Comments (3)
Look at similar changes made to the RHEL6-STIG role a few months ago.
from rhel7-stig.
Haven't put this into testing yet, but this is shorter than what I had before, and resembles the RHEL6-STIG changes:
- block:
- name: |
"MEDIUM | RHEL-07-010320 | PATCH | Accounts subject to three unsuccessful login attempts within 15 minutes must be locked for the maximum configurable period (add modules)."
"MEDIUM | RHEL-07-010330 | PATCH | If three unsuccessful logon attempts within 15 minutes occur the associated account must be locked (add modules)."
pamd:
name: "{{ item.name }}"
state: "{{ item.state }}"
type: "{{ item.type }}"
control: "{{ item.control }}"
module_path: pam_unix.so
new_type: "{{ item.type }}"
new_control: "{{ item.new_control }}"
new_module_path: pam_faillock.so
module_arguments: "{{ item.args }}"
with_items:
- { name: "system-auth", state: "before", type: "auth", control: "sufficient", new_control: "required", args: "preauth silent {{ faillock_args }}" }
- { name: "password-auth", state: "before", type: "auth", control: "sufficient", new_control: "required", args: "preauth silent {{ faillock_args }}" }
- { name: "system-auth", state: "after", type: "auth", control: "sufficient", new_control: "[default=die]", args: "authfail {{ faillock_args }}" }
- { name: "password-auth", state: "after", type: "auth", control: "sufficient", new_control: "[default=die]", args: "authfail {{ faillock_args }}" }
- { name: "system-auth", state: "before", type: "account", control: "required", new_control: "required", args: ""}
- { name: "password-auth", state: "before", type: "account", control: "required", new_control: "required", args: ""}
- name: |
"MEDIUM | RHEL-07-010320 | PATCH | Accounts subject to three unsuccessful login attempts within 15 minutes must be locked for the maximum configurable period (update modules)."
"MEDIUM | RHEL-07-010330 | PATCH | If three unsuccessful logon attempts within 15 minutes occur the associated account must be locked (update modules)."
pamd:
name: "{{ item.name }}"
state: updated
type: auth
control: "{{ item.control }}"
module_path: pam_faillock.so
module_arguments: "{{ item.args }}"
with_items:
- { name: "system-auth", control: "required", args: "preauth silent {{ faillock_args }}" }
- { name: "password-auth", control: "required", args: "preauth silent {{ faillock_args }}" }
- { name: "system-auth", control: "[default=die]", args: "authfail {{ faillock_args }}" }
- { name: "password-auth", control: "[default=die]", args: "authfail {{ faillock_args }}" }
vars:
faillock_args: "audit deny={{ rhel7stig_pam_faillock.attempts }}{{ (rhel7stig_pam_faillock.fail_for_root) | ternary(' even_deny_root ',' ') }}fail_interval={{ rhel7stig_pam_faillock.interval }} unlock_time={{ rhel7stig_pam_faillock.unlock_time }}"
when: rhel_07_010320 or rhel_07_010330
tags:
- RHEL-07-010320
- RHEL-07-010330
- pamd
from rhel7-stig.
This should be fixed in #180 - TLDR of the convo in that PR is that the pamd module is broken.
from rhel7-stig.
Related Issues (20)
- A boot kernel parameter is added to /etc/default/grub even if there is not a separate boot partition HOT 2
- SCAP scan fails for RHEL-07-040160 (TMOUT) HOT 1
- RHEL-07-010119 is potentially not idempotent
- RHEL-07-010110 setting incorrect lock-delay value HOT 1
- RHEL-07-040350 not applying on RHEL7 Workstations HOT 2
- fix-cat1: RHEL-07-010482/010491 HOT 1
- Make auditd process a var HOT 3
- Playbook needs password set or verified for user running the playbook HOT 10
- Capture current password state fails HOT 3
- Improve sudo user passwd check - RHEL-07-010340
- RHEL-07-020110 does not reference rhel_07_020110_autofs_service_status.stdout HOT 1
- GRUB 2 config handler fails when /boot/grub2/user.cfg does not exist HOT 1
- /boot/efi error with improperly tagged tasks HOT 2
- Error "The conditional check ''nosuid' not in home_mount.options' failed" in fix-cat2.yml. Easy code fix. HOT 3
- Controls associated with the auditd.rules are failing because -F perm=x is not added HOT 1
- Missing the auid settings in the audit rules on 3 STIG IDs HOT 1
- Offline usage - ERROR! 'collections' is not a valid attribute for a RoleMetadata HOT 4
- RHEL-07-020620 uidmin and uidmax not sufficient to find local interactive users HOT 2
- RHEL-07-020600 prelim.yml should parse /etc/passwd unconditionally
- RHEL-07-040730 Removes X windows when set to false and rhel7stig_gui is true
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rhel7-stig.