Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Grub passwd update #98

Merged
merged 4 commits into from
Sep 22, 2023
Merged

Grub passwd update #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8223dc8
updated for grub password settings
uk-bolly Sep 21, 2023
c9881b9
updated
uk-bolly Sep 22, 2023
d236a18
updated
uk-bolly Sep 22, 2023
7b9281e
updated template for bootloader hash
uk-bolly Sep 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
- README new layout

- Added test for rule 4.3.4 check user is using sudo has password set before NOPASSWD removed from sudoers
- grub password check update thanks to @Acenl12 on discord

## V1.0.1 - based upon CIS 1.1.0

Expand Down
5 changes: 4 additions & 1 deletion defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -477,7 +477,10 @@ ubtu20cis_set_grub_password: true
ubtu20cis_grub_user_file: /etc/grub.d/40_custom
ubtu20cis_grub_user: root
ubtu20cis_grub_file: /boot/grub/grub.cfg
ubtu20cis_bootloader_password_hash: "grub.pbkdf2.sha512.10000" # pragma: allowlist secret

# This is used to set the password in grub the full string is required.
# It is suggested that this variable is overridden by your setup e.g. inventory/ groupvars / vaults etc
ubtu20cis_bootloader_password_hash: "grub.pbkdf2.sha512.10000.ChangeMe" # pragma: allowlist secret

# Change the following value to true if you wish to be prompted to get past grub bootloader
ubtu20cis_ask_passwd_to_boot: false
Expand Down
4 changes: 2 additions & 2 deletions tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@
- name: Ensure grub password has been changed
ansible.builtin.assert:
that:
- '"ChangeMe" not in ubtu20cis_grub_pw'
- '"grub.pbkdf2.sha512.1000" in ubtu20cis_grub_pw'
- '"ChangeMe" not in ubtu20cis_bootloader_password_hash'
- '"grub.pbkdf2.sha512.1000" in ubtu20cis_bootloader_password_hash'
fail_msg: "The default grub password has not been changed"
when:
- ubtu20cis_set_grub_password
Expand Down
2 changes: 1 addition & 1 deletion templates/ansible_vars_goss.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,7 +373,7 @@ ubtu20cis_allow_autofs: {{ ubtu20cis_allow_autofs }}
ubtu20cis_grub_conf_file: /boot/grub/grub.cfg
ubtu20cis_grub_user_file: {{ ubtu20cis_grub_user_file }}
ubtu20cis_grub_username: {{ ubtu20cis_grub_user }}
ubtu20cis_grub_hash: {{ ubtu20cis_grub_pw }}
ubtu20cis_grub_hash: {{ ubtu20cis_bootloader_password_hash }}

ubtu20cis_root_pw: {{ ubtu20cis_root_pw }}

Expand Down