<commit_before># Not automated
#- name: "MEDIUM | V-38439 | The system must provide automated support for account management functions."

- name: "MEDIUM | V-38443 | PATCH | The /etc/gshadow file must be owned by root."
  file:
      path: /etc/gshadow
      owner: root
  tags:
      - cat2
      - medium
      - V-38443
      - patch
      - file_perms

- block:
    - name: "MEDIUM | V-38444 | AUDIT | iptables module is not idempotent for Policy actions currently"
      shell: ip6tables -S | grep '\-P INPUT' | cut -d ' ' -f 3
      changed_when: no
      failed_when: no
      check_mode: no
      register: ip6tables_input_chain_policy_check

    - name: "MEDIUM | V-38444 | PATCH | The systems local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets."
      iptables:
          chain: INPUT
          ip_version: ipv6
          policy: DROP
      when: "ip6tables_input_chain_policy_check.stdout != 'DROP'"
      notify: save ip6tables rules
  when:
      - rhel6stig_ipv6_required
  tags:
      - cat2
      - medium
      - V-38444
      - ipv6
      - firewall
      - network
      - patch

- block:
    - name: "PRELIM | Get path of auditd log file"
      shell: "grep '^log_file' /etc/audit/auditd.conf | sed s/^[^\\/]*//"
      changed_when: no
      check_mode: no
      register: auditd_logfile

    - name: "MEDIUM | V-38445 | PATCH | Audit log files must be group-owned by root."
      file:
          path: "{{ auditd_logfile.stdout }}"
          group: root
  tags:
      - cat2
      - medium
      - V-38445
      - log_files
      - auditd
      - patch

- name: "MEDIUM | V-38446 | PATCH | The mail system must forward all mail for root to one or more system administrators."
  lineinfile:
      dest: /etc/aliases
      line: 'root: {{ rhel6stig_root_email_address }}'
      state: present
  tags:
      - cat2
      - medium
      - V-38446
      - sendmail

- name: "MEDIUM | V-38448 | PATCH | The /etc/gshadow file must be group-owned by root."
  file:
      path: /etc/gshadow
      group: root
  tags:
    - cat2
    - medium
    - V-38448
    - patch
    - file_perms

- name: "MEDIUM | V-38449 | PATCH | The /etc/gshadow file must have mode 0000"
  file:
      path: /etc/gshadow
      mode: "0000"
  tags:
    - cat2
    - medium
    - V-38449
    - patch
    - file_perms

- name: "MEDIUM | V-38450 | PATCH | The /etc/passwd file be owned by root"
  file:
      path: /etc/passwd
      owner: root
  tags:
    - cat2
    - medium
    - V-38450
    - patch
    - file_perms

- name: "MEDIUM | V-38451 | PATCH | The /etc/passwd file be group-owned by root"
  file:
      path: /etc/passwd
      group: root
  tags:
    - cat2
    - medium
    - V-38451
    - patch
    - file_perms

- name: "MEDIUM | V-38457 | PATCH | The /etc/passwd file must have mode 0644 or less permissive"
  file:
      path: /etc/passwd
      mode: "u-x,g-wx,o-wx"
  tags:
    - cat2
    - medium
    - V-38457
    - patch
    - file_perms

- name: "MEDIUM | V-38458 | PATCH | The /etc/group file be owned by root"
  file:
      path: /etc/group
      owner: root
  tags:
    - cat2
    - medium
    - V-38458
    - patch
    - file_perms

- name: "MEDIUM | V-38459 | PATCH | The /etc/group file be group-owned by root"
  file:
      path: /etc/group
      group: root
  tags:
    - cat2
    - medium
    - V-38459
    - patch
    - file_perms

- name: "MEDIUM | V-38461 | PATCH | The /etc/group file must have mode 0644 or less permissive"
  file:
      path: /etc/group
      mode: "u-x,g-wx,o-wx"
  tags:
      - cat2
      - medium
      - V-38461
      - patch
      - file_perms

- name: "MEDIUM | V-38464 | PATCH | The audit system must take appropriate action when there are disk errors on the audit storage volume."
  lineinfile:
      regexp: '(^disk_error_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["disk_full_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38464
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38465 | AUDIT | Library files must have mode 0755 or less permissive"
      shell: find -L /{lib,lib64,usr/{lib,lib64}/,usr/local/{lib,lib64}}/ -type f -links -2 -perm /022 -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_lib_perms_audit

    - name: "MEDIUM | V-38465 | PATCH | Library files must have mode 0755 or less permissive"
      file:
          state: file
          mode: "go-w"
          path: "{{ item }}"
      when: sys_lib_perms_audit.stdout
      with_items: "{{ sys_lib_perms_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38465
      - patch
      - file_perms

- block:
    - name: "MEDIUM | V-38466 | AUDIT | Library files must be owned by root"
      shell: find -L /{lib,lib64,usr/{lib,lib64}/,usr/local/{lib,lib64}}/ -type f -links -2 \! -user root -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_lib_owner_audit

    - name: "MEDIUM | V-38466 | PATCH | Library files must be owned by root"
      file:
          state: file
          owner: "root"
          path: "{{ item }}"
      when: sys_lib_owner_audit.stdout
      with_items: "{{ sys_lib_owner_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38466
      - patch
      - file_perms

- name: "MEDIUM | V-38468 | PATCH | The audit system must take appropriate action when the audit storage volume is full."
  lineinfile:
      regexp: '(^disk_full_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["disk_full_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38468
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38469 | AUDIT | All system command files must have mode 755 or less permissive."
      shell: find -L /{sbin,bin,usr/{sbin,bin}/,usr/local/{sbin,bin}}/ -type f -links -2 -perm /022 -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_command_perms_audit

    - name: "MEDIUM | V-38469 | PATCH | All system command files must have mode 755 or less permissive"
      file:
          state: file
          mode: "og-w"
          path: "{{ item }}"
      when: sys_command_perms_audit.stdout
      with_items: "{{ sys_command_perms_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38469
      - patch
      - file_perms

- name: "MEDIUM | V-38470 | PATCH | The audit system must alert designated staff members when the audit storage volume approaches capacity."
  lineinfile:
      regexp: '(^space_left_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["space_left_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38470
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38472 | AUDIT | All system command files must be owned by root"
      shell: find -L /{sbin,bin,usr/{sbin,bin}/,usr/local/{sbin,bin}}/ -type f -links -2 \! -user root -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_command_owner_audit

    - name: "MEDIUM | V-38472 | PATCH | All system command files must be owned by root"
      file:
          state: file
          path: "{{item}}"
          owner: root
      when: sys_command_owner_audit.stdout
      with_items: "{{ sys_command_owner_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38472
      - patch
      - file_perms

- name: "MEDIUM | V-38475 | PATCH | The system must require passwords to contain a minimum of 14 characters."
  lineinfile:
      regexp: '(^PASS_MIN_LEN)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_min_length }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38475
      - patch
      - passwords

- name: "MEDIUM | V-38477 | PATCH | Users must not be able to change passwords more than once every 24 hours."
  lineinfile:
      regexp: '(^PASS_MIN_DAYS)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_min_days }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38477
      - patch
      - passwords

- name: "MEDIUM | V-38479 | PATCH | User passwords must be changed at least every 60 days."
  lineinfile:
      regexp: '(^PASS_MAX_DAYS)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_max_days }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38479
      - patch
      - passwords

- name: "MEDIUM | V-38481 | PATCH | System security patches and updates must be installed and up-to-date."
  yum:
      name: '*'
      state: latest
      update_cache: yes
  when: rhel6stig_update_all_packages
  tags:
      - cat2
      - medium
      - V-38481
      - patch
      - yum
      - updates

- block:
    - name: "MEDIUM | V-38483 | AUDIT | The system package management tool must cryptographically verify the authenticity of system software packages during installation."
      shell: find /etc/yum{.conf,.repos.d/} -exec grep -ls '^gpgcheck=0' {} \;
      changed_when: false
      check_mode: no
      register: repo_crypto_check_audit

    - name: "MEDIUM | V-38483 | PATCH | The system package management tool must cryptographically verify the authenticity of system software packages during installation."
      replace:
          backup: yes
          dest: '{{ item }}'
          regexp: '^gpgcheck=0'
          replace: 'gpgcheck=1'
      with_flattened:
        - /etc/yum.conf
        - "{{ repo_crypto_check_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38483
      - patch
      - rpm
      - gpgcheck

- name: "MEDIUM | V-38484 | PATCH | The operating system, upon successful logon, must display to the user the date and time of the last logon or access via ssh."
  lineinfile:
      state: present
      dest: /etc/ssh/sshd_config
      regexp: '^#?PrintLastLog'
      line: PrintLastLog yes
      validate: sshd -t -f %s
  tags:
      - cat2
      - medium
      - patch
      - V-38484
      - sshd

# Not automated
#- name: "MEDIUM | V-38486 | The operating system must conduct backups of system-level information contained in the information system per organization defined frequency to conduct backups that are consistent with recovery time and recovery point objectives."

# Not automated
#- name: "MEDIUM | V-38488 | The operating system must conduct backups of user-level information contained in the operating system per organization defined frequency to conduct backups consistent with recovery time and recovery point objectives."

- name: "MEDIUM | V-38489 | PATCH | A file integrity tool must be installed."
  yum:
      name: aide
      state: present
  notify: init aide
  tags:
      - cat2
      - medium
      - V-38489
      - patch
      - aide
      - integrity

- name: "MEDIUM | V-38490 | PATCH | The operating system must enforce requirements for the connection of mobile devices to operating systems."
  copy:
      content: install usb-storage /bin/true
      dest: /etc/modprobe.d/disable-usb.conf
      owner: root
      group: root
      mode: "0644"
  tags:
      - cat2
      - medium
      - V-38490
      - mobile_devices
      - usb_devices
      - kernel_modules
      - patch

- name: "MEDIUM | V-38492 | PATCH | The system must prevent the root account from logging in from virtual consoles"
  lineinfile:
      state: absent
      dest: /etc/securetty
      regexp: '^.*vc/?\d'
      backup: yes
  tags:
      - cat2
      - medium
      - V-38492
      - root_access
      - logon_settings
      - tty
      - virtual_consoles
      - medium
      - patch

- block:
    - name: "MEDIUM | V-38493 | AUDIT | Audit log directories must have mode 0755 or less permissive."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed 's/^[^/]*//; s/[^/]*$//' | xargs -I % find % -type d -perm /022
      changed_when: no
      check_mode: no
      failed_when: no
      register: audit_log_dir_perms_audit

    - name: "MEDIUM | V-38493 | PATCH | Audit log directories must have mode 0755 or less permissive."
      file:
          state: directory
          mode: "go-w"
          path: "{{ item }}"
      with_items: "{{ audit_log_dir_perms_audit.stdout_lines }}"
      when: audit_log_dir_perms_audit.stdout
  tags:
      - cat2
      - medium
      - V-38493
      - patch
      - file_perms
      - auditd
      - audit_permissions

- block:
    - name: "MEDIUM | V-38495 | AUDIT | Audit log files must be owned by root."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed 's/^[^/]*//; s/[^/]*$//' | xargs -I % find % -type f ! -user root
      changed_when: no
      check_mode: no
      failed_when: no
      register: audit_log_dir_owner_audit

    - name: "MEDIUM | V-38495 | PATCH | Audit log files must be owned by root."
      file:
          state: file
          owner: root
          path: "{{ item }}"
      with_items: "{{ audit_log_dir_owner_audit.stdout_lines }}"
      when: audit_log_dir_owner_audit.stdout
  tags:
      - cat2
      - medium
      - V-38495
      - patch
      - file_perms
      - auditd
      - audit_permissions

- block:
    - name: "MEDIUM | V-38496 | AUDIT | Default system accounts, other than root, must be locked"
      shell: >
       awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1}' /etc/shadow | xargs -I{} grep {} /etc/passwd | awk -F: '$3 < 500 {print $1}'
      changed_when: no
      failed_when: no
      check_mode: no
      register: unlocked_sys_accounts_audit

    - name: "MEDIUM | V-38496 | PATCH | Default system accounts, other than root, must be locked"
      user:
          name: "{{ item }}"
          state: present
          expires: 1412541480
      with_items: "{{ unlocked_sys_accounts_audit.stdout_lines }}"
      when: unlocked_sys_accounts_audit.stdout
  tags:
      - cat2
      - medium
      - V-38496
      - patch
      - accounts
      - system_accounts

- block:
    - name: "MEDIUM | V-38498 | AUDIT | Audit log files must have mode 0640 or less permissive."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//|xargs stat -c %n | xargs -I % find % -perm /137
      changed_when: no
      failed_when: no
      check_mode: no
      register: audit_log_file_perms_audit

    - name: "MEDIUM | V-38498 | PATCH | Audit log files must have mode 0640 or less permissive."
      file:
          state: file<commit_msg>fix password locking, improve check_mode<commit_after># Not automated
#- name: "MEDIUM | V-38439 | The system must provide automated support for account management functions."

- name: "MEDIUM | V-38443 | PATCH | The /etc/gshadow file must be owned by root."
  file:
      path: /etc/gshadow
      owner: root
  tags:
      - cat2
      - medium
      - V-38443
      - patch
      - file_perms

- block:
    - name: "MEDIUM | V-38444 | AUDIT | iptables module is not idempotent for Policy actions currently"
      shell: ip6tables -S | grep '\-P INPUT' | cut -d ' ' -f 3
      changed_when: no
      failed_when: no
      check_mode: no
      register: ip6tables_input_chain_policy_check

    - name: "MEDIUM | V-38444 | PATCH | The systems local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets."
      iptables:
          chain: INPUT
          ip_version: ipv6
          policy: DROP
      when: "ip6tables_input_chain_policy_check.stdout != 'DROP'"
      notify: save ip6tables rules
  when:
      - rhel6stig_ipv6_required
  tags:
      - cat2
      - medium
      - V-38444
      - ipv6
      - firewall
      - network
      - patch

- block:
    - name: "PRELIM | Get path of auditd log file"
      shell: "grep '^log_file' /etc/audit/auditd.conf | sed s/^[^\\/]*//"
      changed_when: no
      check_mode: no
      register: auditd_logfile

    - name: "MEDIUM | V-38445 | PATCH | Audit log files must be group-owned by root."
      file:
          path: "{{ auditd_logfile.stdout }}"
          group: root
  tags:
      - cat2
      - medium
      - V-38445
      - log_files
      - auditd
      - patch

- name: "MEDIUM | V-38446 | PATCH | The mail system must forward all mail for root to one or more system administrators."
  lineinfile:
      dest: /etc/aliases
      line: 'root: {{ rhel6stig_root_email_address }}'
      state: present
  tags:
      - cat2
      - medium
      - V-38446
      - sendmail

- name: "MEDIUM | V-38448 | PATCH | The /etc/gshadow file must be group-owned by root."
  file:
      path: /etc/gshadow
      group: root
  tags:
    - cat2
    - medium
    - V-38448
    - patch
    - file_perms

- name: "MEDIUM | V-38449 | PATCH | The /etc/gshadow file must have mode 0000"
  file:
      path: /etc/gshadow
      mode: "0000"
  tags:
    - cat2
    - medium
    - V-38449
    - patch
    - file_perms

- name: "MEDIUM | V-38450 | PATCH | The /etc/passwd file be owned by root"
  file:
      path: /etc/passwd
      owner: root
  tags:
    - cat2
    - medium
    - V-38450
    - patch
    - file_perms

- name: "MEDIUM | V-38451 | PATCH | The /etc/passwd file be group-owned by root"
  file:
      path: /etc/passwd
      group: root
  tags:
    - cat2
    - medium
    - V-38451
    - patch
    - file_perms

- name: "MEDIUM | V-38457 | PATCH | The /etc/passwd file must have mode 0644 or less permissive"
  file:
      path: /etc/passwd
      mode: "u-x,g-wx,o-wx"
  tags:
    - cat2
    - medium
    - V-38457
    - patch
    - file_perms

- name: "MEDIUM | V-38458 | PATCH | The /etc/group file be owned by root"
  file:
      path: /etc/group
      owner: root
  tags:
    - cat2
    - medium
    - V-38458
    - patch
    - file_perms

- name: "MEDIUM | V-38459 | PATCH | The /etc/group file be group-owned by root"
  file:
      path: /etc/group
      group: root
  tags:
    - cat2
    - medium
    - V-38459
    - patch
    - file_perms

- name: "MEDIUM | V-38461 | PATCH | The /etc/group file must have mode 0644 or less permissive"
  file:
      path: /etc/group
      mode: "u-x,g-wx,o-wx"
  tags:
      - cat2
      - medium
      - V-38461
      - patch
      - file_perms

- name: "MEDIUM | V-38464 | PATCH | The audit system must take appropriate action when there are disk errors on the audit storage volume."
  lineinfile:
      regexp: '(^disk_error_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["disk_full_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38464
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38465 | AUDIT | Library files must have mode 0755 or less permissive"
      shell: find -L /{lib,lib64,usr/{lib,lib64}/,usr/local/{lib,lib64}}/ -type f -links -2 -perm /022 -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_lib_perms_audit

    - name: "MEDIUM | V-38465 | PATCH | Library files must have mode 0755 or less permissive"
      file:
          state: file
          mode: "go-w"
          path: "{{ item }}"
      when: sys_lib_perms_audit.stdout
      with_items: "{{ sys_lib_perms_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38465
      - patch
      - file_perms

- block:
    - name: "MEDIUM | V-38466 | AUDIT | Library files must be owned by root"
      shell: find -L /{lib,lib64,usr/{lib,lib64}/,usr/local/{lib,lib64}}/ -type f -links -2 \! -user root -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_lib_owner_audit

    - name: "MEDIUM | V-38466 | PATCH | Library files must be owned by root"
      file:
          state: file
          owner: "root"
          path: "{{ item }}"
      when: sys_lib_owner_audit.stdout
      with_items: "{{ sys_lib_owner_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38466
      - patch
      - file_perms

- name: "MEDIUM | V-38468 | PATCH | The audit system must take appropriate action when the audit storage volume is full."
  lineinfile:
      regexp: '(^disk_full_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["disk_full_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38468
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38469 | AUDIT | All system command files must have mode 755 or less permissive."
      shell: find -L /{sbin,bin,usr/{sbin,bin}/,usr/local/{sbin,bin}}/ -type f -links -2 -perm /022 -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_command_perms_audit

    - name: "MEDIUM | V-38469 | PATCH | All system command files must have mode 755 or less permissive"
      file:
          state: file
          mode: "og-w"
          path: "{{ item }}"
      when: sys_command_perms_audit.stdout
      with_items: "{{ sys_command_perms_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38469
      - patch
      - file_perms

- name: "MEDIUM | V-38470 | PATCH | The audit system must alert designated staff members when the audit storage volume approaches capacity."
  lineinfile:
      regexp: '(^space_left_action\s*=)(\s*)'
      line: '\1 {{ rhel6stig_auditd_config["space_left_action"] }}'
      dest: /etc/audit/auditd.conf
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38470
      - patch
      - auditd

- block:
    - name: "MEDIUM | V-38472 | AUDIT | All system command files must be owned by root"
      shell: find -L /{sbin,bin,usr/{sbin,bin}/,usr/local/{sbin,bin}}/ -type f -links -2 \! -user root -exec readlink -f {} \;
      check_mode: no
      changed_when: no
      failed_when: no
      register: sys_command_owner_audit

    - name: "MEDIUM | V-38472 | PATCH | All system command files must be owned by root"
      file:
          state: file
          path: "{{item}}"
          owner: root
      when: sys_command_owner_audit.stdout
      with_items: "{{ sys_command_owner_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38472
      - patch
      - file_perms

- name: "MEDIUM | V-38475 | PATCH | The system must require passwords to contain a minimum of 14 characters."
  lineinfile:
      regexp: '(^PASS_MIN_LEN)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_min_length }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38475
      - patch
      - passwords

- name: "MEDIUM | V-38477 | PATCH | Users must not be able to change passwords more than once every 24 hours."
  lineinfile:
      regexp: '(^PASS_MIN_DAYS)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_min_days }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38477
      - patch
      - passwords

- name: "MEDIUM | V-38479 | PATCH | User passwords must be changed at least every 60 days."
  lineinfile:
      regexp: '(^PASS_MAX_DAYS)\s*(\d*)'
      line: '\1 {{ rhel6stig_pass_max_days }}'
      dest: /etc/login.defs
      backrefs: yes
  tags:
      - cat2
      - medium
      - V-38479
      - patch
      - passwords

- name: "MEDIUM | V-38481 | PATCH | System security patches and updates must be installed and up-to-date."
  yum:
      name: '*'
      state: latest
      update_cache: yes
  when: rhel6stig_update_all_packages
  tags:
      - cat2
      - medium
      - V-38481
      - patch
      - yum
      - updates

- block:
    - name: "MEDIUM | V-38483 | AUDIT | The system package management tool must cryptographically verify the authenticity of system software packages during installation."
      shell: find /etc/yum{.conf,.repos.d/} -exec grep -ls '^gpgcheck=0' {} \;
      changed_when: false
      check_mode: no
      register: repo_crypto_check_audit

    - name: "MEDIUM | V-38483 | PATCH | The system package management tool must cryptographically verify the authenticity of system software packages during installation."
      replace:
          backup: yes
          dest: '{{ item }}'
          regexp: '^gpgcheck=0'
          replace: 'gpgcheck=1'
      with_flattened:
        - /etc/yum.conf
        - "{{ repo_crypto_check_audit.stdout_lines }}"
  tags:
      - cat2
      - medium
      - V-38483
      - patch
      - rpm
      - gpgcheck

- name: "MEDIUM | V-38484 | PATCH | The operating system, upon successful logon, must display to the user the date and time of the last logon or access via ssh."
  lineinfile:
      state: present
      dest: /etc/ssh/sshd_config
      regexp: '^#?PrintLastLog'
      line: PrintLastLog yes
      validate: sshd -t -f %s
  tags:
      - cat2
      - medium
      - patch
      - V-38484
      - sshd

# Not automated
#- name: "MEDIUM | V-38486 | The operating system must conduct backups of system-level information contained in the information system per organization defined frequency to conduct backups that are consistent with recovery time and recovery point objectives."

# Not automated
#- name: "MEDIUM | V-38488 | The operating system must conduct backups of user-level information contained in the operating system per organization defined frequency to conduct backups consistent with recovery time and recovery point objectives."

- name: "MEDIUM | V-38489 | PATCH | A file integrity tool must be installed."
  yum:
      name: aide
      state: present
  notify: init aide
  tags:
      - cat2
      - medium
      - V-38489
      - patch
      - aide
      - integrity

- name: "MEDIUM | V-38490 | PATCH | The operating system must enforce requirements for the connection of mobile devices to operating systems."
  copy:
      content: install usb-storage /bin/true
      dest: /etc/modprobe.d/disable-usb.conf
      owner: root
      group: root
      mode: "0644"
  tags:
      - cat2
      - medium
      - V-38490
      - mobile_devices
      - usb_devices
      - kernel_modules
      - patch

- name: "MEDIUM | V-38492 | PATCH | The system must prevent the root account from logging in from virtual consoles"
  lineinfile:
      state: absent
      dest: /etc/securetty
      regexp: '^.*vc/?\d'
      backup: yes
  tags:
      - cat2
      - medium
      - V-38492
      - root_access
      - logon_settings
      - tty
      - virtual_consoles
      - medium
      - patch

- block:
    - name: "MEDIUM | V-38493 | AUDIT | Audit log directories must have mode 0755 or less permissive."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed 's/^[^/]*//; s/[^/]*$//' | xargs -I % find % -type d -perm /022
      changed_when: no
      check_mode: no
      failed_when: no
      register: audit_log_dir_perms_audit

    - name: "MEDIUM | V-38493 | PATCH | Audit log directories must have mode 0755 or less permissive."
      file:
          state: directory
          mode: "go-w"
          path: "{{ item }}"
      with_items: "{{ audit_log_dir_perms_audit.stdout_lines }}"
      when: audit_log_dir_perms_audit.stdout
  tags:
      - cat2
      - medium
      - V-38493
      - patch
      - file_perms
      - auditd
      - audit_permissions

- block:
    - name: "MEDIUM | V-38495 | AUDIT | Audit log files must be owned by root."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed 's/^[^/]*//; s/[^/]*$//' | xargs -I % find % -type f ! -user root
      changed_when: no
      check_mode: no
      failed_when: no
      register: audit_log_dir_owner_audit

    - name: "MEDIUM | V-38495 | PATCH | Audit log files must be owned by root."
      file:
          state: file
          owner: root
          path: "{{ item }}"
      with_items: "{{ audit_log_dir_owner_audit.stdout_lines }}"
      when: audit_log_dir_owner_audit.stdout
  tags:
      - cat2
      - medium
      - V-38495
      - patch
      - file_perms
      - auditd
      - audit_permissions

- block:
    - name: "MEDIUM | V-38496 | AUDIT | Default system accounts, other than root, must be locked"
      shell: >
       awk -F: '$1 !~ /^root$/ && $2 !~ /^[!*]/ {print $1}' /etc/shadow | xargs -I{} grep {} /etc/passwd | awk -F: '$3 < 500 {print $1}'
      changed_when: unlocked_sys_accounts_audit.stdout
      failed_when: no
      check_mode: no
      register: unlocked_sys_accounts_audit

    - name: "MEDIUM | V-38496 | PATCH | Default system accounts, other than root, must be locked"
      command: passwd -l {{ item }}
      with_items: "{{ unlocked_sys_accounts_audit.stdout_lines }}"
      when: unlocked_sys_accounts_audit.stdout
  tags:
      - cat2
      - medium
      - V-38496
      - patch
      - accounts
      - system_accounts

- block:
    - name: "MEDIUM | V-38498 | AUDIT | Audit log files must have mode 0640 or less permissive."
      shell: grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//|xargs stat -c %n | xargs -I % find % -perm /137
      changed_when: no
      failed_when: no
      check_mode: no
      register: audit_log_file_perms_audit

    - name: "MEDIUM | V-38498 | PATCH | Audit log files must have mode 0640 or less permissive."
      file:
          state: file
{'fraction_non_alphanumeric': 0.10828660864779334, 'fraction_numerical': 0.03680643940696914, 'mean_word_length': 1.9854179502978024, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4176044', 'n_tokens_mistral': 10561, 'n_tokens_neox': 9882, 'n_words': 2832}