Merge pull request #11248 from teacup-on-rockingchair/sle15_fix_ansible_stig_remediations

fix ansible SLES stig remediations in check mode

Author: marcusburghardt

linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/ansible/shared.yml

@@ -14,10 +14,10 @@
 {{% if product in ["rhel7", "ol7"] %}}
   ansible.builtin.command:
     cmd: chage -M {{ var_accounts_maximum_age_login_defs }} {{ item }}
-{{% elif product in ["sle12","sle15"] %}}    
+{{% elif product in ["sle12","sle15"] %}}
   ansible.builtin.command:
     cmd:  passwd -q -x {{ var_accounts_maximum_age_login_defs }} {{ item }}
-{{% else %}}        
+{{% else %}}
   ansible.builtin.user:
     user: '{{ item }}'
     password_expire_max: '{{ var_accounts_maximum_age_login_defs }}'

linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/ansible/shared.yml

@@ -18,6 +18,6 @@
 {{% else %}}
   command: >
     chage -m {{ var_accounts_minimum_age_login_defs }} {{ item }}
-{{% endif %}}    
+{{% endif %}}
   with_items: "{{ user_names.stdout_lines }}"
   when: user_names.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords_etc_shadow/ansible/shared.yml

@@ -13,5 +13,4 @@
   command: >
     passwd -l {{ item }}
   with_items: "{{ users_nopasswd.stdout_lines }}"
-  when: users_nopasswd.stdout_lines | length > 0
-
+  when: users_nopasswd is not skipped and users_nopasswd.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/sle12.yml

@@ -13,3 +13,4 @@
   file:
     path: /etc/profile.d/autologout.sh
     mode: '0755'
+  when: lookup('ansible.builtin.file', '/etc/profile.d/autologout.sh', errors='warn')

linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/sle15.yml

@@ -13,3 +13,4 @@
   file:
     path: /etc/profile.d/autologout.sh
     mode: '0755'
+  when: lookup('ansible.builtin.file', '/etc/profile.d/autologout.sh', errors='warn')

linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml

@@ -50,7 +50,7 @@
   register: augenrules_audit_rules_privilege_function_update_result
   with_items: "{{ suid_audit_rules }}"
 
-- name: Update Update /etc/audit/audit.rules to audit privileged functions
+- name: Update /etc/audit/audit.rules to audit privileged functions
   ansible.builtin.lineinfile:
     path: /etc/audit/audit.rules
     line: "{{  item.rule  }}"

linux_os/guide/system/logging/ensure_rtc_utc_configuration/ansible/shared.yml

@@ -5,8 +5,8 @@
     timedatectl status | grep -i 'Time zone'| grep -iv 'UTC\|GMT' || true
   register: check_tz
   failed_when: "check_tz.rc not in [ 0 , 1 ]"
- 
+
 - name: Configure OS to use 'UTC' timezone
-  command: timedatectl set-timezone UTC 
+  command: timedatectl set-timezone UTC
   become: yes
   when: check_tz.rc == 0

linux_os/guide/system/network/network_sniffer_disabled/ansible/shared.yml

@@ -13,4 +13,5 @@
   ansible.builtin.command:
     cmd: ip link set dev {{ item.split(':')[1] }} multicast off promisc off
   loop: "{{ network_interfaces.stdout_lines }}"
-  when: "item.split(':')"
+  when: network_interfaces.stdout_lines is defined and "item.split(':') | length == 3"
+

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml

@@ -3,6 +3,12 @@
 # strategy = restrict
 # complexity = low
 # disruption = low
+- name: "{{{ rule_title }}} - Gather List of Packages"
+  tags:
+  - aide_check_audit_tools
+  ansible.builtin.package_facts:
+    manager: auto
+
 
 - name: Ensure aide is installed
   package:
@@ -35,6 +41,7 @@
     line: "{{ item }} {{{ aide_string() }}}"
   with_items: "{{ audit_tools }}"
 
+
 - name: Configure AIDE to properly protect audit tools
   lineinfile:
     path: {{{ aide_conf_path }}}

linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/ansible/shared.yml

@@ -20,5 +20,5 @@
     path: /etc/aide.conf
     regexp: (^\s*{{ item }}\s*=\s*)(?!.*acl)([^\s]*)
     replace: \g<1>\g<2>+acl
-  when: "'aide' in ansible_facts.packages"
+  when: find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"
   with_items: "{{ find_rules_groups_results.stdout_lines | map('trim') | list }}"