53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
---
|
|
- name: Remove existing ctrl-alt-del.target symlink
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/ctrl-alt-del.target
|
|
state: absent
|
|
|
|
- name: "Mask Ctrl+Alt+Del target to prevent reboot"
|
|
when: "linux_ctrl_alt_del_enabled | bool"
|
|
ansible.builtin.systemd:
|
|
name: "ctrl-alt-del.target"
|
|
masked: true
|
|
state: "stopped"
|
|
register: "cad_mask_result"
|
|
ignore_errors: true
|
|
|
|
# FIX: create the .target.d/ drop-in directory before writing into it.
|
|
# ansible.builtin.copy does NOT create missing parent directories.
|
|
- name: "Ensure ctrl-alt-del.target.d drop-in directory exists"
|
|
when: "linux_ctrl_alt_del_enabled | bool"
|
|
ansible.builtin.file:
|
|
path: "/etc/systemd/system/ctrl-alt-del.target.d"
|
|
state: "directory"
|
|
mode: "0755"
|
|
owner: "root"
|
|
group: "root"
|
|
|
|
- name: "Deploy ctrl-alt-del override to reinforce mask"
|
|
when: "linux_ctrl_alt_del_enabled | bool"
|
|
ansible.builtin.copy:
|
|
content: "[Unit]\nDescription=Ctrl-Alt-Del disabled by CyberAar hardening\n"
|
|
dest: "/etc/systemd/system/ctrl-alt-del.target.d/override.conf"
|
|
mode: "0644"
|
|
owner: "root"
|
|
group: "root"
|
|
register: "cad_override_result"
|
|
|
|
- name: "Reload systemd daemon after mask/override"
|
|
when: "cad_mask_result.changed or cad_override_result.changed"
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: "Verify Ctrl+Alt+Del mask status (verbosity >=1)" # noqa: command-instead-of-module
|
|
when: "ansible_verbosity >= 1"
|
|
ansible.builtin.command: "systemctl is-enabled ctrl-alt-del.target"
|
|
changed_when: false
|
|
register: "cad_status"
|
|
failed_when: false
|
|
|
|
- name: "Show Ctrl+Alt+Del mask status"
|
|
when: "ansible_verbosity >= 1"
|
|
ansible.builtin.debug:
|
|
msg: "ctrl-alt-del.target status: {{ cad_status.stdout | default('unknown') }}"
|