5.6.1.1 Adding solution for users with passwords.

defaults/main.yml

@@ -601,6 +601,10 @@ rhel9cis_pass:
     min_days: 7
     warn_age: 7
 
+# 5.6.1.1/2 Variable to be adjust so the rule sets password min/max
+# This refers to the minimum UID that rule will start from
+usr_min_uid: 1000
+
 # 5.5.1
 ## PAM
 rhel9cis_pam_password:

tasks/post.yml

@@ -26,6 +26,19 @@
       - not system_is_container
       - "'procps-ng' in ansible_facts.packages"
 
+- name: POST | Update usr sysctl
+  ansible.builtin.lineinfile:
+      dest: /usr/lib/sysctl.d/50-default.conf
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+  loop:
+      - { regexp: '^net.ipv4.conf.default.rp_filter', line: 'net.ipv4.conf.default.rp_filter = 1' }
+      - { regexp: '^net.ipv4.conf.*.rp_filter', line: 'net.ipv4.conf.*.rp_filter = 1' }
+  when:
+      - rhel9cis_sysctl_update
+      - not system_is_container
+      - "'procps-ng' in ansible_facts.packages"
+
 - name: Flush handlers
   ansible.builtin.meta: flush_handlers
 

tasks/section_5/cis_5.2.x.yml

@@ -91,7 +91,7 @@
             line: "AllowGroups {{ rhel9cis_sshd['allowgroups'] }}"
             validate: sshd -t -f %s
         notify: Restart sshd
-        when: "rhel9cis_sshd['allowgroups']|default('') | length > 0"
+        when: "rhel9cis_sshd['allowgroups']| default('')| length > 0"
 
       - name: "5.2.4 | PATCH | Ensure SSH access is limited | Add line to sshd_config for denyusers"
         ansible.builtin.lineinfile:
@@ -278,7 +278,7 @@
 - name: "5.2.15 | PATCH | Ensure SSH warning banner is configured"
   ansible.builtin.lineinfile:
       path: "{{ rhel9_cis_sshd_config_file }}"
-      regexp: '^Banner'
+      regexp: "^#Banner|^Banner"
       line: 'Banner /etc/issue.net'
   when:
       - rhel9cis_rule_5_2_15
@@ -354,14 +354,14 @@
       - name: "5.2.20 | PATCH | Ensure SSH Idle Timeout Interval is configured | Add line in sshd_config for ClientAliveInterval"
         ansible.builtin.lineinfile:
             path: "{{ rhel9_cis_sshd_config_file }}"
-            regexp: '^ClientAliveInterval'
+            regexp: '^ClientAliveInterval|^#ClientAliveInterval'
             line: "ClientAliveInterval {{ rhel9cis_sshd['clientaliveinterval'] }}"
             validate: sshd -t -f %s
 
       - name: "5.2.20 | PATCH | Ensure SSH Idle Timeout Interval is configured | Ensure SSH ClientAliveCountMax set to <= 3"
         ansible.builtin.lineinfile:
             path: "{{ rhel9_cis_sshd_config_file }}"
-            regexp: '^ClientAliveCountMax'
+            regexp: '^ClientAliveCountMax|^#ClientAliveCountMax'
             line: "ClientAliveCountMax {{ rhel9cis_sshd['clientalivecountmax'] }}"
             validate: sshd -t -f %s
   when:

tasks/section_5/cis_5.6.1.x.yml

@@ -28,6 +28,29 @@
       - password
       - rule_5.6.1.2
 
+- name: "5.6.1.1/2 | PATCH | Set existing users with password rules"
+  block:
+      - name: "5.6.1.1/2 | AUDIT | Get existing users"
+        ansible.builtin.getent:
+            database: passwd
+
+      - name: "5.6.1.1/2 | PATCH | Update users higher than usr_min_uid"
+        ansible.builtin.user:
+          name: "{{ item }}"
+          password_expire_min: "{{ rhel9cis_pass['min_days'] }}"
+          password_expire_max: "{{ rhel9cis_pass['max_days'] }}"
+        loop: "{{ getent_passwd | dict2items | map(attribute='key') | list  }}"
+        when: getent_passwd[item].1 | int >= usr_min_uid
+  when:
+      - rhel9cis_rule_5_6_1_2
+      - rhel9cis_rule_5_6_1_2_set_user
+  tags:
+      - level1-server
+      - level1-workstation
+      - patch
+      - password
+      - rule_5.6.1.2
+
 - name: "5.6.1.3 | PATCH | Ensure password expiration warning days is 7 or more"
   ansible.builtin.lineinfile:
       path: /etc/login.defs

tasks/section_5/cis_5.6.x.yml

@@ -98,6 +98,11 @@
             regexp: '^USERGROUPS_ENAB'
             line: USERGROUPS_ENAB no
 
+      - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask sessions /etc/pam.d/system-auth"
+        ansible.builtin.lineinfile:
+            path: /etc/pam.d/system-auth
+            line: 'session     required            pam_umask.so'
+            insertafter: EOF
   when:
       - rhel9cis_rule_5_6_5
   tags:

vars/RedHat.yml

@@ -6,3 +6,22 @@ os_gpg_key_pubkey_content: "Red Hat, Inc. (release key 2) <[email protected]>
 
 # disable repo_gpgcheck due to OS default repos
 rhel9cis_rule_enable_repogpg: false
+
+# enable interactive users to be set min/max password change
+rhel9cis_rule_5_6_1_2_set_user: true
+
+# 5.6.1.1/2 Variable to be adjust so the rule sets password min/max
+# This refers to the minimum UID that rule will start from
+usr_min_uid: 1000
+
+# Vars setup for overiding main.yml for rule 5.3.2 
+rhel9cis_sshd:
+    clientalivecountmax: 3
+    clientaliveinterval: 900
+    logingracetime: 60
+    # Group and user choose as being the default for this release
+    # Can also use;
+    # allowusers: 
+    # denygroups:
+    allowgroups: wheel
+    denyusers: nobody