39 lines
1.4 KiB
YAML
39 lines
1.4 KiB
YAML
---
|
|
# CIS 6.1.x: Berechtigungen sicherheitskritischer Systemdateien; zusaetzlich
|
|
# manipulationssicheres sudo-Logging (ergaenzt die auditd-Regel
|
|
# "privileged_sudo" aus auditd.yml um ein menschenlesbares Log).
|
|
|
|
- name: Berechtigungen sicherheitskritischer Dateien absichern
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
owner: root
|
|
group: "{{ item.group }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { path: /etc/passwd, group: root, mode: "0644" }
|
|
- { path: /etc/group, group: root, mode: "0644" }
|
|
- { path: /etc/shadow, group: shadow, mode: "0640" }
|
|
- { path: /etc/gshadow, group: shadow, mode: "0640" }
|
|
- { path: /etc/ssh/sshd_config, group: root, mode: "0600" }
|
|
ignore_errors: true # z.B. wenn die shadow-Gruppe distributionsabhaengig anders heisst
|
|
|
|
- name: Eigenstaendiges sudo-Logfile aktivieren
|
|
ansible.builtin.copy:
|
|
dest: /etc/sudoers.d/99-jumphost-logging
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|
|
content: |
|
|
Defaults logfile="/var/log/sudo.log"
|
|
Defaults log_input, log_output
|
|
Defaults use_pty
|
|
Defaults passwd_tries=3
|
|
|
|
- name: su-Kommando auf die Gruppe "sudo" beschraenken (CIS 5.6)
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pam.d/su
|
|
regexp: '^#?\s*auth\s+required\s+pam_wheel\.so'
|
|
line: "auth required pam_wheel.so use_uid group=sudo"
|
|
insertafter: '^# Uncomment this'
|