<commit_before>---
# NCNR Specific Tasks

- name: "NCNR | Allow incoming pings"
  firewalld:
      rich_rule: 'ipv4 filter IN_drop_allow 0 -p icmp -m icmp --icmp-type 8 -j ACCEPT'
      permanent: true
      state: enabled
  notify: restart firewalld
  when: ncnrcis_allow_pings
  tags:
    - level1
    - pings
    - patch
    - ncnr

- name: "NCNR | Create tenscan user"
  user:
      name: tenscan
      groups: wheel
      state: present
  when: ncnrcis_install_tenscan
  tags: 
    - level1
    - tenscan
    - patch
    - ncnr

- name: "NCNR | Set tenscan user RSA key"
  authorized_key:
      user: tenscan
      key: http://network.ncnr.nist.gov/tenscan_rsa.pub
      state: present
  when: ncnrcis_install_tenscan
  tags: 
    - level1
    - tenscan
    - patch
    - ncnr

- name: "NCNR | Install mail client so that system status messages can be sent"
  yum:
      name: mailx
      state: latest
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set files to 644 so tenable can read them"
  file:
      dest: "{{ item }}"
      state: file
      owner: root
      group: root
      mode: 0644
  with_items:
      - /etc/modprobe.d/CIS.conf
      - /etc/audit/auditd.conf
      - /etc/default/useradd
      - /var/spool/cron/root
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set directories to 755 so tenable can read them"
  file:
      dest: "{{ item }}"
      state: directory
      owner: root
      group: root
      mode: 0755
  with_items:
      - /etc/audit
      - /var/spool/cron
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set daemon umask to 027 because tenable wants it that way"
  lineinfile:
      state: present
      dest: "{{ item }}"
      regexp: '^umask'
      line: 'umask 027'
  with_items: 
      - /etc/sysconfig/init
  when: ncnrcis_config_umask
  tags:
      - level1
      - level2
      - patch
      - ncnr
      - umask
  
- name: "NCNR | Ensure BigFix is installed"
  command: rpm -q BESAgent
  register: bes_check    
  ignore_errors: yes
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Copy bigfix install file if x86_64"
  unarchive:
      src: http://network.ncnr.nist.gov/bigfix-rhe5.x86_64.tar
      dest: /tmp/
      remote_src: true
  when: (ansible_architecture == "x86_64" and bes_check.rc == 1) and ncnrcis_install_bigfix
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Copy bigfix install file if i386"
  unarchive:
      src: http://network.ncnr.nist.gov/bigfix-rhe5.i686.tar
      dest: /tmp/
      remote_src: true
  when: (ansible_architecture == "i386" and bes_check.rc == 1) and ncnrcis_install_bigfix
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Runs bigfix install script"
  command: /tmp/bigfix/NIST_Installation_Script.sh
  args:   
      chdir: /tmp/bigfix/
  when: (bes_check.rc == 1 and ncnrcis_install_bigfix)
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Delete bigfix install files"
  file:
      dest: "{{ item }}"
      state: absent
  with_items:
      - /tmp/bigfix
      - /tmp/bigfix.tar
  when: (bes_check.rc == 1 and ncnrcis_install_bigfix)
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Ensure BigFix is running"
  service:
      name: besclient
      state: started
      enabled: yes
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Install EPEL repository"
  yum:
      name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
      state: present
  tags:
      - level1
      - epel
      - patch
      - ncnr

- name: "NCNR | Manage EPEL Repository settings"
  ini_file:
      dest: /etc/yum.repos.d/epel.repo
      section: epel
      option: enabled
      value: '0'
  tags:
      - level1
      - epel
      - patch
      - ncnr

- name: "NCNR | Ensure ClamAV is installed"
  yum:
      name: 
        - clamav
        - clamav-scanner-systemd
        - clamav-update
      enablerepo: epel
      state: latest
  register: just_installed_clamav
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Ensure Python semanage libraries are installed as needed to configure ClamAV"
  yum:
      name: libsemanage-python
      state: latest
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Give ClamAV access to all files in SELinux"
  seboolean:
      name: "{{ item }}"
      state: yes
      persistent: yes
  with_items:
      - antivirus_can_scan_system
      - clamd_use_jit
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Edit ClamAV config files"
  replace:
      dest: "{{ item.file }}"
      regexp: "{{ item.exp }}"
      replace: "{{ item.to }}"
  with_items:
      - { file: '/etc/clamd.d/scan.conf', exp: '^Example(.*)', to: '#Example\1' }
      - { file: '/etc/freshclam.conf', exp: '^Example(.*)', to: '#Example\1' }
      - { file: '/etc/clamd.d/scan.conf', exp: '^#LocalSocket /var/run(.*)$', to: 'LocalSocket /var/run\1' }
      - { file: '/etc/clamd.d/scan.conf', exp: '^#FixStaleSocket(.*)$', to: 'FixStaleSocket\1' }
      - { file: '/etc/sysconfig/freshclam', exp: '^(FRESHCLAM_DELAY.*)', to: '#\1' }
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Add clamscan to the clamupdate group so it can read the definitions files"
  user: 
      name: clamscan
      groups: clamupdate
      append: yes
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Get fresh ClamAV definitions for the first time"
  command: /bin/freshclam --quiet -l /var/log/freshclam.log
  when: just_installed_clamav.changed
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Ensure the ClamAV Scanning service is started and enabled"
  service:
      name: clamd@scan
      state: started
      enabled: yes
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Make a directory to store ClamAV scan log files"
  file: 
      dest: /var/log/clamav
      owner: clamscan
      group: clamscan
      state: directory
      mode: 0755
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Copy the file for daily /home scans and weekly / scans"
  copy:
      src: etc/cron.daily/clamscan.sh
      dest: /etc/cron.daily/clamscan.sh
      owner: root
      group: root
      mode: 0755
  tags:
      - level1
      - clamav
      - patch
      - ncnr
<commit_msg>firewalld config<commit_after>---
# NCNR Specific Tasks

- name: "NCNR | Allow incoming pings"
  firewalld:
      rich_rule: 'ipv4 filter IN_drop_allow 0 -p icmp -m icmp --icmp-type 8 -j ACCEPT'
      permanent: true
      state: enabled
      zone: drop
      immediate: true
  notify: restart firewalld
  when: ncnrcis_allow_pings
  tags:
    - level1
    - pings
    - patch
    - ncnr

- name: "NCNR | Create tenscan user"
  user:
      name: tenscan
      groups: wheel
      state: present
  when: ncnrcis_install_tenscan
  tags: 
    - level1
    - tenscan
    - patch
    - ncnr

- name: "NCNR | Set tenscan user RSA key"
  authorized_key:
      user: tenscan
      key: http://network.ncnr.nist.gov/tenscan_rsa.pub
      state: present
  when: ncnrcis_install_tenscan
  tags: 
    - level1
    - tenscan
    - patch
    - ncnr

- name: "NCNR | Install mail client so that system status messages can be sent"
  yum:
      name: mailx
      state: latest
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set files to 644 so tenable can read them"
  file:
      dest: "{{ item }}"
      state: file
      owner: root
      group: root
      mode: 0644
  with_items:
      - /etc/modprobe.d/CIS.conf
      - /etc/audit/auditd.conf
      - /etc/default/useradd
      - /var/spool/cron/root
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set directories to 755 so tenable can read them"
  file:
      dest: "{{ item }}"
      state: directory
      owner: root
      group: root
      mode: 0755
  with_items:
      - /etc/audit
      - /var/spool/cron
  tags:
      - level1
      - patch
      - ncnr

- name: "NCNR | Set daemon umask to 027 because tenable wants it that way"
  lineinfile:
      state: present
      dest: "{{ item }}"
      regexp: '^umask'
      line: 'umask 027'
  with_items: 
      - /etc/sysconfig/init
  when: ncnrcis_config_umask
  tags:
      - level1
      - level2
      - patch
      - ncnr
      - umask
  
- name: "NCNR | Ensure BigFix is installed"
  command: rpm -q BESAgent
  register: bes_check    
  ignore_errors: yes
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Copy bigfix install file if x86_64"
  unarchive:
      src: http://network.ncnr.nist.gov/bigfix-rhe5.x86_64.tar
      dest: /tmp/
      remote_src: true
  when: (ansible_architecture == "x86_64" and bes_check.rc == 1) and ncnrcis_install_bigfix
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Copy bigfix install file if i386"
  unarchive:
      src: http://network.ncnr.nist.gov/bigfix-rhe5.i686.tar
      dest: /tmp/
      remote_src: true
  when: (ansible_architecture == "i386" and bes_check.rc == 1) and ncnrcis_install_bigfix
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Runs bigfix install script"
  command: /tmp/bigfix/NIST_Installation_Script.sh
  args:   
      chdir: /tmp/bigfix/
  when: (bes_check.rc == 1 and ncnrcis_install_bigfix)
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Delete bigfix install files"
  file:
      dest: "{{ item }}"
      state: absent
  with_items:
      - /tmp/bigfix
      - /tmp/bigfix.tar
  when: (bes_check.rc == 1 and ncnrcis_install_bigfix)
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Ensure BigFix is running"
  service:
      name: besclient
      state: started
      enabled: yes
  tags:
      - level1
      - bigfix
      - patch
      - ncnr

- name: "NCNR | Install EPEL repository"
  yum:
      name: https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
      state: present
  tags:
      - level1
      - epel
      - patch
      - ncnr

- name: "NCNR | Manage EPEL Repository settings"
  ini_file:
      dest: /etc/yum.repos.d/epel.repo
      section: epel
      option: enabled
      value: '0'
  tags:
      - level1
      - epel
      - patch
      - ncnr

- name: "NCNR | Ensure ClamAV is installed"
  yum:
      name: 
        - clamav
        - clamav-scanner-systemd
        - clamav-update
      enablerepo: epel
      state: latest
  register: just_installed_clamav
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Ensure Python semanage libraries are installed as needed to configure ClamAV"
  yum:
      name: libsemanage-python
      state: latest
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Give ClamAV access to all files in SELinux"
  seboolean:
      name: "{{ item }}"
      state: yes
      persistent: yes
  with_items:
      - antivirus_can_scan_system
      - clamd_use_jit
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Edit ClamAV config files"
  replace:
      dest: "{{ item.file }}"
      regexp: "{{ item.exp }}"
      replace: "{{ item.to }}"
  with_items:
      - { file: '/etc/clamd.d/scan.conf', exp: '^Example(.*)', to: '#Example\1' }
      - { file: '/etc/freshclam.conf', exp: '^Example(.*)', to: '#Example\1' }
      - { file: '/etc/clamd.d/scan.conf', exp: '^#LocalSocket /var/run(.*)$', to: 'LocalSocket /var/run\1' }
      - { file: '/etc/clamd.d/scan.conf', exp: '^#FixStaleSocket(.*)$', to: 'FixStaleSocket\1' }
      - { file: '/etc/sysconfig/freshclam', exp: '^(FRESHCLAM_DELAY.*)', to: '#\1' }
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Add clamscan to the clamupdate group so it can read the definitions files"
  user: 
      name: clamscan
      groups: clamupdate
      append: yes
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Get fresh ClamAV definitions for the first time"
  command: /bin/freshclam --quiet -l /var/log/freshclam.log
  when: just_installed_clamav.changed
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Ensure the ClamAV Scanning service is started and enabled"
  service:
      name: clamd@scan
      state: started
      enabled: yes
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Make a directory to store ClamAV scan log files"
  file: 
      dest: /var/log/clamav
      owner: clamscan
      group: clamscan
      state: directory
      mode: 0755
  tags:
      - level1
      - clamav
      - patch
      - ncnr

- name: "NCNR | Copy the file for daily /home scans and weekly / scans"
  copy:
      src: etc/cron.daily/clamscan.sh
      dest: /etc/cron.daily/clamscan.sh
      owner: root
      group: root
      mode: 0755
  tags:
      - level1
      - clamav
      - patch
      - ncnr

{'fraction_non_alphanumeric': 0.10875170635522524, 'fraction_numerical': 0.013650841801911118, 'mean_word_length': 1.7797217537942664, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4461818', 'n_tokens_mistral': 4948, 'n_tokens_neox': 4800, 'n_words': 1231}