You've already forked ansible-linux-infra
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [pam_hardening, always]
|
|
|
|
- name: Ensure pwquality library is installed
|
|
ansible.builtin.package:
|
|
name: "{{ pam_hardening_pwquality_package }}"
|
|
state: present
|
|
tags: [pam_hardening]
|
|
|
|
- name: Set password complexity requirements
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/security/pwquality.conf
|
|
regexp: "^#?\\s*{{ item.key }}\\s*="
|
|
line: "{{ item.key }} = {{ item.value }}"
|
|
loop:
|
|
- { key: "minlen", value: "{{ pam_pwquality_minlen }}" }
|
|
- { key: "dcredit", value: "{{ pam_pwquality_dcredit }}" }
|
|
- { key: "ucredit", value: "{{ pam_pwquality_ucredit }}" }
|
|
- { key: "lcredit", value: "{{ pam_pwquality_lcredit }}" }
|
|
- { key: "ocredit", value: "{{ pam_pwquality_ocredit }}" }
|
|
- { key: "retry", value: "{{ pam_pwquality_retry }}" }
|
|
tags: [pam_hardening]
|
|
|
|
- name: Enable pam_faillock via authselect (RedHat family)
|
|
ansible.builtin.command: authselect enable-feature with-faillock
|
|
register: pam_hardening_faillock_enable
|
|
changed_when: "'already enabled' not in pam_hardening_faillock_enable.stderr"
|
|
failed_when: false
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
tags: [pam_hardening]
|
|
|
|
- name: Check whether pam_faillock is already enabled (Debian family)
|
|
ansible.builtin.command: grep -q pam_faillock.so /etc/pam.d/common-auth
|
|
register: pam_hardening_faillock_check
|
|
changed_when: false
|
|
failed_when: false
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags: [pam_hardening]
|
|
|
|
- name: Enable pam_faillock via pam-auth-update (Debian family)
|
|
ansible.builtin.command: pam-auth-update --enable faillock
|
|
register: pam_hardening_faillock_debian
|
|
changed_when: true
|
|
failed_when: false
|
|
when:
|
|
- ansible_facts['os_family'] == "Debian"
|
|
- pam_hardening_faillock_check.rc != 0
|
|
tags: [pam_hardening]
|
|
|
|
- name: Set account lockout thresholds
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/security/faillock.conf
|
|
regexp: "^#?\\s*{{ item.key }}\\s*="
|
|
line: "{{ item.key }} = {{ item.value }}"
|
|
loop:
|
|
- { key: "deny", value: "{{ pam_faillock_deny }}" }
|
|
- { key: "unlock_time", value: "{{ pam_faillock_unlock_time }}" }
|
|
tags: [pam_hardening]
|