initial commit

roles/sudo_rbac/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+- name: Deploy sudoers.d drop-in file per AD group
+  ansible.builtin.template:
+    src: sudoers_group.j2
+    dest: "/etc/sudoers.d/10-{{ item.group | lower }}"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: "visudo -cf %s"
+  loop: "{{ sudo_rbac_rules }}"
+  loop_control:
+    label: "{{ item.group }}"
+  tags: [sudo_rbac]
+
+- name: Restrict direct root console login
+  ansible.builtin.lineinfile:
+    path: /etc/securetty
+    state: absent
+    regexp: "^tty[1-9]$"
+  tags: [sudo_rbac, cis_hardening]
+
+- name: Audit rule for privileged command usage
+  ansible.builtin.lineinfile:
+    path: /etc/audit/rules.d/50-privileged.rules
+    create: true
+    owner: root
+    group: root
+    mode: "0640"
+    line: "-a exit,always -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k privileged"
+  notify: reload auditd rules
+  tags: [sudo_rbac, cis_hardening]