diff --git a/tasks/rhel7stig/main.yml b/tasks/rhel7stig/main.yml index 85ce01b7..f8696a90 100644 --- a/tasks/rhel7stig/main.yml +++ b/tasks/rhel7stig/main.yml @@ -49,13 +49,22 @@ - always - skip_ansible_lint -- name: Get a list of users on the system to use throughout the auth tasks - action: get_users +- name: Get user data for all users on the system + get_users: + min_uid: 0 register: user_list check_mode: no tags: - always +- name: Get user data for all interactive users on the system + get_users: + min_uid: "{{ security_interactive_user_minimum_uid }}" + register: interactive_user_list + check_mode: no + tags: + - always + # Package installations and removals must come first so that configuration # changes can be made later. - include: packages.yml diff --git a/vars/debian.yml b/vars/debian.yml index 0b7b56b0..6fae2c07 100644 --- a/vars/debian.yml +++ b/vars/debian.yml @@ -46,6 +46,9 @@ clamav_service: clamav-daemon grub_update_cmd: "/usr/sbin/update-grub" ssh_keysign_path: /usr/lib/openssh +# Other configuration +security_interactive_user_minimum_uid: 500 + # RHEL 6 STIG: Packages to add/remove stig_packages: - packages: diff --git a/vars/redhat.yml b/vars/redhat.yml index 46ea83ec..8c32021f 100644 --- a/vars/redhat.yml +++ b/vars/redhat.yml @@ -43,6 +43,9 @@ clamav_service: 'clamd@scan' grub_update_cmd: "/usr/sbin/grub2-mkconfig -o {{ grub_config_file_boot }}" ssh_keysign_path: /usr/libexec/openssh +# Other configuration +security_interactive_user_minimum_uid: 1000 + # RHEL 6 STIG: Packages to add/remove stig_packages: - packages: