ansible-hardening/tasks/misc.yml

---
# Copyright 2015, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: V-38489 - Install AIDE (with apt)
  apt:
      name: aide
      state: present
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat2
    - V-38489

- name: V-38489 - Install AIDE (with yum)
  yum:
      name: aide
      state: present
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat2
    - V-38489

- name: Verify that AIDE configuration directory exists
  stat:
    path: /etc/aide/aide.conf.d
  register: aide_conf
  always_run: true
  tags:
    - always

- name: V-38489 - Exclude certain directories from AIDE and initialize DB
  template:
    src: ZZ_aide_exclusions.j2
    dest: /etc/aide/aide.conf.d/ZZ_aide_exclusions
  when: aide_conf.stat.exists | bool
  notify:
    - initialize AIDE
  tags:
    - cat2
    - V-38489

- name: Check for AIDE cron job (for V-38670)
  stat:
    path: /etc/cron.daily/aide
  register: v38670_result
  changed_when: False
  tags:
    - cat2
    - V-38670

- name: V-38670 - System must detect unauthorized changes to software and information
  fail:
    msg: "FAILED: AIDE cron job is missing"
  when:
    - not check_mode
    - v38670_result.stat.exists == False
  tags:
    - cat2
    - V-38670

- name: Search for .netrc files (for V-38619)
  shell: find /root /home -xdev -name .netrc | wc -l
  register: v38619_result
  changed_when: False
  always_run: True
  tags:
    - cat2
    - V-38619

- name: V-38619 - There must be no .netrc files on the system
  fail:
    msg: "FAILED: .netrc files found -- they must be removed"
  when: v38619_result.stdout != '0'
  tags:
    - cat2
    - V-38619

- name: V-38620 - Synchronize system clock (installing chrony with apt)
  apt:
    name: chrony
    state: present
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat2
    - V-38620

- name: V-38620 - Synchronize system clock (installing chrony with yum)
  yum:
    name: chrony
    state: present
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat2
    - V-38620

- name: V-38620 - Synchronize system clock (enable chrony)
  service:
    name: chrony
    state: started
    enabled: yes
  when: not check_mode
  tags:
    - cat2
    - V-38620

- name: Check for chrony.conf
  stat:
    path: /etc/chrony/chrony.conf
  register: chrony_conf
  tags:
    - always
    - V-38620

- name: V-38620 - Synchronize system clock (configuration file)
  template:
    src: chrony.conf.j2
    dest: /etc/chrony/chrony.conf
  when: chrony_conf.stat.exists | bool
  notify:
    - restart chrony
  tags:
    - cat2
    - V-38620

# The STIG only requires that logrotate is installed and configured in cron.
# The openstack-ansible project will configure logs to be rotated weekly and
# compressed with each run. We won't change the interval here, but we will
# ensure that logrotate is installed (to meet the STIG requirement).
- name: V-38624 - System logs must be rotated daily (install logrotate with apt)
  apt:
    name: logrotate
    state: present
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat3
    - V-38624

- name: V-38624 - System logs must be rotated daily (install logrotate with yum)
  yum:
    name: logrotate
    state: present
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat3
    - V-38624

- name: Check for logrotate cron job (for V-38624)
  stat:
    path: /etc/cron.daily/logrotate
  register: v38624_result
  tags:
    - cat3
    - V-38624

- name: V-38624 - System logs must be rotated daily (verify cron job)
  fail:
    msg: "FAILED: Cron job for logrotate is missing"
  when:
    - not check_mode
    - not v38624_result.stat.exists | bool
  tags:
   - cat3
   - V-38624

- name: Check if samba is installed (for V-38656)
  stat:
    path: /etc/samba/smb.conf
  register: v38656_result
  changed_when: false
  tags:
    - cat3
    - V-38656

- name: V-38656 - System must use SMB client signing
  lineinfile:
    dest: /etc/samba/smb.conf
    regexp: "^(;)?client signing"
    line: "client signing = mandatory"
    insertafter: "############ Misc ############"
  when: v38656_result.stat.exists | bool
  notify:
    - restart samba
  tags:
    - cat3
    - V-38656

- name: Check if SNMP daemon is installed using dpkg (for V-38660)
  shell: "dpkg --status snmpd | grep \"^Status:.*ok installed\""
  register: v38660_snmpd_apt
  changed_when: False
  failed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat2
    - V-38660

- name: Check if SNMP daemon is installed using rpm (for V-38660)
  shell: "rpm -qi net-snmp"
  register: v38660_snmpd_rpm
  changed_when: False
  failed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat2
    - V-38660

- name: Set fact for SNMP being installed
  set_fact:
    snmpd_installed: True
  when: |
    (v38660_snmpd_apt.rc is defined and v38660_snmpd_apt.rc == 0) or
    (v38660_snmpd_rpm.rc is defined and v38660_snmpd_rpm.rc == 0)

# We shouldn't get any output from this grep since it looks for configuration
# lines for the SNMP v1 and v2c protocols.
- name: Check for insecure SNMP protocols (for V-38660)
  shell: "egrep 'v1|v2c|com2sec|community' /etc/snmp/snmpd.conf | grep -v '^\\s*#'"
  register: v38660_result
  changed_when: False
  failed_when: False
  always_run: True
  when:
    - snmpd_installed is defined
    - snmpd_installed | bool
  tags:
    - cat2
    - V-38660

- name: V-38660 - The snmpd service must only use SNMPv3 or newer
  fail:
    msg: "FAILED: Insecure SNMP configuration found -- use SNMPv3 only"
  when:
    - not check_mode
    - snmpd_installed is defined
    - snmpd_installed | bool
    - v38660_result.rc == 0
  tags:
    - cat2
    - V-38660

- name: V-38675 - Process core dump must be disabled
  lineinfile:
    dest: /etc/security/limits.d/V-38675-coredump.conf
    line: "* hard core 0"
    create: yes
  when: security_disable_core_dumps is defined
  tags:
    - cat3
    - V-38675

- name: V-38684 - Maximum simultaneous logins per user
  lineinfile:
    dest: /etc/security/limits.d/V-38684-maxlogins.conf
    line: "* hard maxlogins {{ security_max_simultaneous_logins }}"
    create: yes
  when: security_max_simultaneous_logins is defined
  tags:
    - cat3
    - V-38684

- name: Check if vsftpd installed using dpkg (for V-38599 and V-38702)
  shell: "dpkg --status vsftpd | grep \"^Status:.*ok installed\""
  register: v38599_vsftpd_apt
  changed_when: False
  failed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat2
    - cat3
    - V-38599
    - V-38702

- name: Check if vsftpd installed using rpm (for V-38599 and V-38702)
  shell: "rpm -qi vsftpd"
  register: v38599_vsftpd_rpm
  changed_when: False
  failed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat2
    - cat3
    - V-38599
    - V-38702

- name: Set fact for vsftpd being installed
  set_fact:
    vsftpd_installed: True
  when: |
    (v38599_vsftpd_apt.rc is defined and v38599_vsftpd_apt.rc == 0) or
    (v38599_vsftpd_rpm.rc is defined and v38599_vsftpd_rpm.rc == 0)

- name: Copy login banner (for V-38599)
  copy:
    src: login_banner.txt
    dest: /etc/issue.net
  when:
    - vsftpd_installed is defined
    - vsftpd_installed | bool
  notify:
    - restart vsftpd
  tags:
    - cat2
    - V-38599

- name: V-38599 - Set warning banner for FTPS/FTP logins
  lineinfile:
    dest: "{{ vsftpd_conf_file }}"
    regexp: "^(#)?banner_file"
    line: "banner_file=/etc/issue.net"
  when:
    - vsftpd_installed is defined
    - vsftpd_installed | bool
  notify:
    - restart vsftpd
  tags:
   - cat2
   - V-38599

- name: V-38702 - Enable xferlog
  lineinfile:
    dest: "{{ vsftpd_conf_file }}"
    regexp: "^(#)?xferlog_enable"
    line: "xferlog_enable=YES"
  when:
    - vsftpd_installed is defined
    - vsftpd_installed | bool
  notify:
    - restart vsftpd
  tags:
   - cat3
   - V-38702

- name: V-38702 - Disable xferlog_std_format
  lineinfile:
    dest: "{{ vsftpd_conf_file }}"
    regexp: "^(#)?xferlog_std_format"
    line: "xferlog_std_format=NO"
  when:
    - vsftpd_installed is defined
    - vsftpd_installed | bool
  notify:
    - restart vsftpd
  tags:
   - cat3
   - V-38702

- name: V-38702 - Enable log_ftp_protocol
  lineinfile:
    dest: "{{ vsftpd_conf_file }}"
    regexp: "^(#)?log_ftp_protocol"
    line: "log_ftp_protocol=YES"
  when:
    - vsftpd_installed is defined
    - vsftpd_installed | bool
  notify:
    - restart vsftpd
  tags:
   - cat3
   - V-38702

- name: Check for default runlevel (for V-38674)
  shell: "grep 'DEFAULT_RUNLEVEL=2' /etc/init/rc-sysinit.conf"
  register: v38674_result
  changed_when: False
  always_run: True
  when: not systemd_running | bool
  tags:
    - cat2
    - V-38674

- name: V-38674 - X Windows must not be enabled
  fail:
    msg: "FAILED: Default runlevel should be 2 (no X windows)"
  when:
    - not systemd_running | bool
    - v38674_result.rc != 0
  tags:
    - cat2
    - V-38674

- name: Check if systemd is configured to load the graphical target
  shell: "systemctl list-units --type=target | grep '^graphical.target.*loaded active active'"
  register: v38674_result
  always_run: True
  failed_when: v38674_result.rc > 1
  when: systemd_running | bool
  tags:
    - cat2
    - V-38674

- name: V-38674 - X Windows must not be enabled
  fail:
    msg: "FAILED: Graphical target must not be enabled in systemd."
  when:
    - systemd_running | bool
    - v38674_result.rc == 0
  tags:
    - cat2
    - V-38674

- name: Check if AppArmor is running (for V-51337)
  shell: "apparmor_status 2>&1 | head -n 1"
  register: v51337_result
  changed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'apt'
  tags:
    - cat2
    - V-51337

- name: V-51337 - The system must use a Linux Security Module at boot time
  fail:
    msg: "FAILED: AppArmor isn't enabled"
  when:
    - ansible_pkg_mgr == 'apt'
    - "'apparmor module is loaded' not in v51337_result.stdout"
  tags:
    - cat2
    - V-51337


- name: Check if SELinux is enforcing (for V-51337)
  command: getenforce
  register: v51337_result
  changed_when: False
  always_run: True
  when: ansible_pkg_mgr == 'yum'
  tags:
    - cat2
    - V-51337

- name: V-51337 - The system must use a Linux Security Module at boot time
  fail:
    msg: "FAILED: SELinux is not in enforcing mode."
  when:
    - ansible_pkg_mgr == 'yum'
    - "'Enforcing' not in v51337_result.stdout"
  tags:
    - cat2
    - V-51337