second commit

ansible/roles/os_hardening/tasks/file_permissions.yml

@@ -0,0 +1,38 @@
+---
+# CIS 6.1.x: Berechtigungen sicherheitskritischer Systemdateien; zusaetzlich
+# manipulationssicheres sudo-Logging (ergaenzt die auditd-Regel
+# "privileged_sudo" aus auditd.yml um ein menschenlesbares Log).
+
+- name: Berechtigungen sicherheitskritischer Dateien absichern
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: "{{ item.group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - { path: /etc/passwd, group: root, mode: "0644" }
+    - { path: /etc/group, group: root, mode: "0644" }
+    - { path: /etc/shadow, group: shadow, mode: "0640" }
+    - { path: /etc/gshadow, group: shadow, mode: "0640" }
+    - { path: /etc/ssh/sshd_config, group: root, mode: "0600" }
+  ignore_errors: true  # z.B. wenn die shadow-Gruppe distributionsabhaengig anders heisst
+
+- name: Eigenstaendiges sudo-Logfile aktivieren
+  ansible.builtin.copy:
+    dest: /etc/sudoers.d/99-jumphost-logging
+    owner: root
+    group: root
+    mode: "0440"
+    validate: "visudo -cf %s"
+    content: |
+      Defaults logfile="/var/log/sudo.log"
+      Defaults log_input, log_output
+      Defaults use_pty
+      Defaults passwd_tries=3
+
+- name: su-Kommando auf die Gruppe "sudo" beschraenken (CIS 5.6)
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/su
+    regexp: '^#?\s*auth\s+required\s+pam_wheel\.so'
+    line: "auth       required   pam_wheel.so use_uid group=sudo"
+    insertafter: '^# Uncomment this'