diff --git a/tasks/audit-cat2.yml b/tasks/audit-cat2.yml index 425ee91..a4230a7 100644 --- a/tasks/audit-cat2.yml +++ b/tasks/audit-cat2.yml @@ -59,12 +59,22 @@ - RHEL-07-040210 - ntp -- name: "MEDIUM | RHEL-07-040180 | PATCH | The operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications." +- name: "MEDIUM | RHEL-07-040180 | AUDIT | The operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications." command: grep -i useldapauth /etc/sysconfig/authconfig register: rhel_07_040180_audit tags: - cat2 - medium - - patch + - audit + - RHEL-07-040180 + - ldap + +- name: "MEDIUM | RHEL-07-040180 | AUDIT | The operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications." + command: systemctl status nails + register: rhel_07_040180_audit + tags: + - cat2 + - medium + - audit - RHEL-07-040180 - ldap diff --git a/tasks/fix-cat2.yml b/tasks/fix-cat2.yml index a757ad1..dd9a722 100644 --- a/tasks/fix-cat2.yml +++ b/tasks/fix-cat2.yml @@ -1210,12 +1210,16 @@ - RHEL-07-040110 - name: "MEDIUM | RHEL-07-040160 | PATCH | All network connections associated with a communication session must be terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements." - command: "true" + lineinfile: + dest: /etc/profile + regexp: ^#?TMOUT + line: TMOUT=600 tags: - cat2 - medium - patch - RHEL-07-040160 + - profile - name: "MEDIUM | RHEL-07-040170 | PATCH | The Standard Mandatory DoD Notice and Consent Banner must be displayed immediately prior to, or as part of, remote access logon prompts." command: "true" @@ -1291,6 +1295,7 @@ - patch - RHEL-07-040210 - ntp + - ntpd - name: "MEDIUM | RHEL-07-040230 | PATCH | The operating system, if using PKI-based authentication, must implement a local cache of revocation data to certificate validation in case of the inability to access revocation information via the network." lineinfile: