBhVEZ0
      WVhCVVVVZ3lWRmtyYTBkU1dXRlRZM28xTm5RMVQyWklTVTlpVkV0U1RncHlWRXRYTUZoVVltRlda
      bmhIYlRjMWMzUnRaVGxWZDFRNVVrSlJUSGxrZWpaSGJFRlBhbXRwUTBOalVEaHhNMWhHVW14cGNH
      Sm9LMVZqZDFJeGFETnNDamN2UWtwaVEzVkVTbVJQYldSUVNEVm5ORm80ZFhsNmFrbEpaVEZuYVZo
      Uk5EZEpVblZhTkcxVVNuZExkRTVTY21wSVFYWnJkazVYVGpCdGJHY3JWVWtLTW01U04xZG1LekJN
      VG0wd04zazBiak0yTnpWdVlXcFZUMFpLTkU5b2NIZEVZbVU0WW1sWlpHVnlSa3hMTTBRNFpEQmlR
      bFpxTHlzNFZYWk5jalpEWmdwMlRIZG5ZVkpyYlZKTlMxWmlXbmhPTDBRMVdWSldSRTU2VVdwcVVX
      ZHNVV3hhWm5kcldYSmtia0ZyTVhoeVRIaElTMUptYkROWVRVaElNV1EwTWxwdUNtSmxiRXAyYzJW
      TWRVZEhWelpPYm1WMVVrWmhaWEJXUVhwSWFrSnJPVElyV2pOcllXRnBSbWd5VjA5S1VWQjBSbUVy
      UkM5eVJXNXVUVEI0UzA5UFptVUtWbnBUYVRseU1WUk9Ua1ozU3pNeE9TOWlhVzloTkVKV1FXdDRR
      WEpyYlVOME9WUnNPRWhxTVN0alpWSjVSR3d2WVZCVFJsaFpTMFpuWlM5VU5GUnBTUXBLYzBGMU9Y
      QXlWSEpQYVc5U2MyRTVaa2tyU0FvOVMzSlJaZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84015-7
    - DISA-STIG-RHEL-09-253060
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - reboot_required
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - unknown_severity
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.icmp_ignore_bogus_error_responses from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses
        replace: '#net.ipv4.icmp_ignore_bogus_error_responses'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.icmp_ignore_bogus_error_responses is set
      sysctl:
        name: net.ipv4.icmp_ignore_bogus_error_responses
        value: '{{ sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  tags:
    - CCE-83998-5
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.3.1
    - PCI-DSS-Req-1.3.2
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_ip_forward
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      c3hNRkF2TWs5UE16aENWVXA0U21FMVZrd3lUbWh3U1Vjd1Vrc0tTMmgyUWtWR05uQkVSRnBRWjJV
      eFlUZEtZek1yZUdSRVQwdDNTbWRLT1ZKalNtRkxMM3BKZFUwclRUaEtRM0pSY25adGNqazBVR2xr
      YTJadFpFeFdOd3BsYkVOWVp6SlVZMEY0WkhwR1ZWbDZVM3BDZURjM1RIaGFhbE55VWpWbk56azFU
      VGhyWTNkdlltOXBPRU56U0RWdFptVXJiVUpQV2xacFQwZFJLMFJwQ201b1ZUSm1LMEpKTkUxUWJs
      cEVabTVUU0VKNWFYaE1kVFJLV0hveFIzbzBPVFp4UjJsWFNXbDBTMUkyVG1VMlppOXBRWGd6U2t4
      cFMxUmlORVZLUWtrS2FHOTJhV3BUWjFWaGExZGFRMlJxU1dwQ09GWTJNME5RUmk5UGNTOWxiM29y
      Vlhac1Z6ZEdPVXBxVW1KRFdTOW1SWEI1WkdoMlVIbHdiVkZTYzFSUlZ3bzJSM1E1VEcxTFdFeGxO
      M1ZSWXpRclIxWnRWM292ZGxjeWNXMTRiVUZQZGpRM1dUSmxjREZPTnpSak0wUTNVMnRaUWxsdU9H
      aHhiQzlGZWxCdVdrYzBDakZtVmpGRFprUnVWMEp5TlVoWk5GSnZiRVZQTW1oM2RqTXlPWFJIV1Va
      ck56SmhObWhVZFZwM2NuVnNaVkYzY0RnNVVpdFVjVXByVFU5VE1VSXJabVFLTXpaRGEycHhjWFF4
      UjBGb1ZqUTRlSGQ2Umsxd05HZFhNMkZrVFZsRllpdFdRbVZNYzNKSGIxRXhVbll5VG5oelpGVXpa
      VlZVWmxGM1FTc3dhMk5IU1FwRVZITlFlVFJEWTBkd1oycGFaR1IwTVRkdFZXSk1lRmhqUkhWSlps
      ZEJaR0pDVVdKWmRtSnBWMVJNZG1kTmRGbE9kVVJzUWtSNlNWUTFVMGxYY205UUNrbHlZMDVhTmxr
      eWJteEVUazh2UWtGcU1YUnpSWEpvZFU1VVptaGthRVpOYnpWSmVtaE9aWFY1ZW1STGJHUmtNemhC
      UjJsWmFVdEJiRTg0WVRkaGRrb0tha2x5VmpOU2RtaGxkR0k1U1c1WU5sQnFLelI1ZDJ4T1l6Vmxh
      bTl6WVVKaVdqWlNOR0V3ZERCcVJWSTJiMGxrUmpCSFFsaHNaR1JVVHpjMVJsbFdkUXByZEZkVFJt
      ZEpUazlJU0N0M1drZEdjV3hCVndvOWR6ZHljZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.ip_forward.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.ip_forward from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.ip_forward
        replace: '#net.ipv4.ip_forward'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.ip_forward is set to 0
      sysctl:
        name: net.ipv4.ip_forward
        value: '0'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'


# Enable Kernel Parameter to Use TCP Syncookies
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_tcp_syncookies,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Enable Kernel Parameter to Use TCP Syncookies on Network Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv4_tcp_syncookies_value: '1'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      TjFSVkF2TUd0RlYyNVJNVGhhWW5kbksxUk5RMGcxWTBsYVF6WUtXWFZKZVdseWVFNTJjMlI2Tmsw
      MGMzbEtaMFJZTWxRM2JscEJjMUpPWlU1b1FXWTFZMk13V1hJMmJTOUlOVFIxTDFCV09YWmllRGxq
      WTI5NlUxa3pkd3BvWTJ3eWJWWm9hRXhwWkVZM2FVdFFTSE5VUVUxVFRIVmFVbEJYV1hSeVRUUldO
      bU5VYVhaWFJrdG5PRWhHVjB4SWEyTlhaazVRS3pBeWEwZEtTbU5RQ2twYWVUWjZaVGRvVjAxaFRr
      VmpUMnd5Y1VSelVUZGlWV2R3TlhKcE4xSktkREIwTVdoMk1HWXpkelJNVWpjM2FrbFllV1JoVUdS
      d05USTRRWGxWWlcwS1MweENTRUV3WVRWa09HaENPRzB6TWpWS01FcEdiVlZDUWtSS01XcDVaREpK
      WjJGclkxcE5Lekp6YW5ad1FXSkdjemgwY3k5aWNGSmpWM1pYT1d0dGNRcHpUM2cwVEROTFUydFJV
      VW93YzNGYVRtRm1Ra1UzTHpJck5FOUVWMmRRUVhaeWFXeFVNamxFU2tGR04yZDBja2wzZFRjMFdX
      OWhURXRtZWtwbFQwbExDbEZsYkd0eVdUVnlTekZJYkVOYVFqZzNiMjFSWlc5d2QybzVVbXBsWjFS
      T1RXeDJOM2hOZW10eE5sVTJkakZLWTNwU2RucHpWbFZSYmpaV1dtSnJkMk1LY25KNGVEVldVSGxS
      WXpaR1pGVkpjbEZJUVRKT01HbG9ZM0JQTTJ3clIxTnFkbFEyVjBvM1RFbElPSE5aUzFkUloxcEpS
      MlZaTmtGS2R6WkZTbFJNVndwMU5YbE5TRlpyWVhCU1ExcGFWRVpVUnpKaVZqVkJRbVZvZVc1elEw
      cEVWbWhzVXpGcVIyWkZhRFZUT1hWaGNEbFVjVkpCU0NzNU0zVTJXRlZOT1Raa0NtMHhVVzFaTVcx
      aWN6TTNTbUZPYWpNd1EyaExNR2xITVRkM2FUVmtRVlV2SzI0MFNTOWhhVUZPZFdoSVZrSlBOVXRK
      YjAxRmQwTjZNbVIzZFVJMVRUa0taWEpYVEZoSmQzVkhWWFpoZFZwaVMyVm9Oa1puU2toc1EwaGlP
      WFpyY2pReVowY3ZOMk5TWlU5a2FFaDJiMEp0UjIxNFNtNHhlV1prZGpCbWVXRjRSZ3B0WVZCWVlV
      Y3ZVbGc0WWl0b1ZYSmFSbEp2VmdvOVVrVTBXQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84006-6
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-09-253010
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5(1)
    - NIST-800-53-SC-5(2)
    - NIST-800-53-SC-5(3)(a)
    - PCI-DSS-Req-1.4.1
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_tcp_syncookies
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv4.tcp_syncookies.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv4.tcp_syncookies from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv4.tcp_syncookies
        replace: '#net.ipv4.tcp_syncookies'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv4.tcp_syncookies is set
      sysctl:
        name: net.ipv4.tcp_syncookies
        value: '{{ sysctl_net_ipv4_tcp_syncookies_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Configure Accepting Router Advertisements on All IPv6 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Configure Accepting Router Advertisements on All IPv6 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_ra_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VjRWVkF2YWpKNmNHczRZMDFPWkdVNVEzQkxOM1UxUVU5Q1Ztb0tVRE5yUm5aaFoxQlFjMmQzVFhW
      SlRVdG1kWE40V0c5WGJrVnVRV2R6VFVoVUwxRllZMU4yWjBoTWFIb3djemx4WkU4NWVHOVdhM1Y2
      Wlhkc01YbG1NQXB5UWtRMk1WQlpOMEo1Y1VsdVQyMXlWMjFVYWtVcmJWSk9TMXAwVjFSbGNEUnFN
      V2htVDNwd1dVRmlibkpVVUdaSE5GUjRiWFpSVEd0eFNGTk5TRTVwQ2tKaU5TOURkM2htY1doYVF6
      bFBhbFJLVkhwVVNuWjJVM0ZsWWxsWU5rWldkVkYwWm5SYWRrbEhaQ3RRVkdkdFVFdEdWbGhRTWpG
      c0wyMVNjbVJqVjJnS1kwUmxObE5vZFRaQ2F6RTRUbFJRVVhkU09UTjZUbU5GV21vdlVHTkxXazFZ
      VWxJMVNGSkNhMmxSYTNoSlFuUlNaRFZ5T1hWT2FGUkdXa0Z1VUcxV1VBcFFNR053ZEU1MlVYbE9l
      bTlCVm5kSWRtNTZkR0pCZVdjNWNXUTBNSGhTT0d0V1ZqSjJUMjUzUjFWR01sbDFlWEJ4YWtOWGMz
      aFZTVEpLT1UwNGMwc3pDbTlTUXpsQ01GcFZTM1EyZEdwbFIzRk9UMVVyVUd0NVYyeDFiMFZwWms1
      S05sRlFNbXRyTlVWNlVXc3lRa1pLUzNGM1JXdGhTMjl2ZGs0dmF6WnZOSEVLTDFGdGFtcGtXbEJ3
      Y0VNelZFZFRia2g1UTIwMmRYbFNiMk01V2sxcVoyZG9PVkV6VGxOWFMwaDZaelZFVTNWNlIzVnBk
      RWs1ZFc4MVYzaFZUa3BrY0FwNlVIaFRibkpRVVZCNGVqWXhaekZNWVZVMU1rUnRlRE56UlROS2NF
      Sm1iMFZRVnprcmRrVk1Zak5wUVRoUmRqQldjWFpXVTBadlpuSkZTMHBGVG5Oc0NrZEVaREJ0Y0V4
      WVkxSlJjV2xFZEhOa1dVdEpjM0E0VFdKTFlVa3dlV0pqU3poV2RGZDRkVWhtVkRCSGNVaFFlSGhM
      WjJGV1NtSkxOMVpEWkdneVJFOEtXak5vTm1KSVZIRkNaSFF4TkhZM1QyZHZUamxyVlVoUlRXRkxU
      VlJSZDFFd1ZtUjNRak5RWjNjelIwNTNWamxHYzA5SE9WZDRaREJNU0M5dE9FRjBNZ3A2TVRRMllV
      MXdlVU16Vm1WcmVrdEtWUzlRS3dvOU5ESjBMd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84120-5
    - DISA-STIG-RHEL-09-254010
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_ra.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_ra from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_ra
        replace: '#net.ipv6.conf.all.accept_ra'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_ra is set
      sysctl:
        name: net.ipv6.conf.all.accept_ra
        value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Accepting ICMP Redirects for All IPv6 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting ICMP Redirects for All IPv6 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rs
      cDNSVkF2VW14VGJtdE5NbGd3VTB0QlYxVkNjSEV4ZDB0V2EzQUtjalpKZERGSlIxTnNURTgyV1Zk
      WlNTdHpPV1pJVWl0SlJIWkpNRUZ2VWtkUFRFbG9hbkExVjBodlNEVlVZbnBuZFdwUlVFWXhXWEZy
      T1RCa1UwUk1kQW94U2tSWVRrdGFaVE5KZFdaNmRHWnpXak5YUzA1V1JXZ3hja1F2YW1JMFRUVkJV
      U3RHVGs1d1NreFdVbmgxUjFwaWFFRjNTVkZPTHpad2F6bGtUVXA2Q2xwM2RURlBVMGx6ZVdZemFW
      TXphamw0YjBNMU0zWlVOM0ZXU1hob2MzZENSMDV3YUdGcU9XdHRUR05FVTJ4TE9XbExkVlZtUkhs
      VFZGQjVXWEJrZUZRS2NXNUZkRWR0U1UxV1pWSTVXVVpFWm5sclpHWmhUbmMxVVhoUE5UUllUbXhL
      Vm5OVmVtVjJXbXhLWTJjemVWSnZXVEk0V0dwS1EwTTBRMFV3WVZKaVdBcGFkalZWUjBKelFtWnRT
      RU5vTDJaQk9XTmFjRGhCVjFkblRVYzNjbEp3U0Zack5YVnFObHBRZWpSSlVtUjJkamMyY0dGaFpt
      VnBXVmhGV2xvelYxWlhDa0ZFWldoVGFFSXJkM3A0ZFZCM0szUjNZVXhpYlRCb2JscFVSa3BFVW1k
      b1EzVk9UMGxQVjFoaFNuZEljRE5MWkdKeE9VaHZjalZ4U0VGaFowRXhibTRLVjFwUWFqaExPVU5D
      UmpBMmJHVlpLMmxOYTNSalZGZERRVFp5SzA5TWJGVnJMekJ0ZGt0WVpIbFRlREI2UXpkYVoySTRN
      V05OSzNONWFITlBSWHBFZUFwRlRFZE5NR1V2U210c1dIaFpWbkZGTm1OQ1ltNHhTRlE1U0RKVk4w
      eFRUbVZRY1VGNE5VWXhMMHhJUXk5dU9IUXdRWGREYzJkeWRGSk9SVlo2ZVZsc0NrZzBXbTVIVWtk
      bWVGbHpNMFF6V2pZNGVTdFNTRGRUWmxnM0wxTkRLM0J4UkhZNGVYUXlRMGsxUXl0aVQxRnlUMVp1
      S3l0MVZ6aExkVmd5ZHl0dFRUWUtOQzlpWjNGYVJrbFFVQ3MxVm1STWMyeEtjMUJKVVRKbGRHSkRS
      RWRIUkRablVYZGljSFUyUmtWeVdFNVFRVkZCYVhsaVNqSjFUV0ZaZDBWdmEwTlRUUXBQYkRSVFVs
      SnFUME5hTmxBd1UwSkJiRTVXTndvOVJrNVZRd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84125-4
    - DISA-STIG-RHEL-09-254015
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
        replace: '#net.ipv6.conf.all.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_redirects is set
      sysctl:
        name: net.ipv6.conf.all.accept_redirects
        value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      dFhhMUF2TURsU2F6SmFhVFpZVFZOemVucExXRlpGZURWMVZFVUtWM1EzVkdOclFWSlZSbEJ0VGxC
      allXWXJRVUl5YnpkUk16ZFVkMmhpT1dWaVkwWXpLM2t6Wm1JMVlVcFZObkpOUVc4MGVFaHhhMHhx
      VjJodk5sZEhhd3BFVlVVclVTdFliR3BtZW5WQ1IyMXNjR3RqWlc0d1VrUnBXSEppUmpsVlZrWjZj
      VTlqUmtacFIwTTBkVUZCVGxCdFQycFRWRXR6VmtKb1RsUkJOVWxoQ2psemNub3ljMlp1TDJRcmMx
      bGlXRmN4TlV0VU9FUTFlVklyU21SMWFESnlOamhNVkhoUUwzUjZTV3d2Y1VJeWExVklZV1k1TURO
      alEzbGxhamhSYmk4S1RFMW1WRms1Y1VaWlpEaERVMVJ2VldWUVp6a3dSV3RrZVdneFJDOUZObkV2
      VFVJcmQxZFZSM1pRY3pSQkt6aHlUMmRVTTFGelZEaERZVTlyUVZOVVlncFJOelJTWVUxeGNIRlJl
      WGhSTm1zd09EbE9jRUZVT1doeFVraERhSGhMVEUxSk1GWXdhMkZUVTFNNFVHOVpaMjlFYkVOT1Qy
      RTJhU3R4YWtsS04xVlBDaTlZWkRWUVdqUXJUbVpHWmtKdVRVTlNiVlpRYzFkSllXa3ZPV1poY0Rk
      VmMxUjJUbU5LSzBrclpHbFlhbHBhVFdkYU9YVklVbGRFUkVkMFZGVk9NMGNLZFhoeVZ5OVllVlp5
      YVRWbGQzQk1jMk5HUmpSSlZ6TjFTMnNyTkU1cFdESTBjV2hwWVV0bFpXZ3hka2MzVkZoNk1WUjZj
      akJRVVdoU2FGQTJVQ3N4YndvcmQyaGxSbTV0T1ZCc01UaG1aR3RwV2l0MlF6ZHJTVWRqZGxoSWFT
      dG5OMGhQY21sUVUwcHpOSFp1ZWsxYVYzSjRiMVl2TVU1dk1WQm5LMjVzVlZwRUNqRkJPVGhxUmpS
      MGRHTTBOV3N6WlVKUWJGbFdVa2x5V1hwdVMwaHNVVkpEYUdOMFpXb3dOMGhpTW1GSWJsVjBTREJR
      TTJZeU1YSXlWR052TWxCck9XSUtSbEYyT0dsUVZrbFVkM1ZFVUVaWlVHaGlUekpNZW5KT1NuWXhR
      VGx2UWpkMllsVkNWbHBwYlZCeGFWSnZWbVJxVHpoaWJrNHhOWE5JUlZCRVJYQklaUXBCZWsxT2VH
      MHJaM0ZDTkZBNFNYaGxhbVJ4UndvOU1IUlVkd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84131-2
    - DISA-STIG-RHEL-09-254020
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
        replace: '#net.ipv6.conf.all.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.accept_source_route is set
      sysctl:
        name: net.ipv6.conf.all.accept_source_route
        value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for IPv6 Forwarding
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for IPv6 Forwarding
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_all_forwarding_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      VXdVVkF2VW5Jck5rTkdURkE0VFhWck5sRnpTM1ZoU2xaV1kzZ0tZelkwY2xGUVlWZDZLMDVET1VW
      bGRGcEVlRFJ4SzJrMWJETXpSWGRtUlV4U2VrWnFPREowZVZGSk1FMVRlRUZaWVdsUVpqRnlWRGR3
      Vms0d2NHRkdXZ292UkhGa1dXRnpaVGRMWlVOWWJrNUNOM1EyTUVOb1NXWkhOV0ZEV2pRd05rdGpT
      VkpsU1hORlZVdzFNR1ZEVkRWTk1IaG9ZWGxXU1d4Q0syTk9iVmRJQ2s1UFIyOHZTV1o0Um5kSGRr
      ZDRVSE5aZW1Kc1IxWjFkbU5HU2tkUU1YaFNhREUzV1RrMU5IbEVlRXRwUW5jcmRTdFlOblZNYUdk
      blkyUmFOVmxFWnpFS1V6SmxiMmhPZEVReFZGWmFZaTh2YURkek1VWkVLME5yVDNRNFN6WlFXV0pt
      UnpCcWFWa3hkbE5qWVVreEsxUlJRWFpaUW1SWU5Xd3dPRU5pZERKSVNRcGlRbVl3T0c5dE0wNW5T
      a1Z1TWpCUVRuVlhURnBvV2taTlMwMU9WRGR2YWxwWGEyNXdLeTl0YTBOR1lXSTFRMDB4WjBkeVRE
      SlpNbEpPYVhCTVVYSnJDakpqYUVkcVdHMTViV0ZNYkdWbFRVczFURTkwWW1VMFN6bDFSRTV1VDNk
      SVJIWm5jV0Z0VldaYVRUSlZSRVJvTkdoSVUyVjBRVnBFYmxJM01XdERLellLUTNnMllXVlBTSHBS
      VVVaM1JqSnVhSGsyZWxGc0wyaGxSbWxEVFhKckwxbEZVMnBSVkdoUVNuZHJNVzFOT0VodGFuVm5L
      elZ1TDBSd1owTkZXRU5GVUFwalpEbHFUVkpyUkhCWFZ6bERaVTlrZFdZck0ydEdObVpHVFhseFdV
      VkxSRUk1T1N0WE5rdzRORVpKYWxZME1rVTNRV3hCZDIxUVlteFhlV0p5T1dseENrSkxla3czZEZC
      b1QyWm9TVGh5T0c0NVYyZGtXVlpNSzFSS01qUXZPRWh0UXpSVFdXSTJkRFJtY1doaVdIZFBOV0Z2
      WjBWd1FXeEVhSGRwVURaRGJ6VUtaRXhCVG1kQ1YwNUtNR3hPVUZwdGVYVXZlalJyYjFSVVdVOXNP
      Q3MyU0RoSUszQjRUVXM1YW5ZdlJsUkJaWEZKVFVScmMyVXhRV1ZxWVhwaVVHVlVWUW80UzBkc1Yx
      Wmlkak12TkhBM2NqRjRjR3hQS3dvOVlXNHJSd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84114-8
    - DISA-STIG-RHEL-09-254025
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.all.forwarding.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.all.forwarding from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.all.forwarding
        replace: '#net.ipv6.conf.all.forwarding'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.all.forwarding is set
      sysctl:
        name: net.ipv6.conf.all.forwarding
        value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_ra_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rr
      aFhiMUF2TVU5allrOTJURVE0ZERkQ05HaEdhekl4U0dSUE1USUtTa1kyTjNZclVXdHBjRmMyUzJG
      b1ltZG9aelpPU2xSYVUwOVVOV2hMTWpWc1dVMVFia3AwYkV3NU9IVnpWVEo2TXpsd2IxSmtPRFZT
      WTJoRE1FcE5Od296YjJOUU1HdDZMM2R4YlRsb1J5OTZhalo0YVV4NFIwMTNjVVUxVTNCRFNYSkll
      Vk15ZUhCMFZteEpPU3RGVFZVclZrMXdOSEF5ZERoQ2Ewb3hTREZFQ2pJNU1pdFliakF6YldORVJt
      MXlOMDl3TVc1eFVDOUNTa1JwWTFOd1VFVnJTbmxOU25WS1FqSTVTRGN2YlZCM2NYSlJZelJYYjFK
      QlpISjRPV1JhV0hjS1pGaEdMek0yZDFJMlYwTkxTMmh5U2xodlZIWkxhVXRwWTJ4aVJtRlFTVGQ0
      UzJ4bWJGcERRWEZrYW1oUE4yaDNlWGRRWVZkTFFWcGtLMFZvUzFKeFJRcGllWEZGUXpCWGJEbHZj
      M0oxU201RWJIUk1hM2haV0VWVmVsZG5kRzR3TW5KTFdqZFVjVmxtVm5ReFpVMU5hVzlxU1d0eWIw
      RTNjemw0WVRkQ1JGVjNDbEYyWTBwNFNUTllhSEkxUlhscmJUWlRjMHhuUjJoV2FTOU1hbVl6VFhw
      R1VXcEhPVTAzU2poVlkyaG9TQ3RxYTI1bFVEQnFkU3N5V25Kd1RVeEhhbm9LVFhoR1ZFSlRTbXd4
      YjJKemVsaG5URTVhUjJVcksycEJaVkJ0ZG04eWMwSkJXVWh1UldkeVZHVXdSV3RWWldRdlZIVXJL
      M0pKU2xkSVlWSTVkSFF3Vndwd00yUjZXRmRhVFZaWlkwRkZMemt6YWpSTlNra3djRUV3UzI5TmFV
      NHlkMHRKVjBSMVZGZFpTVU5oVjNCTFprUjRXbU54UjBGR05WQkdPWE00VlhSYUNpOU9PVVJKZVRo
      SGFYSlZhSHB3YW1neFkxVjFPVUpXTW14alEyMHZaREZJZUhkMGNubDRSbFJ6WVZNeVRIUlphMEpM
      Y0hrMGJFTmthVkpuUTI1TFoyb0tZWEJ6VUhaV1luRlJaekJNVVc5WmQzSnlSM05sY1NzemJrZDRT
      bWhLV25aWGQwWldaSHByVWtVd09IZGhNWElyT1dwQlZYcGlZVXhqVGxBdmJtTTBiZ281YlVGSVNu
      ZENhak55TWl0VFdYZDNZbE5hWkFvOVZEQnlTd290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84124-7
    - DISA-STIG-RHEL-09-254030
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_ra.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_ra from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_ra
        replace: '#net.ipv6.conf.default.accept_ra'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_ra is set
      sysctl:
        name: net.ipv6.conf.default.accept_ra
        value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_redirects_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeEtRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rt
      cGtORkZCU1dVeVZpODFMM1l2TUdKdFJYQnpjRE5JYTBSVmRuQUtjemR5Y3poT04xTnNVRXhzZUVw
      M0wwZGxZalV4TlRKSmNYQm9VMkUzWnpRd1prcENZM2hxTjJReVJFVjJXWGRKSzNWNEsyRTBURU5Z
      VFU4NFYxZ3JkQW95UWxOU04wbzVjVXc0YkUxSlRFZ3hNMnhDUjBGS2NXbG5aazVLZG5kSFJXdDFP
      R3RIV1RaUFRYbGpkVlI2VVN0SE9XbHJkR2xPT0U1clNteE5WMWhQQ2psWFZDOUJlRFpWUXpKU1Ey
      ZFdjMU5OUTFGUmFucFVibVZXY2pGM1lWVjZlbm9yTURCNFZIVnFNRWR1Uld4S01EQkVjSFIyTTBo
      YVNtVkZZbmRKWTNnS1FrSnFRazl3ZGpCSFZuSklhMEo1Tm1aMVdraHRjRVpSUjNWdWRuVkRSM1J0
      VlU4NU0wbzJRamxVYzFOU2IybEtObE5EVmtod1lXZDRiVE5TUm1wVE1nbzBWMlJRWkdKR1ZHZG5Z
      Mnc0T1cxNVNuTlJjbGhDZFRoRllYbDZWSEpHWWpocU5IZzRkbkJSV0V3eE9ESkZhak5TUVcxRGJq
      WTFXV3hFT1dOa0wzVXhDbGhYTDBoelIwVlJRekUwUlVWcFlrMHdTR0ZtTWxKd2RtdHZRekpLVGxG
      MmNrbEhUMGhDV0U5V1ZETlFkMmRUWW5aek5rNXZkMHh5TW5KbE4yazJkMk1LV25jeGJ6TklRWFo2
      V1ZWVWFFUmlURVkyWkhCSlYyZE1hWFJVYlhwRWNsbHJOMmRGZDJ3clZ6QTNNalpGUTJGS1lTdGlZ
      M0UyYlZNcmVHUnZSVkJTYndwTE1UZzNUbFIxVm5sVlpISkNlUzlDZGsxUVFTdG1Wa3hSTTJwUmRt
      SnRVelZKSzBsSVFreGtTM0J6VW5rMFMwZzRURmRXWTFReVVHRmpXbkowWmpOMUNqQllZWE5PVERa
      VWRIZHhTMUJ2V1Znd1VIZzFSRWhQY2xWbVpGVm9LMUZxY0RkUVdGWlVVSFJyVGxkdFlYTkhUbVUz
      UVd3MmRHVTJkRTVwZFVaTFJXa0tTRlk0ZUZnM1VtWk9NbFZsUjIxSFMyVm5MMHhUYkhOQmFXbGxh
      bUZxTWpKWk1VZExNa3RLUlVZNWRtOWxhU3RzVm5JNU1ubzBlazAxZEVsbWVFZG5lZ3BGTkVGdk5V
      OVpkMWxKZFhoM2VXSldNbFkxZVFvOWVXUXlSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84113-0
    - DISA-STIG-RHEL-09-254035
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_redirects.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_redirects from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
        replace: '#net.ipv6.conf.default.accept_redirects'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_redirects is set
      sysctl:
        name: net.ipv6.conf.default.accept_redirects
        value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route,fix)
# Version: undefined
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    sysctl_net_ipv6_conf_default_accept_source_route_value: '0'
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeExRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rp
      OUlXVkF2TTBONWJUQlpRbVl6VlhwaVRYRlBSVEpSYWxCeVZuY0thSGhvVEc1TFdtRk1ja1JoZG5C
      S1RqTlRSV3hFWW5GTE9FUXhVRlZqYWtneGRXVXdkbXBTYjNWVk1GcGFhbHBvUlVweFQwMTZlRVJI
      THpWaldUUlhSZ3ByTVRSUGJYZ3pORUl5Y20xWlZEVjRSVVV6ZDNoWGFWTXJTMk41ZVZocFRsSkxL
      M000UlVkVk9FNDVja2N5V1ZSYWJGRXhMeTgyVEhwdmVHVnFaMVV2Q2tweGF6ZHZOelZRUzFoNFNt
      WnZjRmxZWlU5Wk9XUTVjM3BZY2preEwwVnlLMlZHZEUxTU1ISTRWMWhGWW1wcWFrZ3ZORkJKUzJR
      eVVHdHpZVU5NWms4S2VXbHhlRU5zTjBsUGJtVjZVVE5SYjBkcFIyaDBkWFpJYlVvelVuSkJZVEI1
      VFhOR1duWTVWQzg1TVVkMmRGUXdTMk5VZVZSdVlpdEVTVWcwWWs5aWF3bzBSMHQ0WlhBMFMxZzFj
      a292VjNwQmNTOXZWVkZHZFhNMVIxTjBjM2QzYUZaTGQySjNPUzlPY0dKbmEwMVpWMUI2U3pSMVdW
      WmlSbVE0ZDNoT1lXNWhDa1JZUVVSS09HVmxVbFJuVWpVMWNIaEtWemw0Y2k4NVVVTkVWemxuVlZW
      cE9WTXliWGRWSzAxdFYweG1NemRwTmxGMGNFVldaMVJsTkRkUGIwVnhTMmtLVDBOSVNFVmhPSEpQ
      TTIwMU5HRlhibVpNZUdaS2NUUnVaMUE1YVhkTU5sSkROMFJZUlRoWlVIZFhVRE5GV2t4VWNUaGll
      amRhWjI1bWJYbDVTSFowZGdwa1dtWkZiWGxzYW1kTVVYbHRZelpwUWtjemNFRnpjbHBITkhGa1Yz
      SlVkMFphTjIxME9EaENhMHRvVlRkaVprSm1NRnB3Y0hVd2JIRjBabXgzVG1WMENsZHFWazlUYjBS
      WkwwTkNORWR6VXpCWVZWUkllbmh3WkVrNWRXWnJSelI2YmxZMGFXTlZOVUZvUWpNMGVVSmlUM1JT
      TldWdllraFFUSGd3ZEd4NGRrc0tWalI1VDJ4bWFFZHFNa0psZFdSR05IaFNSMk16YWxJeWFEVnJk
      MGRzVGpsQmJFRjZWSGhaTm0xV1prNDBaVkJCTkRSaFlWSnZlbTVVV25aQ2IzRlFWd3AzVDFKU1Ew
      aE1SbVY0U3pCemFDOXVibFpRWXdvOVMxbFZSQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-84130-4
    - DISA-STIG-RHEL-09-254040
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: List /etc/sysctl.d/*.conf files
      find:
        paths:
          - /etc/sysctl.d/
          - /run/sysctl.d/
          - /usr/local/lib/sysctl.d/
        contains: ^[\s]*net.ipv6.conf.default.accept_source_route.*$
        patterns: '*.conf'
        file_type: any
      register: find_sysctl_d
      when: '"kernel" in ansible_facts.packages'

    - name: Comment out any occurrences of net.ipv6.conf.default.accept_source_route from config files
      replace:
        path: '{{ item.path }}'
        regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
        replace: '#net.ipv6.conf.default.accept_source_route'
      loop: '{{ find_sysctl_d.files }}'
      when: '"kernel" in ansible_facts.packages'

    - name: Ensure sysctl net.ipv6.conf.default.accept_source_route is set
      sysctl:
        name: net.ipv6.conf.default.accept_source_route
        value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
        sysctl_file: /etc/sysctl.conf
        state: present
        reload: true
      when: '"kernel" in ansible_facts.packages'
  handlers:
    - name: insights_reboot_handler
      set_fact:
        insights_needs_reboot: true


# Enforce Usage of pam_wheel with Group Parameter for su Authentication
# Identifier: (ssg:rhel9|cis_server_l1|xccdf_org.ssgproject.content_rule_use_pam_wheel_group_for_su,fix)
# Version: undefined
# platform = multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- name: Enforce Usage of pam_wheel with Group Parameter for su Authentication
  hosts: 'tupelo-rhel9-0.rhc.home.arpa'
  become: true
  vars:
    var_pam_wheel_group_for_su: sugroup
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU201U2IyeExRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      QnVVVkF2VW1kcU1tcGhVWFYyVlcxUmVrMVFkVU5OVkVob1dEVUtkbFY0YTJsR2FHcDBTMUUxTVZo
      WFdra3pkamd6ZEUxQlMzQTNhR0k0TDNaSE9YTlBlbmRYUzJGWU5IWjRaRGhXTUZscmVVaHdTR3hN
      VFhSUGFFZzRhQXBDV0RCWlozUjRiMlJsYkdWNmJtcFpkR3BvUTBkTVlVUlpLMUpOY0hjNGNHbHhP
      U3RvWkRGM1kwZGxWelp2TDJkSlMycHpNMmhNU0hsb1lYRklXaXR1Q2xVd1FraEpVVEpXUWxVemRq
      WnFURmRPY2sxMFRGZDNWVWw0UVZWR1IwMVJaMFV2WkhGUWRXNUNhWE5DTjBkaFJHaENjekZIWVUx
      c2RGbFFXVFJNZEdZS2NtdFdXWGhKZFZJd2NWQk9lR0p6UzJ4TVdIRlZTaXRNUVRZd1dWWjVOREpD
      YVV4cVkyWTFRVFJsVFZwWmNtRkhNa05YWkRNd1NEaE9UVWRaUW5SemF3cGpTemxYVkdocWJsUlFP
      RkZvVjA5dmQwVldTa2xTWVZkQ1RuWm1TVkE1Wm1sSU4xRllWMkpWUW1abVZqWlZURUZQUXk5c1pI
      Qm1Va2MwZFUxYWRtZDRDbkJGUVVGeFl5dGxPR2x3TVd4aE9GWTNNRGRJWW10Q2VUUk1WRE5hYTNZ
      eVYxSlZTSGRZUTNWTGVHaDNXU3NyVjBzek5tTllUbkp4VjJjNVdDOHlRM1lLTW5OWlpuWnJkRGhD
      YlZFMU1EVjBSMVpxUmlzNGVteGlaa0o0VlN0b2Qya3plU3RzTkdGVVpETXlaMVppT1dVd1RqTnNj
      VU5GTHpKUVJqRkJSRzR3VlFvd2JrUndXQ3RIVFdWaWEwSm9hRUUyUXpsTlp6VmFNMFp4ZGxsTmRu
      TnVUUzl5VjFSWk1XOW1PVmw0V0RrME9WbzBhWHBpY0dGRlVuRnZOR2hzVDJGV0NsWnZUV3A0Tldr
      MFoybFhkbVIxVUZCellsWmxjWE5MTlVsSVdTOHZXakZMVVhacE0zSldiR1ZWYkRaRVZXcEdja05W
      TWxKbFUybzVlR0kwYVZkeFlsQUtWVElyZGk5WVRVbEZXVFJHZERFeWFDOU5NMXBVY1ZWMGJGTnRV
      V0o0YVhndmVYbG9OVkkyWVhOMFdGZHFUREI0V25CUGFYUlNUVE5LVHpsTmVGVjNaZ3BVVXpGdU5H
      dHFWM0JKU25OT01Ib3pLMk51VndvOWJWQkVhQW90TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tags:
    - CCE-86065-0
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - use_pam_wheel_group_for_su
  tasks:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enforce Usage of pam_wheel with Group Parameter for su Authentication - Add the group to the /etc/pam.d/su file
      ansible.builtin.lineinfile:
        path: /etc/pam.d/su
        state: present
        regexp: ^[\s]*#[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid group=$
        line: auth             required        pam_wheel.so use_uid group={{ var_pam_wheel_group_for_su }}
      when: '"pam" in ansible_facts.packages'


- name: generate Compliance report
  hosts: "tupelo-rhel9-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTV05DUVVGQ1EwRkJSMEpSU213elMyZFlRVUZ2U2tWTmRuYzFPRVFyYWpWd1Rq
      a3djMUZCU1dwWVVsWklhUzh5WkdRclFrdzRhRnBCVXlzNGJrd0tjbUp5WkhobWRra3ZhM1p3TWxj
      eGNrMWtNbkJ0YmpsV1owOURXVll6YzI5Nk1FNURjRTVKZUhsUFFuZFpXVmhOYkdwYU5XcGhOSE5F
      TkZVME5HbzFRUXBQUmxWTE1IQmxaR3QwVTJseVVsbDJhbTFsVm1oU1YyRnhURzE0VnpJeFFVdDNN
      bmR5YTBRM1EwNVRjM1JtYmxWMlRtUkJabU5LYjFGV2NHODJOM2RyQ2sxUFNUaFJZMlo2ZFdJMWNu
      aHlTSFV3ZUM5eFZqVnROa3RPZVZORFptaFlLelo0SzFkMWFqQk1ibEZqYTJ4WVYyVkZVM2hQV1N0
      blRrMUJNMFkxYkU4S1dXcHdSMmhVU25oeFkzSXpTRWh0TURsV1RWTk1aeTkwTjNFNGRqaERWMlp1
      Wms1M2VVcDBOazVsYVV0MGFVYzVUa2hKV1d0M1NFZ3lOMFZZTlhORk9Rb3pSakEyWWs5NlpsQkdT
      RWRaUzBzeFlYTmplamhvTDNOMVRtMDRiWFJ4Ym5CQmIycHNkM1JZVDNKWmFVaG1hV1JsTWtSaWEz
      VjNOUzl0ZDBGSFFXZFVDbGhtTWtJMGMybFBVSHBpWWxvMVUzUjJSbFk0YzBaMVVrMTFjWEpHVTJj
      M2FsSkpkbkpQT1ZjeE5YQTBiV04xUnpkSWVDOVJRMVpvUmpkb1FuUkZUMG9LVFhCdmFYVjBOVlpx
      ZGxsVFkwcEJUM05tTUdsYU5FaFlRWEZtVEVWWWVtdzFja1ZzUmtoek1GSnlWRkJsWVZoSmRqTmti
      bkpUV0dkNFNUZFVTVUpUYVFwYWJtTkNZalpMVUdkNWFVSXJibWRQV0ZCbFEyMUhNbmRMVm5CSGVI
      ZDFkV0pXTWtScE5FdGxhWHB0V25KcWNtMVFPRlJLWjJWb2QyRktSMmt5TlZwakNrcFpVMlpGTVU5
      T1pucDVaR2gxVmxscVltSnhabkppZGxKWU4zaExlV1JNTVhWQlRucG9Ua05wY2pSRk0xcHRaRloy
      UlVSd04wNVNhalIwTmpReldrY0tTVGxSYnpGRldEazNlR001YmtwYU0wMDVWME5zYVhSa2MwUTJh
      V1JQWlhCU1FuRlBhSFJIU0hoRlkxVkJUMHgxWkUwelNVNDNNM1pDVlRCa1dsbFVXQXByYVhwNVRV
      VXJibGxEUmxKSk9XWjFaemx2ZGdvOVVtcGxWZ290TFMwdExVVk9SQ0JRUjFBZ1UwbEhUa0ZVVlZK
      RkxTMHRMUzBL
  tasks:
    - name: generate Compliance report
      command: insights-client --compliance
      changed_when: false

# Reboots a system if any of the preceeding plays sets the 'insights_needs_reboot' variable to true.
# The variable can be overridden to suppress this behavior.
- name: Reboot system (if applicable)
  hosts: "tupelo-rhel9-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTVlpCZDFWQldVaHBRMVk0ZG5jMU9FUXJhalZ3VGtGUmFrMUVRa0ZCYTJOeE1W
      WlhVbEF3VUVoMGRIRjBWMGt4UkZSdU4zcE1kbFUyU0hKd2QxSUtUbkJ3Um5SWGJWRktiM2xxYm1w
      bE5XUmFSemMxUTNCU1kzZGFPRU5XVW5sRlRVRXpVREExZW1Kc1UzSnFWbTUxVW5oNlpVeG1SbTFy
      YW1SRVJWcHdjZ3ByWTJ0d2FFazJSVUpIYWtJemEyaGFUalJ5YTNwUWRWQm1PR1pMUVdsSE1ESmxk
      SGhXVFZWV01tZHRkV3c0UjBJMmRIcEpkRk5uVFRGQlFYQkdORTFRQ2s1NFRDOUpUMlY2ZFdRMGFt
      VlFaV05KZWpGS1dtMTVkVGgzWTNoVFZqWkpTbTVPU1VGSGVHYzVWRUpVYzNNMFEwbHVaVlZXY0RG
      VWRrUlFPUzlHVXk4S2VGaFlaMFphWlM5VlZuQjBaRzA1ZDJkbmRVOXRiR2hvWVZCTVZHNU5Tbkoy
      UVRsV2FVUnZRVzV2WWt0b1VIbEtZMHBSYjJOTFdrRlRjVTF6ZWs1VWNncHVNek5JYlRoUk9IQnRW
      VTFLYldobU9VRnZkM2x4VW5GWVVHeHpXVGwzT0UxRU1WQkZjR3htY2pJeVlYTjFMMHhvYjNGNlIz
      TmtOMUUxTTJwdFMyNXBDaXM1Y0VjeWEzVkNSVXhpVVhoblRHcERiVlZsUzFCdmJuaFhjM0JuVFZs
      M2VYQjFaVFJvYnl0dmFsZG5WRGR2ZG1GbFRFNVRTMkV2UkZOS2JEWldRaThLZEd4YUwxUXJPRFZr
      Ym5ZclNWb3phbEJTZFM5bVpuZFBkVVpVV2xoNmVGTkJUalZSV1M5ak15c3hhbUZSTDBKeFdYTmhi
      M2RpUkZreGRXUXZVeXRsYVFwa2FEa3JWRkV5TlVKa1NYa3hibGh3ZWpoV1JHbHpjbEp3Y0VrNWFs
      SldWakkwTVVVelRVWkhka1ZaTm1aVFYzSlZWMWMzY0RKbFpUbGphelpOVlUweUNrNUZjRXBLWm5G
      UFNFdHBjRXRPZVRKdVFVRTJURmcxTHpNeGFWSk9VSEZZVXpKRVdqSlpkbVZTUTJOMmVDOHZPVTlo
      UzFWd1FsZElZVmxYYW5STU4wWUtSWFJWVEZGeFZESkJPVTF3WjFSU1RtOU5WbEZ4Y1haQ01GUlBP
      WE00TmxoTmRuUkdRa1IzYW5SbWIxSm9NRnBEYlUwME1FRlhRMHBxT0RKNlduTlRZUXBCYXpkUEsy
      UkpkMFl5VVQwS1BWcEtiallLTFMwdExTMUZUa1FnVUVkUUlGTkpSMDVCVkZWU1JTMHRMUzB0Q2c9
      PQ==
  tasks:
    - when:
        - insights_needs_reboot is defined
        - insights_needs_reboot
      block:
        - name: Reboot system
          shell: sleep 2 && shutdown -r now "Ansible triggered reboot"
          async: 1
          poll: 0
          ignore_errors: true

        - name: Wait for system to boot up
          local_action:
            module: wait_for
            host: "{{ hostvars[inventory_hostname]['ansible_host'] | default(hostvars[inventory_hostname]['ansible_ssh_host'], true) | default(inventory_hostname, true) }}"
            port: "{{ hostvars[inventory_hostname]['ansible_port'] | default(hostvars[inventory_hostname]['ansible_ssh_port'], true) | default('22', true) }}"
            delay: 15
            search_regex: OpenSSH
            timeout: 300
          become: false

- name: run insights
  hosts: "tupelo-rhel9-0.rhc.home.arpa"
  become: true
  gather_facts: false
  vars:
    insights_signature_exclude: /hosts,/vars/insights_signature
    insights_signature: !!binary |
      TFMwdExTMUNSVWRKVGlCUVIxQWdVMGxIVGtGVVZWSkZMUzB0TFMwS1ZtVnljMmx2YmpvZ1IyNTFV
      RWNnZGpFS0NtbFJTVlpCZDFWQldVaHBRaXR6ZG5jMU9FUXJhalZ3VGtGUmFXdDRaeTh2WmtaRFoz
      QXlTblIxVEd0UU5qQnNTa3BZYm1GU1JGTjVjVVYwU0ZSNlRGY0tOVlZSVlc5MWEyUmpVRFJVUlZn
      d01EaDFhRkJHUzFaSmVrdFVTR2RsYTFOaU1UUXlkMjlQYm5sR2VUUnpRbEJrZEZoaGREVlliWEp0
      VGxsR1EwaEVWZ28xYVhSdlNrcDBPVzg1UWtkQlJVaDVZMFJ3SzBoNVNqWXphM0paZVRGUk1rOXVU
      azF3VjJaSmNtYzJUakJXVTJoa1JtVk1lR0ppTjBaMlpFaEpjbFo2Q2pJNGFrdHhOemx1Tm13eUx6
      aDZZVkJSTDFkWVZIWkNaMDVhUkVWTFJ6TmhSSFl3WVRkbWIyUnlPRWhEZGxseE5tNUhNRkZOY1RO
      U1ZFOXBkbFZtTTFnS1JuQnlhVTh2TDNKSlRDOVlSelE1TTA1NGFWSjBRakVyZEhSUk0wZHNhM1ZE
      ZFVwck1EQkdaREp0ZDNZNFprRnZaR2xUUW5aelQydEpZekZyV25adFN3cEJjR3BEY1ZKMWVHaExU
      MDgzYWxZM1FYSnRTV0p6TkhobVJrUkJVMkZaV2t4R01VMHZhME42ZWs1d1MwTjFhbE5hVUUxRlVt
      WlhhV2RHVGpGMWRqRjNDalpQSzB0b1pTdFJVRU5hUm5CV1kwVndSbTFSTVdwcWFrOVFPV2haSzNW
      alZWSnhSVEkyTlhGTWRuWnFSWE4wUW5WQk4xQkZNRVZ3UkRsaU5VaFZSM1lLTkZKemJXc3pNbFpC
      Vnl0WE5IWk1VRWQwZG1sQ00wSXpUbE0wZUhCdVIzSmlObGs1Y1cwNFZuVTJSRUZIV2xOYWRsbFlk
      bWQwTm1WR2N6RTVTVFZZUWdvMGVtcFVSRUlyTW1sT2NrcE9jM2d5YURoU1VGVnJMMmhZUzFKMGEy
      WnZZMlpKZVRkcGNWY3hiMGRsTlZSMmFqTTFSbXRqUld0YU9VRnpSMjl6WXpWMENuUlZkVlZJWWpS
      ME5EVTFSSE5EWlZWc1ZEZFNOakJDTTB4d1Z6TmlTRTF0YzFCMEx6RktNRFEwYm1KS2RFTkhUM1Jy
      UVVWWVRsVTJlbGxUTDNBMFFqSUtaSFYxY2tZdlNHUnFWWFJNVDNSdlNFTnlZVWd2WkZwaFRVNTZk
      MVZpZUc1VFZXUkdZU3R6TTBaNFJHczFVVkU0VVRaMVVucFpRbWw0WkcxeWREZGpUQXBKYTA1NlEy
      aHBRMDlrY3owS1BVMVZOMk1LTFMwdExTMUZUa1FnVUVkUUlGTkpSMDVCVkZWU1JTMHRMUzB0Q2c9
      PQ==
  tasks:
    - name: run insights
      command: insights-client
      changed_when: false