Addressed #381

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
ansible-lockdown · Jun 18, 2024 · 0148023 · 0148023
1 parent 3f53f49
commit 0148023
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/tasks/prelim.yml b/tasks/prelim.yml
@@ -208,7 +208,7 @@
 - name: "PRELIM | Optional | If IPv6 disable to stop chronyd listening"
   ansible.builtin.lineinfile:
       path: /etc/sysconfig/chronyd
-      regexp: ^OPTIONS="(.*)"
+      regexp: '^OPTIONS="(?!.* -4.*)(.*)"'
       line: OPTIONS="\1 -4"
       backrefs: true
   notify: restart chronyd

diff --git a/tasks/section_2/cis_2.1.x.yml b/tasks/section_2/cis_2.1.x.yml
@@ -22,17 +22,18 @@
             dest: /etc/chrony.conf
             owner: root
             group: root
-            mode: 0644
+            mode: '0644'
         when: rhel8cis_chrony_ansible_managed
 
       - name: "2.1.2 | PATCH | Ensure chrony is configured | modify /etc/sysconfig/chronyd"
         ansible.builtin.lineinfile:
             path: /etc/sysconfig/chronyd
-            regexp: OPTIONS=\"(.*)(?!-u chrony)(.*)"
-            line: OPTIONS="\1\2 -u chrony"
+            regexp: '^OPTIONS="(?!.* -u chrony.*)(.*)"'
+            line: OPTIONS="\1 -u chrony"
             create: true
             backrefs: true
             mode: '0644'
+        notify: restart chronyd
 
   when:
       - rhel8cis_time_synchronization == "chrony"