You've already forked ansible-linux-infra
32 lines
868 B
YAML
32 lines
868 B
YAML
---
|
|
- name: Deploy sudoers.d drop-in file per AD group
|
|
ansible.builtin.template:
|
|
src: sudoers_group.j2
|
|
dest: "/etc/sudoers.d/10-{{ item.group | lower }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: "visudo -cf %s"
|
|
loop: "{{ sudo_rbac_rules }}"
|
|
loop_control:
|
|
label: "{{ item.group }}"
|
|
tags: [sudo_rbac]
|
|
|
|
- name: Restrict direct root console login
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/securetty
|
|
state: absent
|
|
regexp: "^tty[1-9]$"
|
|
tags: [sudo_rbac, cis_hardening]
|
|
|
|
- name: Audit rule for privileged command usage
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/audit/rules.d/50-privileged.rules
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0640"
|
|
line: "-a exit,always -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k privileged"
|
|
notify: reload auditd rules
|
|
tags: [sudo_rbac, cis_hardening]
|