<commit_before>---
# Copyright 2015, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: V-38475 - Set minimum length for passwords
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MIN_LEN"
    line: "PASS_MIN_LEN {{ password_minimum_length }}"
  when: password_minimum_length is defined
  tags:
    - auth
    - cat2
    - V-38475

- name: V-38477 - Set minimum time for password changes
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MIN_DAYS"
    line: "PASS_MIN_DAYS {{ password_minimum_days }}"
  when: password_minimum_days is defined
  tags:
    - auth
    - cat2
    - V-38477

- name: V-38479 - Set maximum age for passwords
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MAX_DAYS"
    line: "PASS_MAX_DAYS {{ password_maximum_days }}"
  when: password_maximum_days is defined
  tags:
    - auth
    - cat2
    - V-38479

- name: V-38480 - Warn users prior to password expiration
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_WARN_DAYS"
    line: "PASS_WARN_DAYS {{ password_warn_age }}"
  when: password_warn_age is defined
  tags:
    - auth
    - cat3
    - V-38480

# The awk line here comes from the STIG itself. It does the following:
#  * splits each line of /etc/shadow on colons (:)
#  * ignores any lines that start with root
#  * searches 2nd field (password) for accounts that don't start with ! (that
#    would be a locked account)
#  * returns a list of those accounts other than root which aren't locked
# This list should be completely empty for a properly secured system.
- name: Check for default system accounts other than root that aren't locked (for V-38496)
  shell: "awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1 \":\" $2}' /etc/shadow | wc -l"
  register: v38496_result
  changed_when: v38496_result.stdout != '0'
  failed_when: False
  always_run: True
  tags:
    - auth
    - cat2
    - V-38496

# The playbook will fail here if any default system accounts besides root are
# not locked.
- name: V-38496 - Default operating system accounts (other than root) must be locked
  fail:
    msg: "FAILED: Lock default system user accounts (other than root)"
  when: v38496_result.stdout != '0'
  tags:<commit_msg>Improved search for unlocked system accounts<commit_after>---
# Copyright 2015, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

- name: V-38475 - Set minimum length for passwords
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MIN_LEN"
    line: "PASS_MIN_LEN {{ password_minimum_length }}"
  when: password_minimum_length is defined
  tags:
    - auth
    - cat2
    - V-38475

- name: V-38477 - Set minimum time for password changes
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MIN_DAYS"
    line: "PASS_MIN_DAYS {{ password_minimum_days }}"
  when: password_minimum_days is defined
  tags:
    - auth
    - cat2
    - V-38477

- name: V-38479 - Set maximum age for passwords
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_MAX_DAYS"
    line: "PASS_MAX_DAYS {{ password_maximum_days }}"
  when: password_maximum_days is defined
  tags:
    - auth
    - cat2
    - V-38479

- name: V-38480 - Warn users prior to password expiration
  lineinfile:
    dest: /etc/login.defs
    regexp: "^(#)?PASS_WARN_DAYS"
    line: "PASS_WARN_DAYS {{ password_warn_age }}"
  when: password_warn_age is defined
  tags:
    - auth
    - cat3
    - V-38480

- name: V-38496 - Get all system accounts
  shell: "awk -F: '$1 !~ /^root$/ && $3 < 500 {print $1}' /etc/passwd"
  register: v38496_system_users
  always_run: True
  tags:
    - auth
    - cat2
    - V-38496

- name: V-38496 - Loop through system accounts to find unlocked accounts
  shell: "awk -F: '$1 ~ /^{{ item }}$/ && $2 !~ /^[!*]/ {print $1}' /etc/shadow"
  register: v38496_unlocked_system_users
  always_run: True
  with_items: v38496_system_users.stdout_lines
  tags:
    - auth
    - cat2
    - V-38496

- name: V-38496 - Gather problematic system accounts
  set_fact:
    v38496_violations: |
      {% for i in v38496_unlocked_system_users.results %}
      {% if i.stdout|length > 0 %}
      {{ i.stdout }}
      {% endif %}
      {% endfor %}
  tags:
    - auth
    - cat2
    - V-38496

# The playbook will fail here if any default system accounts besides root are
# not locked.
- name: V-38496 - Default operating system accounts (other than root) must be locked
  fail:
    msg: "FAILED: System accounts are unlocked: {{ v38496_violations|trim|replace('\n',', ') }}"
  when: v38496_violations|length > 0
  tags:
{'fraction_non_alphanumeric': 0.10632183908045977, 'fraction_numerical': 0.04058908045977012, 'mean_word_length': 3.091844232182219, 'pattern_counts': {'":': 1, '<': 4, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5236802', 'n_tokens_mistral': 1990, 'n_tokens_neox': 1815, 'n_words': 621}