---
# CIS 6.1.x: Berechtigungen sicherheitskritischer Systemdateien; zusaetzlich
# manipulationssicheres sudo-Logging (ergaenzt die auditd-Regel
# "privileged_sudo" aus auditd.yml um ein menschenlesbares Log).

- name: Berechtigungen sicherheitskritischer Dateien absichern
  ansible.builtin.file:
    path: "{{ item.path }}"
    owner: root
    group: "{{ item.group }}"
    mode: "{{ item.mode }}"
  loop:
    - { path: /etc/passwd, group: root, mode: "0644" }
    - { path: /etc/group, group: root, mode: "0644" }
    - { path: /etc/shadow, group: shadow, mode: "0640" }
    - { path: /etc/gshadow, group: shadow, mode: "0640" }
    - { path: /etc/ssh/sshd_config, group: root, mode: "0600" }
  ignore_errors: true  # z.B. wenn die shadow-Gruppe distributionsabhaengig anders heisst

- name: Eigenstaendiges sudo-Logfile aktivieren
  ansible.builtin.copy:
    dest: /etc/sudoers.d/99-jumphost-logging
    owner: root
    group: root
    mode: "0440"
    validate: "visudo -cf %s"
    content: |
      Defaults logfile="/var/log/sudo.log"
      Defaults log_input, log_output
      Defaults use_pty
      Defaults passwd_tries=3

- name: su-Kommando auf die Gruppe "sudo" beschraenken (CIS 5.6)
  ansible.builtin.lineinfile:
    path: /etc/pam.d/su
    regexp: '^#?\s*auth\s+required\s+pam_wheel\.so'
    line: "auth       required   pam_wheel.so use_uid group=sudo"
    insertafter: '^# Uncomment this'