search

ComplianceAsCode / content

Security automation content in SCAP, Bash, Ansible, and other formats
https://complianceascode.readthedocs.io/en/latest/
Other
2.2k stars 696 forks source link

ansible-role-rhel9-cis vs. issues with password/authselect hardening #10741

Open TomKristenHansen opened 1 year ago

TomKristenHansen commented 1 year ago

Description of problem:

When we are running playbook ansible-role-rhel9-cis we have to exclude following to have a complete run;

   accounts_password_pam_pwhistory_remember_password_auth: false
   accounts_password_pam_pwhistory_remember_system_auth: false
   accounts_password_pam_retry: false
   accounts_password_set_max_life_existing: false
   accounts_passwords_pam_faillock_deny: false
   accounts_passwords_pam_faillock_unlock_time: false
   no_empty_passwords_etc_shadow: false
   set_password_hashing_algorithm_passwordauth: false
   set_password_hashing_algorithm_systemauth: false

Typically we get error as following; fatal: [ilp-gif-test01]: FAILED! => {"msg": "The conditional check 'authselect_current_profile is not match(\"custom/\")' failed. The error was: error while evaluating conditional (authselect_current_profile is not match(\"custom/\")): 'authselect_current_profile' is undefined\n\nThe error appears to be in '/mnt/share-gjk/et1119/ansible_hansen/RedHatOfficial_rhel9_cis_0.1.64/roles/RedHatOfficial.rhel9_cis/tasks/main.yml': line 1285, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n - authselect_current_profile is not match(\"custom/\")\n - name: 'Limit Password Reuse: password-auth - Check if any custom profile with the same name was already created'\n ^ here\nThis one looks easy to fix. It seems that there is a value started\nwith a quote, and the YAML parser is expecting to see the line ended\nwith the same kind of quote. For instance:\n\n when: \"ok\" in result.stdout\n\nCould be written as:\n\n when: '\"ok\" in result.stdout'\n\nOr equivalently:\n\n when: \"'ok' in result.stdout\"\n"}

SCAP Security Guide Version:

Operating System Version:

RHEL 9.2 x86_64

Steps to Reproduce:

1. 2. 3. 4.

Actual Results:

Expected Results:

Additional Information/Debugging Steps:

marcusburghardt commented 1 year ago

RedHatOfficial.rhel9_cis is currently aligned to 0.1.68 which includes many updates. Could you confirm the issue is resolved, please?

TomKristenHansen commented 1 year ago

Thank you for feedback!

I will do a test during this week, and share the result!

TomKristenHansen commented 1 year ago

I have now tested 0.1.68 and 0.1.69, and it looks better, i now only have to exclude following play to complete without errors; "accounts_password_set_max_life_existing" / ( accounts_password_set_max_life_existing: false )

Following error; TASK [RedHatOfficial.rhel9_cis : Change the maximum time period between password changes] ** failed: [ilp-gif-test01] (item=root) => {"ansible_loop_var": "item", "changed": false, "item": "root", "msg": "Unsupported parameters for (ansible.builtin.user) module: password_expire_max Supported parameters include: append, authorization, comment, create_home, expires, force, generate_ssh_key, group, groups, hidden, home, local, login_class, move_home, name, non_unique, password, password_lock, profile, remove, role, seuser, shell, skeleton, ssh_key_bits, ssh_key_comment, ssh_key_file, ssh_key_passphrase, ssh_key_type, state, system, uid, update_password"}

PLAY RECAP ***** ilp-gif-test01 : ok=209 changed=13 unreachable=0 failed=1 skipped=246 rescued=0 ignored=0

TomKristenHansen commented 1 year ago

I have also discovered here after several executions, that just sub part of role is executed without understanding why. E.g. following plays are not executed;

Command for executing playbook; ansible-playbook_ -i "ilp-gif-test01," playbook_rhel9_cis.yml

Playbook content; `- hosts: ilp-gif-test01 become: true roles:

Any idea why not all plays are executed like in version 0.1.67?

TomKristenHansen commented 1 year ago

After some more testing, since we do not use firewalld as service, I was able to run a successful playbook by changing this;

from: service_firewalld_enabled: false

to: firewalld_loopback_traffic_restricted : false firewalld_loopback_traffic_trusted: false service_firewalld_enabled: false

Wish it could be more clear error messages :-)