Configure Job Schedulers

tasks/amazon_linux.yaml

@@ -0,0 +1,3 @@
+---
+- name: Amazon Linux 2 | Configure Job Schedulers
+  include_tasks: configure_job_schedulers_al2.yaml

tasks/configure_job_schedulers_al2.yaml

@@ -0,0 +1,55 @@
+---
+# Ensure cron daemon is enabled and active
+- name: Ensure cron daemon is enabled and active
+  ansible.builtin.systemd:
+    name: "{{ cron_service }}"
+    masked: no
+    enabled: true
+    state: started
+  become: true
+
+# Ensure permissions on cron directories are configured
+- name: Ensure permissions on cron directories are configured
+  ansible.builtin.file:
+    path: "{{ item }}"
+    owner: root
+    group: root
+    mode: '0700'
+  loop: "{{ cron_dirs }}"
+  become: true
+
+# Ensure permissions on /etc/crontab are configured
+- name: Ensure permissions on crontab file
+  ansible.builtin.file:
+    path: "{{ cron_tab_file }}"
+    owner: root
+    group: root
+    mode: '0600'
+  become: true
+
+# Ensure /etc/cron.allow exists and is properly secured
+- name: Ensure /etc/cron.allow exists and is secured
+  ansible.builtin.file:
+    path: "{{ cron_allow_file }}"
+    state: touch
+    owner: root
+    group: root
+    mode: '0640'
+  become: true
+
+# Check if /etc/cron.deny exists
+- name: Check if /etc/cron.deny exists
+  ansible.builtin.stat:
+    path: "{{ cron_deny_file }}"
+  register: cron_deny_status
+
+# Ensure /etc/cron.deny permissions if file exists
+- name: Ensure /etc/cron.deny permissions if exists
+  ansible.builtin.file:
+    path: "{{ cron_deny_file }}"
+    owner: root
+    group: root
+    mode: '0640'
+  when: cron_deny_status.stat.exists
+  become: true
+

tasks/main.yaml

@@ -2,15 +2,18 @@
 - name: Include CIS Stage Specific vars
   include_vars: cis-{{ cis_Stage }}.yaml
 
-- name: Debian realted Specification
+- name: Debian related Specification
   include_tasks: configure_Debian.yaml
   when:
     ansible_os_family == 'Debian'
 
-- name: Centos realted Specification
+- name: CentOS related Specification
   include_tasks: configure_RedHat.yaml
-  when:
-    ansible_os_family == 'RedHat'
+  when: ansible_os_family == 'RedHat' and ansible_distribution != 'Amazon'
+
+- name: Amazon Linux 2 related Specification
+  include_tasks: amazon_linux.yaml
+  when: ansible_distribution == 'Amazon'
 
 # - name: Special purpose services
 #   include_tasks: services.yaml
@@ -35,3 +38,4 @@
 
 # - name: Ensure dccp and sctp is disabled
 #   include_tasks: network_protocol_and_unusedFilesystem.yaml
+

vars/main.yml

@@ -88,3 +88,16 @@ os_services_name: ['avahi-daemon', 'slapd', 'named', 'cups', 'telnet', 'discard-
 # aide cronjob configuration
 minute_aide_cronjob: '0'
 hour_aide_cronjob: '5'
+
+# Configure job schedulers
+cron_service: crond
+cron_dirs:
+  - /etc/cron.hourly
+  - /etc/cron.daily
+  - /etc/cron.weekly
+  - /etc/cron.monthly
+  - /etc/cron.d
+cron_tab_file: /etc/crontab
+cron_allow_file: /etc/cron.allow
+cron_deny_file: /etc/cron.deny
+