Add Debian 13 and Ubuntu 26.04 CIS-inspired hardening playbook

2026-05-06 08:56:45 +00:00
parent 75a11f7650
commit 2fd9c0b5ef
15 changed files with 778 additions and 0 deletions
@@ -0,0 +1,23 @@
+---
+- name: Build sudo hardening directives
+  ansible.builtin.set_fact:
+    cis_sudo_directives: >-
+      {{
+        ([{'regexp': '^Defaults\s+use_pty', 'line': 'Defaults use_pty'}]
+         if cis_sudo_use_pty | bool else [])
+        + [{'regexp': '^Defaults\s+logfile=', 'line': 'Defaults logfile="' ~ cis_sudo_logfile ~ '"'}]
+      }}
+
+- name: Configure sudo hardening drop-in
+  ansible.builtin.lineinfile:
+    path: "{{ cis_sudoers_dropin_path }}"
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    create: true
+    owner: root
+    group: root
+    mode: "0440"
+    validate: /usr/sbin/visudo -cf %s
+  loop: "{{ cis_sudo_directives }}"
+  loop_control:
+    label: "{{ item.line }}"