section5.yml

- name: "SCORED | 5.1.1 | PATCH | Ensure cron daemon is enabled"
  systemd:
      name: crond
      enabled: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
      - level1
      - patch
      - rule_5.1.1

- name: "SCORED | 5.1.2 | PATCH | Ensure permissions on /etc/crontab are configured"
  file:
      dest: /etc/crontab
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
      - level1
      - patch
      - rule_5.1.2

- name: "SCORED | 5.1.3 | PATCH | Ensure permissions on /etc/cron.hourly are configured"
  file:
      dest: /etc/cron.hourly
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.3

- name: "SCORED | 5.1.4 | PATCH | Ensure permissions on /etc/cron.daily are configured"
  file:
      dest: /etc/cron.daily
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.4

- name: "SCORED | 5.1.5 | PATCH | Ensure permissions on /etc/cron.weekly are configured"
  file:
      dest: /etc/cron.weekly
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.5

- name: "SCORED | 5.1.6 | PATCH | Ensure permissions on /etc/cron.monthly are configured"
  file:
      dest: /etc/cron.monthly
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.6

- name: "SCORED | 5.1.7 | PATCH | Ensure permissions on /etc/cron.d are configured"
  file:
      dest: /etc/cron.d
      state: directory
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.7

- name: "SCORED | 5.1.8 | PATCH | Ensure at/cron is restricted to authorized users"
  file:
      dest: /etc/at.deny
      state: absent
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.8

- name: "SCORED | 5.1.8 | PATCH | Ensure at/cron is restricted to authorized users"
  file:
      dest: /etc/at.allow
      state: touch
      owner: root
      group: root
      mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.8

- name: "SCORED | 5.1.8 | PATCH | Ensure at/cron is restricted to authorized users"
  file:
    dest: /etc/cron.deny
    state: absent
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.8

- name: "SCORED | 5.1.8 | PATCH | Ensure at/cron is restricted to authorized users"
  file:
    dest: /etc/cron.allow
    state: touch
    owner: root
    group: root
    mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.1.8

- name: "SCORED | 5.2.1 | PATCH | Ensure permissions on /etc/ssh/sshd_config are configured"
  file:
    dest: /etc/ssh/sshd_config
    state: file
    owner: root
    group: root
    mode: 0600
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.1

- name: "SCORED | 5.2.2 | PATCH | Ensure SSH Protocol is set to 2"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^Protocol'
    line: 'Protocol 2'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.2

- name: "SCORED | 5.2.3 | PATCH | Ensure SSH LogLevel is set to INFO"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^LogLevel'
    line: 'LogLevel INFO'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.3

- name: "SCORED | 5.2.4 | PATCH | Ensure SSH X11 forwarding is disabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^X11Forwarding'
    line: 'X11Forwarding no'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.4

- name: "SCORED | 5.2.5 | PATCH | Ensure SSH MaxAuthTries is set to 4 or less"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^(#)?MaxAuthTries \d'
    line: 'MaxAuthTries 4'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.5

- name: "SCORED | 5.2.6 | PATCH | Ensure SSH IgnoreRhosts is enabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^IgnoreRhosts'
    line: 'IgnoreRhosts yes'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.6

- name: "SCORED | 5.2.7 | PATCH | Ensure SSH HostbasedAuthentication is disabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^HostbasedAuthentication'
    line: 'HostbasedAuthentication no'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.7

- name: "SCORED | 5.2.8 | PATCH | Ensure SSH root login is disabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^PermitRootLogin'
    line: 'PermitRootLogin no'
  when:
    - centos7cis_permit_ssh_root_login_disabled is defined and centos7cis_permit_ssh_root_login_disabled
  tags:
    - level1
    - patch
    - rule_5.2.8

- name: "SCORED | 5.2.9 | PATCH | Ensure SSH PermitEmptyPasswords is disabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^PermitEmptyPasswords'
    line: 'PermitEmptyPasswords no'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.9

- name: "SCORED | 5.2.10 | PATCH | Ensure SSH PermitUserEnvironment is disabled"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^PermitUserEnvironment'
    line: 'PermitUserEnvironment no'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.10

# Removed 5.2.11 from CIS Benchmark
# - name: "SCORED | 5.2.11 | PATCH | Ensure only approved ciphers are used"
#   lineinfile:
#       state: present
#       dest: /etc/ssh/sshd_config
#       regexp: '^Ciphers'
#       line: 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr'
#   tags:
#       - level1
#       - level2
#       - medium
#       - patch
#       - rule_5.2.11

- name: "SCORED | 5.2.11 | PATCH | Ensure only approved MAC algorithms are used"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^MACs'
    line: 'MACs {{ centos7cis_ssh_mac_algorithms | quote }}'
    #line: 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ssh_mac_algorithms is defined
  tags:
    - level1
    - patch
    - rule_5.2.11

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  lineinfile:
    state: absent
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveInterval (?!300)'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveInterval(.*)?$'
    line: 'ClientAliveInterval 300'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  replace:
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveInterval(.*)?$'
    replace: 'ClientAliveInterval 300'
    backup: yes
  ignore_errors: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  lineinfile:
    state: absent
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveCountMax (?!0)'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveCountMax(.*)?$'
    line: 'ClientAliveCountMax 0'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.12 | PATCH | Ensure SSH Idle Timeout Interval is configured"
  replace:
    dest: /etc/ssh/sshd_config
    regexp: '^ClientAliveCountMax(.*)?$'
    replace: 'ClientAliveCountMax 0'
    backup: yes
  ignore_errors: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.12

- name: "SCORED | 5.2.13 | PATCH | Ensure SSH LoginGraceTime is set to one minute or less"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^LoginGraceTime'
    line: 'LoginGraceTime 60'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.13

- name: "SCORED | 5.2.14 | PATCH | Ensure SSH access is limited"
  command: /bin/true
  changed_when: no
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.14

- name: "SCORED | 5.2.15 | PATCH | Ensure SSH warning banner is configured"
  lineinfile:
    state: present
    dest: /etc/ssh/sshd_config
    regexp: '^Banner'
    line: 'Banner /etc/issue.net'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.2.15

- name: "SCORED | 5.3.1 | PATCH | Ensure password creation requirements are configured"
  lineinfile:
    state: present
    dest: /etc/security/pwquality.conf
    regexp: '^{{ item.key }}'
    line: '{{ item.key }} = {{ item.value }}'
  with_items:
    - { key: 'minlen',  value: '14' }
    - { key: 'dcredit', value: '-1' }
    - { key: 'ucredit', value: '-1' }
    - { key: 'ocredit', value: '-1' }
    - { key: 'lcredit', value: '-1' }
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_password_creation_requirements is defined and centos7cis_password_creation_requirements
  tags:
    - level1
    - patch
    - rule_5.3.1

# auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
# auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900


# START # auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900 #

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth audit silent deny=5 unlock_time=900
    state: before
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth audit silent deny=5 unlock_time=900
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - Removal"
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth audit silent deny=5 unlock_time=900
    state: absent
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low


# END # auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900 #

# START # auth [success=1 default=bad] pam_unix.so #

- name: 'SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - pam_unix.so'
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: 'pam_unix.so'
    new_control: '[success=1 default=bad]'
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth

  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: 'SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - pam_unix.so'
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: 'pam_unix.so'
    new_type: auth
    new_control: '[success=1 default=bad]'
    new_module_path: pam_unix.so
    module_arguments: 'nullok try_first_pass'
    state: before
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: 'SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - pam_unix.so'
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[success=1 default=bad]'
    module_path: pam_unix.so
    module_arguments: 'nullok try_first_pass'
    state: updated
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: 'SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - pam_unix.so'
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[success=1 default=bad]'
    module_path: pam_unix.so
    module_arguments: 'nullok try_first_pass'
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

# - name: 'SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - Removal - pam_unix.so'
#   pamd:
#     name: '{{ item }}'
#     type: auth
#     control: sufficient
#     module_path: 'pam_unix.so'
#     state: absent
#   ignore_errors: yes
#   loop:
#     - system-auth
#     - password-auth
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# END # auth [success=1 default=bad] pam_unix.so #

# START # auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 #

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[success=1 default=bad]'
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail audit deny=5 unlock_time=900
    state: after
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail audit deny=5 unlock_time=900
    state: after
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail audit deny=5 unlock_time=900
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - Removal"
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail audit deny=5 unlock_time=900
    state: absent
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

# END # auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900 #

# START # auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900 #

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    new_type: auth
    new_control: sufficient
    new_module_path: pam_faillock.so
    module_arguments: authsucc audit deny=5 unlock_time=900
    state: after
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured"
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_faillock.so
    module_arguments: authsucc audit deny=5 unlock_time=900
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and not centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

- name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured - Removal"
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_faillock.so
    module_arguments: authsucc audit deny=5 unlock_time=900
    state: absent
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ad_ldap_joined_machine is defined and centos7cis_ad_ldap_joined_machine
  tags:
    - level1
    - patch
    - rule_5.3.2
    - low

# END # auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900 #

# OLD # START #
# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | system-auth"
#   pamd:
#     name: system-auth
#     type: auth
#     control: required
#     module_path: pam_faillock.so
#     module_arguments: 'preauth
#         audit
#         silent
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | system-auth"
#   pamd:
#     name: system-auth
#     type: auth
#     control: '[success=1 default=bad]'
#     module_path: pam_unix.so
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | system-auth"
#   pamd:
#     name: system-auth
#     type: auth
#     control: '[default=die]'
#     module_path: pam_faillock.so
#     module_arguments: 'authfail
#         audit
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | system-auth"
#   pamd:
#     name: system-auth
#     type: auth
#     control: sufficient
#     module_path: pam_faillock.so
#     module_arguments: 'authsucc
#         audit
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | password-auth"
#   pamd:
#     name: password-auth
#     type: auth
#     control: required
#     module_path: pam_faillock.so
#     module_arguments: 'preauth
#         audit
#         silent
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | password-auth"
#   pamd:
#     name: password-auth
#     type: auth
#     control: '[success=1 default=bad]'
#     module_path: pam_unix.so
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | password-auth"
#   pamd:
#     name: password-auth
#     type: auth
#     control: '[default=die]'
#     module_path: pam_faillock.so
#     module_arguments: 'authfail
#         audit
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low

# - name: "SCORED | 5.3.2 | Ensure lockout for failed password attempts is configured | password-auth"
#   pamd:
#     name: password-auth
#     type: auth
#     control: sufficient
#     module_path: pam_faillock.so
#     module_arguments: 'authsucc
#         audit
#         deny=5
#         unlock_time=900'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.2
#     - low
# END # OLD #

# START # password sufficient pam_unix.so remember=5 #
# Determine if pam_unix.so or pam_pwhistory.so should be utilized
- name: 'SCORED | 5.3.3 | Ensure password reuse is limited'
  shell: 'grep -q "^password\s*sufficient\s*pam_unix\.so" /etc/pam.d/system-auth'
  register: system_auth_password_check_pam_unix
  failed_when: 'system_auth_password_check_pam_unix.rc > 1'
  changed_when: false
  ignore_errors: yes
  become: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.3
    - low

- name: 'SCORED | 5.3.3 | Ensure password reuse is limited'
  shell: 'grep -q "^password\s+required\s+pam_pwhistory\.so" /etc/pam.d/system-auth'
  register: system_auth_password_check_pam_pwhistory
  failed_when: 'system_auth_password_check_pam_pwhistory.rc > 1'
  changed_when: false
  ignore_errors: yes
  become: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.3.3
    - low

# START # DEBUG STATEMENTS #
# - debug:
#     var: system_auth_password_check_pam_unix
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.3
#     - low


# - debug:
#     var: system_auth_password_check_pam_pwhistory
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.3
#     - low
# END # DEBUG STATEMENTS #

- name: 'SCORED | 5.3.3 | Ensure password reuse is limited'
  pamd:
    name: '{{ item }}'
    type: password
    control: sufficient
    module_path: 'pam_unix.so'
    module_arguments: 'remember=5'
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - system_auth_password_check_pam_unix.rc is defined and system_auth_password_check_pam_unix.rc == 0
  tags:
     - level1
     - patch
     - rule_5.3.3
     - low

- name: 'SCORED | 5.3.3 | Ensure password reuse is limited'
  pamd:
    name: '{{ item }}'
    type: password
    control: required
    module_path: 'pam_pwhistory.so'
    module_arguments: 'remember=5'
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - system_auth_password_check_pam_pwhistory.rc is defined and system_auth_password_check_pam_pwhistory.rc == 0
  tags:
     - level1
     - patch
     - rule_5.3.3
     - low

# END # password sufficient pam_unix.so remember=5 #

# OLD # START #
# - name: "SCORED | 5.3.3 | Ensure password reuse is limited | password-auth"
#   pamd:
#     name: password-auth
#     type: password
#     control: sufficient
#     module_path: pam_pwhistory.so
#     module_arguments: 'remember=5'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.3
#     - low

# - name: "SCORED | 5.3.3 | Ensure password reuse is limited | system-auth"
#   pamd:
#     name: system-auth
#     type: password
#     control: sufficient
#     module_path: pam_pwhistory.so
#     module_arguments: 'remember=5'
#     state: updated
#   ignore_errors: yes
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.3
#     - low

# OLD # END #

# START # password sufficient pam_unix.so sha512 #

- name: 'SCORED | 5.3.4 | PATCH | Ensure password hashing algorithm is SHA-512'
  pamd:
    name: '{{ item }}'
    type: password
    control: sufficient
    module_path: 'pam_unix.so'
    module_arguments: 'sha512'
    state: args_present
  ignore_errors: yes
  loop:
    - system-auth
    - password-auth
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
     - level1
     - patch
     - rule_5.3.4

# END # password sufficient pam_unix.so sha512 #

# OLD # START #
# - name: "SCORED | 5.3.4 | PATCH | Ensure password hashing algorithm is SHA-512"
#   command: authconfig --passalgo=sha512 --update
#   when:
#     - centos7cis_level1 is defined and centos7cis_level1
#   tags:
#     - level1
#     - patch
#     - rule_5.3.4
# OLD # END #

- name: "SCORED | 5.4.1.1 | PATCH | Ensure password expiration is 365 days or less"
  lineinfile:
      state: present
      dest: /etc/login.defs
      regexp: '^PASS_MAX_DAYS'
      line: 'PASS_MAX_DAYS 90'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_password_expiration is defined and centos7cis_password_expiration
  tags:
    - level1
    - patch
    - rule_5.4.1.1

- name: "SCORED | 5.4.1.2 | PATCH | Ensure minimum days between password changes is 7 or more"
  lineinfile:
      state: present
      dest: /etc/login.defs
      regexp: '^PASS_MIN_DAYS'
      line: 'PASS_MIN_DAYS 7'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_password_minimum_days_password_change is defined and centos7cis_password_minimum_days_password_change
  tags:
    - level1
    - patch
    - rule_5.4.1.2

- name: "SCORED | 5.4.1.3 | PATCH | Ensure password expiration warning days is 7 or more"
  lineinfile:
    state: present
    dest: /etc/login.defs
    regexp: '^PASS_WARN_AGE'
    line: 'PASS_WARN_AGE 7'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.4.1.3

- name: "SCORED | 5.4.1.4 | PATCH | Ensure inactive password lock is 30 days or less"
  command: useradd -D -f 30
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.4.1.4
    - low

- name: "SCORED | 5.4.1.5 | Ensure all users last password change date is in the past (Scored)"
  debug:
    msg: 'Confirm all password change dates are in the past.'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.4.1.5
    - low

- name: "SCORED | 5.4.2 | PATCH | Ensure system accounts are non-login"
  copy:
    src: scripts/five_four_two.sh
    dest: /opt/five_four_two.sh
    owner: root
    group: root
    mode: 0700
  changed_when: no
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ensure_system_accounts_are_non_login is defined and centos7cis_ensure_system_accounts_are_non_login
  tags:
    - level1
    - patch
    - rule_5.4.2
    - low

- name: "SCORED | 5.4.2 | PATCH | Ensure system accounts are non-login"
  shell: /opt/five_four_two.sh
  args:
    executable: /bin/bash
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ensure_system_accounts_are_non_login is defined and centos7cis_ensure_system_accounts_are_non_login
  tags:
    - level1
    - patch
    - rule_5.4.2
    - low

- name: "SCORED | 5.4.2 | PATCH | Ensure system accounts are non-login"
  file:
    path: /opt/five_four_two.sh
    owner: root
    group: root
    state: absent
  changed_when: no
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_ensure_system_accounts_are_non_login is defined and centos7cis_ensure_system_accounts_are_non_login
  tags:
    - level1
    - patch
    - rule_5.4.2
    - low

- name: "SCORED | 5.4.3 | PATCH | Ensure default group for the root account is GID 0"
  command: usermod -g 0 root
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.4.3

- name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive"
  lineinfile:
    state: present
    dest: /etc/bashrc
    regexp: 'umask'
    line: 'umask {{ centos7cis_default_user_umask }}'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_modify_default_user_umask is defined and centos7cis_modify_default_user_umask
  tags:
    - level1
    - patch
    - rule_5.4.4
    - low

- name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive"
  lineinfile:
      state: present
      dest: /etc/profile
      regexp: 'umask'
      line: 'umask {{ centos7cis_default_user_umask }}'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_modify_default_user_umask is defined and centos7cis_modify_default_user_umask
  tags:
    - level1
    - patch
    - rule_5.4.4
    - low

- name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive"
  find:
    paths: /etc/profile.d/
    recurse: yes
    patterns: "*.sh"
  register: profiled_dir
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_modify_default_user_umask is defined and centos7cis_modify_default_user_umask
  tags:
    - level1
    - patch
    - rule_5.4.4
    - low

- name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive"
  lineinfile:
    state: present
    dest: "{{ item }}"
    regexp: 'umask'
    line: 'umask {{ centos7cis_default_user_umask }}'
    backup: yes
  with_items: profiled_dir.files.path
  ignore_errors: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
    - centos7cis_modify_default_user_umask is defined and centos7cis_modify_default_user_umask
  tags:
    - level1
    - patch
    - rule_5.4.4
    - low

- name: "SCORED | 5.4.5 | PATCH | Ensure default user shell timeout is 900 seconds or less"
  lineinfile:
    state: present
    dest: /etc/bashrc
    regexp: '^TMOUT'
    line: 'TMOUT=600'
  when:
    - centos7cis_level2 is defined and centos7cis_level2
  tags:
    - level2
    - patch
    - rule_5.4.5
    - low

- name: "SCORED | 5.4.5 | PATCH | Ensure default user shell timeout is 900 seconds or less"
  lineinfile:
    state: present
    dest: /etc/profile
    regexp: '^TMOUT'
    line: 'TMOUT=600'
  when:
    - centos7cis_level2 is defined and centos7cis_level2
  tags:
    - level2
    - patch
    - rule_5.4.5
    - low

- name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted"
  lineinfile:
    state: present
    dest: /etc/group
    regexp: '^wheel:x:10:(.*)$'
    line: 'wheel:x:10:\1,root'
    backrefs: yes
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.6
    - low

- name: "SCORED | 5.6 | PATCH | Ensure access to the su command is restricted"
  lineinfile:
    state: present
    dest: /etc/pam.d/su
    regexp: '^#auth\s+required\s+pam_wheel\.so'
    line: 'auth           required        pam_wheel.so use_uid'
  when:
    - centos7cis_level1 is defined and centos7cis_level1
  tags:
    - level1
    - patch
    - rule_5.6