Configure DoD banner on graphical logon screen.

I also included a shell script to do this if I decide in the future it’s cleaner to copy a script, execute it, then remove it.

I also included a handler that “restarts GDM”. The gem-restart command was removed in CentOS 6 so the only way to make the changes appear immediately after these tasks are run is to flop between run levels or press Ctrl+Alt+Backspace from the target host. The bad thing about this is that it kicks out active users with zero warning, so this may be removed in the future.
Task to set default iptables forward policy to DROP.
Add handler to restart iptables.
Reorder DOD login banner tasks.
Change finding ID to ‘?????’ for tasks that I haven’t yet gotten to in the STIG but I’m fairly sure are in there somewhere.
Blacklist bluetooth kernel module
Reduce noise from error message when checking for IPv6 and it is not present.
Add another finding ID to task that copies auditd.conf

Uninstall tftp-server

Add ‘unauthorized_packages’ tag.

It would be more efficient to iterate through a list of unauthorized packages, however this comes at the cost of execution control. If you want to only remove three of the five unauthorized packages because two of them are required in your environment, this would not be possible if all five packages were in a list inside a single task. Open to feedback on a better way to solve this.
Add tasks to disable ypbind, enable crond, remove ypserv package, and disable ICMPv4 redirects.
Set ‘/etc/gshadow’ owner to root with 0000 permissions
Use tabs instead of spaces in lineinfile to be consistent with the existing config file.

Add ‘reload xinetd’ handler
Improve adding secure parameter to tftp-server. Capture existing path and insert ‘-s’ instead of putting the default path back in.

Add ‘rhel6stig_tftp_required’ variable to indicate whether TFTP packages should be removed on not.
Ensure grub.conf is owned by root.
Deny direct root login via ssh
Add variable for password settings used in system-auth-ac.

Target system-auth-ac instead of system-auth because system-auth is just a symlink to system-auth-ac.

Better formatting of multiline names.
Use FIPS 140-2 approved algorithms
Install AIDE since agile integrity tool is required to be installed.

It may be better to set a variable that is the name of the file integrity package and pass that to the yum module since there are many other file integrity tools than AIDE.
Use template for configuring system-auth-ac
Run AIDE check periodically
rsyslog generated files must be owned by root
Clean up formatting of multiline name fields
Blacklist TIPC, SCTP, and DCCP modules
Stop and disable bluetooth