Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chage tool related settings: max-days, min-days and warn-age, for get… #190

Conversation

ipruteanu-sie
Copy link
Contributor

5.6.1.{1-3} rules - chage impl

Overall Review of Changes:
Adding chage settings for users

Issue Fixes:
#189

Enhancements:
Completing rules 5.6.1-3

How has this been tested?:
Tested on VM

ipruteanu-sie and others added 5 commits March 11, 2024 09:38
…ting CIS-Passes on rules 5.6.1.{1-3}

Signed-off-by: Pruteanu <[email protected]>
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Signed-off-by: Pruteanu <[email protected]>
* change logic thanks to @rjacobs1990 see ansible-lockdown#175

* 1.2.1 force gpg import rhel

* fix missing facts

---------

Signed-off-by: Mark Bolwell <[email protected]>
Signed-off-by: Pruteanu <[email protected]>
* Issue ansible-lockdown#170, PR ansible-lockdown#181 thanks to @ipruteanu-sie

* issue ansible-lockdown#182, PR ansible-lockdown#183 thansk to @ipruteanu-sie

* PR ansible-lockdown#180 thanks to @ipruteanu-sie and @raabf

* Addressed PR ansible-lockdown#165 thanks to @ipruteanu-sie

* PT ansible-lockdown#184 addressed thansk to @ipruteanu-sie

* updated credits

* typo and ssh allow_deny comments

* enable OS check

---------

Signed-off-by: Mark Bolwell <[email protected]>
Signed-off-by: Pruteanu <[email protected]>
@ipruteanu-sie
Copy link
Contributor Author

L.E.: About newest comit:

As one may notice below, value for the shells have no leading spaces, therefore the below conditional

"/usr/sbin/nologin" != "      /bin/false"

will be evaluated as True, forcing the conditionals to not work as intended.

changed: [192.168.126.152] => (item=root) => {
    "ansible_loop_var": "item",
    "changed": true,
    "cmd": "chage --warndays \"7\"  \"root\"",
    "delta": "0:00:00.091259",
    "end": "2024-03-11 10:47:30.783333",
    "invocation": {
        "module_args": {
            "_raw_params": "chage --warndays \"7\"  \"root\"",
            "_uses_shell": true,
            "argv": null,
            "chdir": null,
            "creates": null,
            "executable": null,
            "removes": null,
            "stdin": null,
            "stdin_add_newline": true,
            "strip_empty_ends": true,
            "warn": false
        }
    },
    "item": {
        "dir": "/root",
        "gecos": "root",
        "gid": 0,
        "id": "root",
        "password": "x",
        "shell": "/bin/bash",
        "uid": 0
    },
    "msg": "",
    "rc": 0,
    "start": "2024-03-11 10:47:30.692074",
    "stderr": "",
    "stderr_lines": [],
    "stdout": "",
    "stdout_lines": []
}
skipping: [192.168.126.152] => (item=bin)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/bin",
        "gecos": "bin",
        "gid": 1,
        "id": "bin",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 1
    },
    "skip_reason": "Conditional result was False"
}
skipping: [192.168.126.152] => (item=daemon)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/sbin",
        "gecos": "daemon",
        "gid": 2,
        "id": "daemon",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 2
    },
    "skip_reason": "Conditional result was False"
}
...
}

@uk-bolly
Copy link
Member

hi @ipruteanu-sie

Thank you as always for the PR and feedback, i'm trying to undertsnad how you have so many commits when so many are already in place.
We seem to be adding files and changes that are already committed back in meaning that we are checking thing through multiple times.

Is there any chance you could pull the latest and just make the changes you need?
That should hopefully mean we are only looking at the files you are trying to change.

Many thanks as always

uk-bolly

pre-commit-ci bot and others added 4 commits March 26, 2024 20:57
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
…sible-lockdown#188)

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Signed-off-by: John Foster <[email protected]>

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Removed debug messages

Signed-off-by: John Foster <[email protected]>

---------

Signed-off-by: John Foster <[email protected]>
updates:
- [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Signed-off-by: Pruteanu <[email protected]>
@ipruteanu-sie ipruteanu-sie mentioned this pull request Mar 26, 2024
@ipruteanu-sie
Copy link
Contributor Author

Hi @uk-bolly: #196 was created instead of current one.

uk-bolly added a commit that referenced this pull request Apr 10, 2024
Signed-off-by: Mark Bolwell <[email protected]>
uk-bolly added a commit that referenced this pull request Apr 10, 2024
Signed-off-by: Mark Bolwell <[email protected]>
@uk-bolly uk-bolly mentioned this pull request Apr 10, 2024
uk-bolly added a commit that referenced this pull request Apr 15, 2024
* Issue #170, PR #181 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <[email protected]>

* issue #182, PR #183 thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <[email protected]>

* PR #180 thanks to @ipruteanu-sie and @raabf

Signed-off-by: Mark Bolwell <[email protected]>

* Addressed PR #165 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <[email protected]>

* PT #184 addressed thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <[email protected]>

* updated credits

Signed-off-by: Mark Bolwell <[email protected]>

* typo and ssh allow_deny comments

Signed-off-by: Mark Bolwell <[email protected]>

* enable OS check

Signed-off-by: Mark Bolwell <[email protected]>

* PR - #198 addressed thanks to @brakkio86

Signed-off-by: Mark Bolwell <[email protected]>

* Addressed issue #190

Signed-off-by: Mark Bolwell <[email protected]>

* Additional vars for issue #190

Signed-off-by: Mark Bolwell <[email protected]>

* updated pre-commit version

Signed-off-by: Mark Bolwell <[email protected]>

* consistent quotes around mode

Signed-off-by: Mark Bolwell <[email protected]>

* moved audit added discoveries

Signed-off-by: Mark Bolwell <[email protected]>

* removed unneeded vars

Signed-off-by: Mark Bolwell <[email protected]>

* audit moved to prelim

Signed-off-by: Mark Bolwell <[email protected]>

* tidy up

Signed-off-by: Mark Bolwell <[email protected]>

* improved new variable usage

Signed-off-by: Mark Bolwell <[email protected]>

* fixed logic 6.2.10

Signed-off-by: Mark Bolwell <[email protected]>

* updated

Signed-off-by: Mark Bolwell <[email protected]>

* addressed #197 thanks to @mark-tomich

Signed-off-by: Mark Bolwell <[email protected]>

* updates for audit section

Signed-off-by: Mark Bolwell <[email protected]>

* fixed naming

Signed-off-by: Mark Bolwell <[email protected]>

* updated

Signed-off-by: Mark Bolwell <[email protected]>

* added prelim to includes

Signed-off-by: Mark Bolwell <[email protected]>

---------

Signed-off-by: Mark Bolwell <[email protected]>
uk-bolly added a commit that referenced this pull request Jun 5, 2024
This was referenced Jun 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants