cis_6.2.x.yml

---

- name: "6.2.1 | AUDIT | Ensure accounts in /etc/passwd use shadowed passwords"
  when:
      - rhel7cis_rule_6_2_1
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - NIST800-53R5_IA-5
      - rule_6.2.1
      - user_accounts
  vars:
      warn_control_id: '6.2.1'
  block:
      - name: "6.2.1 | AUDIT | Ensure accounts in /etc/passwd use shadowed passwords | Get users not using shadowed passwords"
        ansible.builtin.shell: awk -F':' '($2 != "x" ) { print $1}' /etc/passwd
        changed_when: false
        failed_when: false
        register: rhel7cis_6_2_1_nonshadowed_users

      - name: "6.2.1 | AUDIT | Ensure accounts in /etc/passwd use shadowed passwords | Warn on findings"
        when: rhel7cis_6_2_1_nonshadowed_users.stdout | length > 0
        ansible.builtin.debug:
            msg:
                - "Warning!! You have users that are not using a shadowed password. Please convert the below accounts to use a shadowed password"
                - "{{ rhel7cis_6_2_1_nonshadowed_users.stdout_lines }}"

      - name: "6.2.1 | WARN | Ensure accounts in /etc/passwd use shadowed passwords | warn_count"
        when: rhel7cis_6_2_1_nonshadowed_users.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.2 | PATCH | Ensure /etc/shadow password fields are not empty"
  when:
      - rhel7cis_rule_6_2_2
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - rule_6.2.2
      - NIST800-53R5_IA-5
      - user
      - permissions
  block:
      - name: "6.2.2 | AUDIT | Ensure /etc/shadow password fields are not empty | Find users with no password"
        ansible.builtin.shell: awk -F":" '($2 == "" ) { print $1 }' /etc/shadow
        changed_when: false
        check_mode: false
        register: rhel7cis_6_2_2_empty_password_acct

      - name: "6.2.2 | PATCH | Ensure /etc/shadow password fields are not empty | Lock users with empty password"
        when: rhel7cis_6_2_2_empty_password_acct.stdout | length > 0
        ansible.builtin.user:
            name: "{{ item }}"
            password_lock: true
        loop:
            - "{{ rhel7cis_6_2_2_empty_password_acct.stdout_lines }}"

- name: "6.2.3 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group"
  when:
      - rhel7cis_rule_6_2_3
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - rule_6.2.3
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - groups
  vars:
      warn_control_id: '6.2.3'
  block:
      - name: "6.2.3 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Check /etc/passwd entries"
        ansible.builtin.shell: pwck -r | grep 'no group' | awk '{ gsub("[:\47]",""); print $2}'
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel7cis_6_2_3_passwd_gid_check

      - name: "6.2.3 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Print warning about users with invalid GIDs missing GID entries in /etc/group"
        when: rhel7cis_6_2_3_passwd_gid_check.stdout | length > 0
        ansible.builtin.debug:
            msg: "Warning!! The following users have non-existent GIDs (Groups): {{ rhel7cis_6_2_3_passwd_gid_check.stdout_lines | join (', ') }}"

      - name: "6.2.3 | WARN | Ensure all groups in /etc/passwd exist in /etc/group | warn_count"
        when: rhel7cis_6_2_3_passwd_gid_check.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.4 | AUDIT | Ensure no duplicate UIDs exist"
  when:
      - rhel7cis_rule_6_2_4
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.4
      - user
  vars:
      warn_control_id: '6.2.4'
  block:
      - name: "6.2.4 | AUDIT | Ensure no duplicate UIDs exist | Check for duplicate UIDs"
        ansible.builtin.shell: "pwck -r | awk -F: '{if ($3 in uid) print $1 ; else uid[$3]}' /etc/passwd"
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel7cis_6_2_4_user_uid_check

      - name: "6.2.4 | AUDIT | Ensure no duplicate UIDs exist | Print warning about users with duplicate UIDs"
        when: rhel7cis_6_2_4_user_uid_check.stdout | length > 0
        ansible.builtin.debug:
            msg: "Warning!! The following users have UIDs that are duplicates: {{ rhel7cis_6_2_4_user_uid_check.stdout_lines }}"

      - name: "6.2.4 | AUDIT | Ensure no duplicate UIDs exist | Set warning count"
        when: rhel7cis_6_2_4_user_uid_check.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.5 | AUDIT | Ensure no duplicate GIDs exist"
  when:
      - rhel7cis_rule_6_2_5
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.5
      - groups
  vars:
      warn_control_id: '6.2.5'
  block:
      - name: "6.2.5 | AUDIT | Ensure no duplicate GIDs exist | Check for duplicate GIDs"
        ansible.builtin.shell: "pwck -r | awk -F: '{if ($3 in users) print $1 ; else users[$3]}' /etc/group"
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel7cis_6_2_5_user_user_check

      - name: "6.2.5 | AUDIT | Ensure no duplicate GIDs exist | Print warning about users with duplicate GIDs"
        when: rhel7cis_6_2_5_user_user_check.stdout | length > 0
        ansible.builtin.debug:
            msg: "Warning!! The following groups have duplicate GIDs: {{ rhel7cis_6_2_5_user_user_check.stdout_lines }}"

      - name: "6.2.5 | AUDIT | Ensure no duplicate GIDs exist | Set warning count"
        when: rhel7cis_6_2_5_user_user_check.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.6 | AUDIT | Ensure no duplicate user names exist"
  vars:
      warn_control_id: '6.2.6'
  when:
      - rhel7cis_rule_6_2_6
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - rule_6.2.6
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - user
  block:
      - name: "6.2.6 | AUDIT | Ensure no duplicate user names exist | Check for duplicate User Names"
        ansible.builtin.shell: "pwck -r | awk -F: '{if ($1 in users) print $1 ; else users[$1]}' /etc/passwd"
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel7cis_6_2_6_username_check

      - name: "6.2.6 | WARN | Ensure no duplicate user names exist | Print warning about users with duplicate User Names"
        when: rhel7cis_6_2_6_username_check.stdout | length > 0
        ansible.builtin.debug:
            msg: "Warning!! The following user names are duplicates: {{ rhel7cis_6_2_6_user_username_check.stdout_lines }}"

      - name: "6.2.6 | WARN | Ensure no duplicate user names exist | Set warning count"
        when: rhel7cis_6_2_6_username_check.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.7 | AUDIT | Ensure no duplicate group names exist"
  when:
      - rhel7cis_rule_6_2_7
  tags:
      - level1-server
      - level1-workstation
      - automated
      - audit
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.7
      - groups
  vars:
      warn_control_id: '6.2.7'
  block:
      - name: "6.2.7 | AUDIT | Ensure no duplicate group names exist | Check for duplicate group names"
        ansible.builtin.shell: 'getent passwd | cut -d: -f1 | sort -n | uniq -d'
        changed_when: false
        failed_when: false
        check_mode: false
        register: rhel7cis_6_2_7_group_check

      - name: "6.2.7 | AUDIT | Ensure no duplicate group names exist | Print warning about users with duplicate group names"
        when: rhel7cis_6_2_7_group_check.stdout | length > 0
        ansible.builtin.debug:
            msg: "Warning!! The following group names are duplicates: {{ rhel7cis_6_2_7_group_group_check.stdout_lines }}"

      - name: "6.2.7 | AUDIT | Ensure no duplicate group names exist | Set warning count"
        when: rhel7cis_6_2_7_group_check.stdout | length > 0
        ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: "6.2.8 | PATCH | Ensure root PATH Integrity"
  when:
      - rhel7cis_rule_6_2_8
  tags:
      - level1-server
      - level1-workstation
      - patch
      - paths
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.8
  block:
      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Get root paths"
        ansible.builtin.shell: sudo -Hiu root env | grep '^PATH' | cut -d= -f2
        changed_when: false
        register: rhel7cis_6_2_8_root_paths

      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Get root paths"
        ansible.builtin.shell: sudo -Hiu root env | grep '^PATH' | cut -d= -f2 | tr ":" "\n"
        changed_when: false
        register: rhel7cis_6_2_8_root_paths_split

      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Set fact"
        ansible.builtin.set_fact:
            root_paths: "{{ rhel7cis_6_2_8_root_paths.stdout }}"

      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Check for empty dirs"
        ansible.builtin.shell: 'echo {{ root_paths }} | grep -q "::" && echo "roots path contains a empty directory (::)"'
        changed_when: false
        failed_when: rhel7cis_6_2_8_root_path_empty_dir.rc not in [ 0, 1 ]
        register: rhel7cis_6_2_8_root_path_empty_dir

      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Check for trailing ':'"
        ansible.builtin.shell: '{{ root_paths }} | cut -d= -f2 | grep -q ":$" && echo "roots path contains a trailing (:)"'
        changed_when: false
        failed_when: rhel7cis_6_2_8_root_path_trailing_colon.rc not in [ 0, 1 ]
        register: rhel7cis_6_2_8_root_path_trailing_colon

      - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Check for owner and permissions"
        block:
            - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Check for owner and permissions"
              ansible.builtin.stat:
                  path: "{{ item }}"
              register: rhel7cis_6_2_8_root_path_perms
              loop: "{{ rhel7cis_6_2_8_root_paths_split.stdout_lines }}"

            - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Set permissions"
              when:
                  - item.stat.exists
                  - item.stat.isdir
                  - item.stat.pw_name != 'root' or item.stat.gr_name != 'root' or item.stat.woth or item.stat.wgrp
                  - (item != 'root') and (not rhel7cis_uses_root)
              ansible.builtin.file:
                  path: "{{ item.stat.path }}"
                  state: directory
                  owner: root
                  group: root
                  mode: '0755'
                  follow: false
              loop: "{{ rhel7cis_6_2_8_root_path_perms.results }}"
              loop_control:
                  label: "{{ item }}"

- name: "6.2.9 | PATCH | Ensure root is the only UID 0 account"
  when:
      - discovered_uid_zero_accounts_except_root.rc
      - rhel7cis_rule_6_2_9
  tags:
      - level1-server
      - level1-workstation
      - patch
      - accounts
      - users
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.9
  ansible.builtin.shell: passwd -l {{ item }}
  changed_when: false
  failed_when: false
  loop: "{{ discovered_uid_zero_accounts_except_root.stdout_lines }}"

- name: "6.2.10 | PATCH | Ensure local interactive user home directories exist"
  when:
      - rhel7cis_rule_6_2_10
  tags:
      - level1-server
      - level1-workstation
      - patch
      - users
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.10
  block:
      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Create dir if absent"
        ansible.builtin.file:
            path: "{{ item.dir }}"
            state: directory
            owner: "{{ item.id }}"
            group: "{{ item.gid }}"
        register: rhel7cis_6_2_10_home_dir
        loop: "{{ rhel7cis_passwd  | selectattr('uid', '>=', rhel7uid_interactive_uid_start | int ) | selectattr('uid', '<=', rhel7uid_interactive_uid_stop | int ) | list }}"
        loop_control:
            label: "{{ item.id }}"

      - name: "6.2.10 | AUDIT | Ensure local interactive user home directories exist | get perms stat"
        ansible.builtin.stat:
            path: "{{ item }}"
        register: rhel7cis_6_2_10_home_dir_perms
        loop: "{{ discovered_interactive_users_home.stdout_lines }}"

      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | set perms if needed"
        ansible.builtin.file:
            path: "{{ item.stat.path }}"
            state: directory
            mode: g-w,o-rwx
        loop: "{{ rhel7cis_6_2_10_home_dir_perms.results }}"
        loop_control:
            label: "{{ item }}"

      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | own their home directories"
        when:
            - item.uid >= rhel7uid_interactive_uid_start | int
            - item.id != 'nobody'
            - (item.id != 'tss' and item.dir != '/dev/null')
            - item.shell != '/sbin/nologin'
        ansible.builtin.file:
            path: "{{ item.dir }}"
            owner: "{{ item.id }}"
            state: directory
        loop: "{{ rhel7cis_passwd | selectattr('uid', '>=', rhel7uid_interactive_uid_start | int ) | selectattr('uid', '<=', rhel7uid_interactive_uid_stop | int ) | list }}"
        loop_control:
            label: "{{ item.id }}"

      # set default ACLs so the homedir has an effective umask of 0027
      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set group ACL"
        ansible.posix.acl:
            path: "{{ item }}"
            default: true
            etype: group
            permissions: rx
            state: present
        loop: "{{ discovered_interactive_users_home.stdout_lines }}"

      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set other ACL"
        ansible.posix.acl:
            path: "{{ item }}"
            default: true
            etype: other
            permissions: 0
            state: present
        loop: "{{ discovered_interactive_users_home.stdout_lines }}"

- name: "6.2.11 | PATCH | Ensure local interactive user dot files access is configured"
  when:
      - rhel7cis_rule_6_2_11
      - rhel7cis_disruption_high
  tags:
      - level1-server
      - level1-workstation
      - automated
      - patch
      - NIST800-53R5_CM-1
      - NIST800-53R5_CM-2
      - NIST800-53R5_CM-6
      - NIST800-53R5_CM-7
      - NIST800-53R5_IA-5
      - rule_6.2.11
      - user
  vars:
      warn_control_id: '6.2.11'
  block:
      - name: "6.2.11 | AUDIT | Ensure local interactive user dot files access is configured | Check for files"
        ansible.builtin.shell: find /home/ -name "\.*" -perm /g+w,o+w
        changed_when: false
        failed_when: rhel7cis_6_2_11_audit.rc not in [ 0, 1 ]
        check_mode: false
        register: rhel7cis_6_2_11_audit

      - name: "6.2.11 | AUDIT | Ensure local interactive user dot files access is configured | Warning on files found"
        when:
            - rhel7cis_6_2_11_audit.stdout | length > 0
            - rhel7cis_dotperm_ansiblemanaged
        ansible.builtin.debug:
            msg:
                - "Warning!! You have group or world-writable dot files on your system and have configured for manual intervention"

      - name: "6.2.11 | PATCH | Ensure local interactive user dot files access is configured | Set warning count"
        when:
            - rhel7cis_6_2_11_audit.stdout | length > 0
            - rhel7cis_dotperm_ansiblemanaged
        ansible.builtin.import_tasks:
            file: warning_facts.yml

      - name: "6.2.11 | PATCH | Ensure local interactive user dot files access is configured | Changes files if configured"
        when:
            - rhel7cis_6_2_11_audit.stdout | length > 0
            - rhel7cis_dotperm_ansiblemanaged
        ansible.builtin.file:
            path: '{{ item }}'
            mode: go-w
        with_items: "{{ rhel7cis_6_2_11_audit.stdout_lines }}"