Merge pull request #112 from siemens/siemens/feat/ensure_default_umas…

…k_027_5_6_5 Adding new entry in /etc/pam.d/system-auth
ansible-lockdown · Jan 26, 2024 · ac5eee8 · ac5eee8
2 parents 068c45f + c6a51ad
commit ac5eee8
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/tasks/section_5/cis_5.6.x.yml b/tasks/section_5/cis_5.6.x.yml
@@ -98,6 +98,11 @@
             regexp: '^USERGROUPS_ENAB'
             line: USERGROUPS_ENAB no
 
+      - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask sessions /etc/pam.d/system-auth"
+        ansible.builtin.lineinfile:
+            path: /etc/pam.d/system-auth
+            line: 'session     required            pam_umask.so'
+            insertafter: EOF
   when:
       - rhel9cis_rule_5_6_5
   tags: