new files from source

Infrastrucutre as Code/Ansible/roles/cis_hardening/password_policy/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+# Password and PAM related hardening
+
+- name: Ensure password hashing algorithm is SHA512
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: "^ENCRYPT_METHOD"
+    line: "ENCRYPT_METHOD SHA512"
+    create: yes
+
+- name: Ensure PASS_MAX_DAYS is 365
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: "^PASS_MAX_DAYS"
+    line: "PASS_MAX_DAYS   365"
+    create: yes
+
+- name: Ensure PASS_MIN_DAYS is 7
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: "^PASS_MIN_DAYS"
+    line: "PASS_MIN_DAYS   7"
+    create: yes
+
+- name: Ensure PASS_WARN_AGE is 7
+  ansible.builtin.lineinfile:
+    path: /etc/login.defs
+    regexp: "^PASS_WARN_AGE"
+    line: "PASS_WARN_AGE   7"
+    create: yes
+
+- name: Ensure pwquality minlen and requirements
+  ansible.builtin.lineinfile:
+    path: /etc/security/pwquality.conf
+    regexp: "^minlen"
+    line: "minlen = 14"
+    create: yes
+
+- name: Ensure pwquality minclass (character classes) is 4
+  ansible.builtin.lineinfile:
+    path: /etc/security/pwquality.conf
+    regexp: "^minclass"
+    line: "minclass = 4"
+    create: yes
+
+- name: Ensure pam_faillock preauth is configured
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/system-auth
+    insertafter: "^auth.*required.*pam_unix.so"
+    line: "auth required pam_faillock.so preauth silent audit deny=5 unlock_time=900"
+    state: present
+    backrefs: no
+
+- name: Ensure pam_faillock authfail/account lines exist
+  ansible.builtin.blockinfile:
+    path: /etc/pam.d/system-auth
+    insertafter: "^auth.*required.*pam_unix.so"
+    block: |
+      auth [default=die] pam_faillock.so authfail deny=5 unlock_time=900 audit
+      account required pam_faillock.so