5.6 | Ensure access to the su command is restricted tasks do not account for lines commented out in pam.d

[jrbeilke]

The tasks for this CIS criteria first grep the /etc/pam.d/su file, and do not take into account a line that may be commented out, so the tasks get skipped ie.
# auth required pam_wheel.so

      - name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted | Check for pam_wheel.so module"
        command: grep 'auth.*required.*pam_wheel' /etc/pam.d/su
        changed_when: false
        failed_when: false
        register: ubtu18cis_5_6_pam_wheel_status

      - name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted | Set pam_wheel if does not exist"
        lineinfile:
            path: /etc/pam.d/su
            line: 'auth       required   pam_wheel.so use_uid group={{ ubtu18cis_su_group }}'
            create: yes
        when: ubtu18cis_5_6_pam_wheel_status.stdout == ""

Seems an update is needed to check if the line is commented out and uncomment it so that the control is applied properly.

[jrbeilke]

FYI here is an example from the GSA how they handle this criteria in their role using lineinfile:
https://github.com/GSA/ansible-os-ubuntu18/blob/master/tasks/section5.yml#L809

- name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted"
  lineinfile:
      state: present
      dest: /etc/pam.d/su
      regexp: '^(#)?auth\s+required\s+pam_wheel\.so'
      line: "auth           required        pam_wheel.so use_uid"
  when:
      - ubuntu1804cis_rule_5_6
  tags:
      - level1
      - patch
      - rule_5.6
      - scored

[georgenalen]

Hello,
Thanks for raising the issue. I have added a little more robust regex to control a bit more of what it is looking for. One issue I discovered is if there are no existing or commented out instances where do we put the line. With that I noticed that there was an error in the task where it was always going at the bottom of the file, which is the wrong place for that required pam_wheel element. Since rootok should generally be there I have it inserting below that if there are no instances of auth required pam_wheel. Thanks for raising the issue and I will close this ticket once I get it into devel. Thanks again

George