Add GH Action to check if there is a change in Ansible shell module u…

[mildas]

…sage

Description:

• Description here. Replace this text. Don't use the italics format!

Rationale:

• Rationale here. Replace this text. Don't use the italics format!

• Fixes # Issue number here (e.g. Updating sysctl XCCDF naming ComplianceAsCode/content#26) or remove this line if no issue exists.

Review Hints:

• Review hints here. Replace this text. Don't use the italics format!

• Use this optional section to give any relevant information which could help the reviewer to more quickly and assertively understand and test the changes.

• Good examples are useful commands, if it is better to review all commits together or in a suggested sequence, any relevant discussion in other PRs or issues, etc.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -2,6 +2,10 @@
 if rpm --quiet -q pam; then
 
 var_password_pam_unix_remember=''
+
+
+
+
 
 
 if [ -f /usr/bin/authselect ]; then

OVAL for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- oval:ssg-accounts_passwords_pam_faillock_interval:def:1
+++ oval:ssg-accounts_passwords_pam_faillock_interval:def:1
@@ -1,19 +1,19 @@
 criteria AND
 criteria AND
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_unix_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_unix_auth:tst:1
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system_pam_faillock_account:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_auth:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password_pam_faillock_account:tst:1
 criteria OR
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_system:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_pamd_password:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_faillock_conf:tst:1
 criteria AND
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1
-criterion oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_system:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_no_pamd_password:tst:1
+criterion oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_parameter_faillock_conf:tst:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth'.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -10,8 +10,10 @@
 In file /etc/pam.d/password-auth append rounds='xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds'
          
 to the pam_unix.so entry, as shown below:
+
 password sufficient pam_unix.so ...existing_options... rounds='xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds'
          
+
 The system's default number of rounds is 5000.
 
 [warning]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1
+++ ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1
@@ -1,6 +1,7 @@
 To verify the number of rounds for the password hashing algorithm is configured, run the following command:
 $ sudo grep rounds /etc/pam.d/password-auth
 The output should show the following match:
+
 password sufficient pam_unix.so sha512 rounds=
       Is it the case that rounds is not set to <sub idref="var_password_pam_unix_rounds" /> or is commented out?