Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chage tool related settings: max-days, min-days and warn-age, for get… #190

Conversation

ipruteanu-sie
Copy link
Contributor

5.6.1.{1-3} rules - chage impl

Overall Review of Changes:
Adding chage settings for users

Issue Fixes:
#189

Enhancements:
Completing rules 5.6.1-3

How has this been tested?:
Tested on VM

ipruteanu-sie and others added 5 commits March 11, 2024 09:38
…ting CIS-Passes on rules 5.6.1.{1-3}

Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
* change logic thanks to @rjacobs1990 see ansible-lockdown#175

* 1.2.1 force gpg import rhel

* fix missing facts

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
* Issue ansible-lockdown#170, PR ansible-lockdown#181 thanks to @ipruteanu-sie

* issue ansible-lockdown#182, PR ansible-lockdown#183 thansk to @ipruteanu-sie

* PR ansible-lockdown#180 thanks to @ipruteanu-sie and @raabf

* Addressed PR ansible-lockdown#165 thanks to @ipruteanu-sie

* PT ansible-lockdown#184 addressed thansk to @ipruteanu-sie

* updated credits

* typo and ssh allow_deny comments

* enable OS check

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
@ipruteanu-sie
Copy link
Contributor Author

L.E.: About newest comit:

As one may notice below, value for the shells have no leading spaces, therefore the below conditional

"/usr/sbin/nologin" != "      /bin/false"

will be evaluated as True, forcing the conditionals to not work as intended.

changed: [192.168.126.152] => (item=root) => {
    "ansible_loop_var": "item",
    "changed": true,
    "cmd": "chage --warndays \"7\"  \"root\"",
    "delta": "0:00:00.091259",
    "end": "2024-03-11 10:47:30.783333",
    "invocation": {
        "module_args": {
            "_raw_params": "chage --warndays \"7\"  \"root\"",
            "_uses_shell": true,
            "argv": null,
            "chdir": null,
            "creates": null,
            "executable": null,
            "removes": null,
            "stdin": null,
            "stdin_add_newline": true,
            "strip_empty_ends": true,
            "warn": false
        }
    },
    "item": {
        "dir": "/root",
        "gecos": "root",
        "gid": 0,
        "id": "root",
        "password": "x",
        "shell": "/bin/bash",
        "uid": 0
    },
    "msg": "",
    "rc": 0,
    "start": "2024-03-11 10:47:30.692074",
    "stderr": "",
    "stderr_lines": [],
    "stdout": "",
    "stdout_lines": []
}
skipping: [192.168.126.152] => (item=bin)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/bin",
        "gecos": "bin",
        "gid": 1,
        "id": "bin",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 1
    },
    "skip_reason": "Conditional result was False"
}
skipping: [192.168.126.152] => (item=daemon)  => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": {
        "dir": "/sbin",
        "gecos": "daemon",
        "gid": 2,
        "id": "daemon",
        "password": "x",
        "shell": "/usr/sbin/nologin",
        "uid": 2
    },
    "skip_reason": "Conditional result was False"
}
...
}

@uk-bolly
Copy link
Member

hi @ipruteanu-sie

Thank you as always for the PR and feedback, i'm trying to undertsnad how you have so many commits when so many are already in place.
We seem to be adding files and changes that are already committed back in meaning that we are checking thing through multiple times.

Is there any chance you could pull the latest and just make the changes you need?
That should hopefully mean we are only looking at the files you are trying to change.

Many thanks as always

uk-bolly

pre-commit-ci bot and others added 4 commits March 26, 2024 20:57
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
…sible-lockdown#188)

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Signed-off-by: John Foster <robopickle@proton.me>

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Removed debug messages

Signed-off-by: John Foster <robopickle@proton.me>

---------

Signed-off-by: John Foster <robopickle@proton.me>
updates:
- [github.com/ansible-community/ansible-lint: v24.2.0 → v24.2.1](ansible/ansible-lint@v24.2.0...v24.2.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
updates:
- [github.com/adrienverge/yamllint.git: v1.34.0 → v1.35.1](https://github.com/adrienverge/yamllint.git/compare/v1.34.0...v1.35.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Signed-off-by: Pruteanu <ionut.pruteanu@siemens.com>
@ipruteanu-sie ipruteanu-sie mentioned this pull request Mar 26, 2024
@ipruteanu-sie
Copy link
Contributor Author

Hi @uk-bolly: #196 was created instead of current one.

uk-bolly added a commit that referenced this pull request Apr 10, 2024
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
uk-bolly added a commit that referenced this pull request Apr 10, 2024
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
@uk-bolly uk-bolly mentioned this pull request Apr 10, 2024
uk-bolly added a commit that referenced this pull request Apr 15, 2024
* Issue #170, PR #181 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* issue #182, PR #183 thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PR #180 thanks to @ipruteanu-sie and @raabf

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Addressed PR #165 thanks to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PT #184 addressed thansk to @ipruteanu-sie

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated credits

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* typo and ssh allow_deny comments

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* enable OS check

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* PR - #198 addressed thanks to @brakkio86

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Addressed issue #190

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* Additional vars for issue #190

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated pre-commit version

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* consistent quotes around mode

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* moved audit added discoveries

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* removed unneeded vars

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* audit moved to prelim

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* tidy up

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* improved new variable usage

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* fixed logic 6.2.10

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* addressed #197 thanks to @mark-tomich

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updates for audit section

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* fixed naming

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

* added prelim to includes

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

---------

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
uk-bolly added a commit that referenced this pull request Jun 5, 2024
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This was referenced Jun 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants