Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feb25 #329

Merged
merged 3 commits into from
Feb 11, 2025
Merged

Feb25 #329

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
68b7721
added fix from PR #317 thanks to @dglinder
uk-bolly Feb 11, 2025
257191b
added fix for PR #320 thanks to @davewujcik
uk-bolly Feb 11, 2025
e792e99
added fix for #327 thanks to @derekbentson
uk-bolly Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 8 additions & 26 deletions tasks/fix-cat2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2723,7 +2723,7 @@
- name: "MEDIUM | RHEL-08-010830 | PATCH | RHEL 8 must not allow users to override SSH environment variables."
ansible.builtin.lineinfile:
path: /etc/ssh/sshd_config
regexp: '(?i)^#?PermitUserEnvironment'
regexp: (?i)^\s*PermitUserEnvironment
line: 'PermitUserEnvironment no'
validate: '/usr/sbin/sshd -T -f %s'
notify: restart sshd
Expand Down Expand Up @@ -3286,7 +3286,7 @@
line: "{{ item.line }}"
loop:
- { regexp: '^(?#)\s*StopIdleSessionSec\s*=', line: "StopIdleSessionSec={{ rhel_08_020035_idlesessiontimeout }}" }
- { regexp: '^(?#)\s*KillUserProccesses\s*=', line: "KillUserProccesses=no" }
- { regexp: '^(?#)\s*KillUserProcesses\s*=', line: "KillUserProcesses=no" }
notify: Restart_systemdlogin
when:
- rhel_08_020035
Expand Down Expand Up @@ -6161,30 +6161,12 @@
"MEDIUM | RHEL-08-040120 | PATCH | RHEL 8 must mount /dev/shm with the nodev option."
"MEDIUM | RHEL-08-040121 | PATCH | RHEL 8 must mount /dev/shm with the nosuid option."
"MEDIUM | RHEL-08-040122 | PATCH | RHEL 8 must mount /dev/shm with the noexec option."
block:
- name: |
"MEDIUM | RHEL-08-040120 | AUDIT | RHEL 8 must mount /dev/shm with the nodev option."
"MEDIUM | RHEL-08-040121 | AUDIT | RHEL 8 must mount /dev/shm with the nosuid option."
"MEDIUM | RHEL-08-040122 | AUDIT | RHEL 8 must mount /dev/shm with the noexec option."
ansible.builtin.shell: mount | grep /dev/shm
changed_when: false
failed_when: false
register: rhel8stig_040120_dev_shm_status

- name: |
"MEDIUM | RHEL-08-040120 | PATCH | RHEL 8 must mount /dev/shm with the nodev option."
"MEDIUM | RHEL-08-040121 | PATCH | RHEL 8 must mount /dev/shm with the nosuid option."
"MEDIUM | RHEL-08-040122 | PATCH | RHEL 8 must mount /dev/shm with the noexec option."
ansible.posix.mount:
path: "{{ item.mount }}"
state: mounted
src: "{{ item.device }}"
fstype: "{{ item.fstype }}"
opts: "defaults{{ rhel_08_040120 | ternary (',nodev', '') }}{{ rhel_08_040121 | ternary (',nosuid', '') }}{{ rhel_08_040122 | ternary (',noexec', '') }}"
loop: "{{ ansible_facts.mounts }}"
when:
- item.mount == '/dev/shm'
- rhel8stig_040120_dev_shm_status.stdout | length > 0
ansible.posix.mount:
path: /dev/shm
state: mounted
src: tmpfs
fstype: tmpfs
opts: "defaults{{ rhel_08_040120 | ternary (',nodev', '') }}{{ rhel_08_040121 | ternary (',nosuid', '') }}{{ rhel_08_040122 | ternary (',noexec', '') }}"
when:
- rhel_08_040120 or
rhel_08_040121 or
Expand Down