STIG/stig-ubuntu-apache2.yml at main · techc0de/STIG · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
- hosts: aws-servers
  # become_user:
  become_method: sudo
  become: yes

  vars_files:
    - private/passwords.yml
    - group_vars/aws_ec2.yml
  vars:
    output_path: "/tmp/stig-{{ansible_hostname}}.txt"
    update_int: '\d+'
    security_int: ';\d+'
  pre_tasks:

    - name: install required packages
      become: true
      package:
        name:
          - ntp
          - ntpdate
          - aide
          - auditd
          - audispd-plugins
        state: present
        update_cache: yes
        cache_valid_time: 3600
        dpkg_options: 'force-confnew'

  tasks:

    - name: check for graphical interface
      stat:
        path: /etc/X11/default-display-manager
      register: dm_file

    - name: check to see if we are booting with EFI or UEFI
      set_fact:
        booted_with_efi: "{{ ansible_mounts | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}"
        has_display: "{{ dm_file.stat.exists }}"

    # enable a config file: a2enconf extra-stigs.conf
    # disable a config file: a2disconf charset.conf
    # show loaded modules and configs: apachectl -D DUMP_INCLUDES

    - include_tasks: tasks/stig/Apache2/V-214228.yml
    - include_tasks: tasks/stig/Apache2/V-214229.yml
    - include_tasks: tasks/stig/Apache2/V-214230.yml
    - include_tasks: tasks/stig/Apache2/V-214231.yml
    - include_tasks: tasks/stig/Apache2/V-214232.yml
    - include_tasks: tasks/stig/Apache2/V-214236.yml
    - include_tasks: tasks/stig/Apache2/V-214239.yml
    - include_tasks: tasks/stig/Apache2/V-214241.yml
    - include_tasks: tasks/stig/Apache2/V-214242.yml
    - include_tasks: tasks/stig/Apache2/V-214243.yml
    - include_tasks: tasks/stig/Apache2/V-214244.yml
    - include_tasks: tasks/stig/Apache2/V-214245.yml
    - include_tasks: tasks/stig/Apache2/V-214250.yml
    - include_tasks: tasks/stig/Apache2/V-214252.yml
    - include_tasks: tasks/stig/Apache2/V-214253.yml
    - include_tasks: tasks/stig/Apache2/V-214255.yml
    - include_tasks: tasks/stig/Apache2/V-214256.yml
    - include_tasks: tasks/stig/Apache2/V-214257.yml
    - include_tasks: tasks/stig/Apache2/V-214258.yml
    - include_tasks: tasks/stig/Apache2/V-214265.yml
    - include_tasks: tasks/stig/Apache2/V-214267.yml
    - include_tasks: tasks/stig/Apache2/V-214268.yml
    - include_tasks: tasks/stig/Apache2/V-214269.yml
    - include_tasks: tasks/stig/Apache2/V-214271.yml
    - include_tasks: tasks/stig/Apache2/V-214273.yml
    - include_tasks: tasks/stig/Apache2/V-214274.yml


    # - include: "{{ item }}"
    #   with_fileglob:
    # # #     - /home/thuan/projects/sec/fix_snmp.yml
    # #     #  - /home/thuan/projects/sec/upgrade_kernel.yml
    #     - /home/thuan/projects/sec/dropbear.yml
        # - /home/thuan/projects/sec/manage_engine_agent_installation.yml