Made some changes to CAT II

defaults/main.yml

@@ -29,3 +29,6 @@ rhel7stig_snmp_community: Endgam3Ladyb0g
 # system is a router. This variable is used in tasks that should not be run
 # if the OS is run as a router. (must override to yes)
 rhel7stig_system_is_router: no
+
+#RHEL-07-040560 An X Windows display manager must not be installed unless approved.
+rhel7stig_x11: no

tasks/audit-cat2.yml

@@ -1,5 +1,10 @@
 - name: "MEDIUM | RHEL-07-040640 | AUDIT | The SSH public host key files must have mode 0644 or less permissive."
-  command: find / -name '*.pub'
+  find:
+      paths: /
+      recurse: yes
+      file_type: file
+      patterns: '*.pub'
+      hidden: true
   failed_when: no
   changed_when: no
   ignore_errors: yes
@@ -10,6 +15,7 @@
       - audit
       - RHEL-07-040640
       - always
+      - ssh
 
 - name: "MEDIUM | RHEL-07-040650 | AUDIT | The SSH private host key files must have mode 0600 or less permissive."
   find:
@@ -28,3 +34,16 @@
       - audit
       - RHEL-07-040650
       - always
+      - ssh
+
+- name: "MEDIUM | RHEL-07-040230 | AUDIT | The operating system, if using PKI-based authentication, must implement a local cache of revocation data to certificate validation in case of the inability to access revocation information via the network."
+  stat:
+      path: /var/lib/pki-kra/conf/server.xml
+  register: rhel_07_040230_audit
+  tags:
+      - cat2
+      - medium
+      - audit
+      - RHEL-07-040230
+      - always
+      - pki