Added node read rule.
[ta/caas-security.git] / ansible / roles / hardening / tasks / hardening.yaml
1 ---
2 # Copyright 2019 Nokia
3 #
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
7 #
8 #     http://www.apache.org/licenses/LICENSE-2.0
9 #
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
15
16 - name: set /etc/openssl directory with proper rights
17   file:
18     path: /etc/openssl
19     state: directory
20     mode: 0755
21
22 - name: templating path hardener profile.d script
23   template:
24     src: hardened_path.sh
25     dest: /etc/profile.d/hardened_path.sh
26     mode: 0644
27
28 - name: removing root spool/mail if exists
29   file:
30     path: /var/spool/mail/root
31     state: absent
32
33 - name: creating root spool/mail
34   file:
35     path: /var/spool/mail/root
36     state: directory
37     mode: 0660
38     owner: root
39     group: mail
40
41 - name: removing unused users
42   user:
43     name: "{{ item }}"
44     state: absent
45     remove: yes # deletes home, spool etc
46   ignore_errors: yes # sometimes spool not exists, sometimes group is not primary.
47   with_items:
48     - "lp"
49     - "operator"
50     - "games"
51     - "ftp"
52
53 - name: remove not needed user groups
54   group:
55     name: "{{ item }}"
56     state: absent
57   with_items:
58     - "cdrom"
59     - "floppy"
60     - "games"
61     - "tape"
62
63 - name: system uids to 999 instead of 199
64   replace:
65     dest: /etc/profile
66     regexp: 'if \[ \$UID -gt 199 \]'
67     replace: 'if [ $UID -gt 999 ]'
68
69 - name: Removing home per bin from path in skeleton and in the already existing root
70   lineinfile:
71     dest: "{{ item }}"
72     state: absent
73     regexp: '^PATH=.*$HOME/bin'
74   with_items:
75     - /etc/skel/.bash_profile
76     - /root/.bash_profile
77
78 - name: create /etc/cron.allow with root
79   copy:
80     content: 'root'
81     dest: /etc/cron.allow
82     owner: root
83     group: root
84     mode: 0600
85     force: yes
86
87 - name: remove linked files
88   file:
89     path: "{{ item }}"
90     state: absent
91   with_items:
92     - /etc/prelink.conf.d/fipscheck.conf
93     - /etc/prelink.conf.d/grub2.conf
94     - /etc/prelink.conf.d/nss-softokn-prelink.conf
95
96 - name: change auditd config
97   lineinfile:
98     dest: /etc/audit/auditd.conf
99     state: present
100     regexp: '^ *{{ item.key }} *=.+$'
101     line: '{{ item.key }} = {{ item.val }}'
102   with_items:
103     - key: num_logs
104       val: 10
105     - key: max_log_file
106       val: 15
107
108 - name: No root login access on terminals /etc/securetty
109   copy:
110     content: 'console'
111     dest: /etc/securetty
112     force: yes