Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: #172 checks if ipv6.disable is present in GRUB_CMDLINE_LINUX bef… #173

Merged
merged 2 commits into from
Nov 23, 2023
Merged

fix: #172 checks if ipv6.disable is present in GRUB_CMDLINE_LINUX bef… #173

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f716f32
fix: #172 checks if ipv6.disable is present in GRUB_CMDLINE_LINUX bef…
Jason-Hendry Nov 14, 2023
4e67550
style: fix yamllint and align command and variable name to other task…
Jason-Hendry Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion tasks/section_3/cis_3.1.x.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,23 @@
register: ipv6disable_replaced
notify: Grub update

- name: "3.1.1 | PATCH | Ensure system is checked to determine if IPv6 is enabled | Check grub cmdline linux"
ansible.builtin.shell: grep "GRUB_CMDLINE_LINUX=" /etc/default/grub | cut -f2 -d'"'
changed_when: false
failed_when: false
check_mode: false
register: ubtu22cis_3_1_1_cmdline_settings
when: ubtu22cis_ipv6_disable == 'grub'

- name: "3.1.1 | PATCH | Ensure system is checked to determine if IPv6 is enabled | Insert ipv6.disable if it doesn't exist"
ansible.builtin.lineinfile:
path: /etc/default/grub
regexp: '^(GRUB_CMDLINE_LINUX=".*)"$'
line: '\1 ipv6.disable=1"'
backrefs: true
when: ipv6disable_replaced is not changed
when:
- ipv6disable_replaced is not changed
- "'ipv6.disable' not in ubtu22cis_3_1_1_cmdline_settings.stdout"
notify: Grub update

- name: "3.1.1 | PATCH | Ensure system is checked to determine if IPv6 is enabled | Remove net.ipv6.conf.all.disable_ipv6"
Expand Down