updates for audit section

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/post_remediation_audit.yml

@@ -5,10 +5,10 @@
   changed_when: true
   environment:
       AUDIT_BIN: "{{ audit_bin }}"
-      AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
+      AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
       AUDIT_FILE: goss.yml
 
-- name: Post Audit | Ensure audit files readable by users
+- name: Post Audit | ensure audit files readable by users
   ansible.builtin.file:
       path: "{{ item }}"
       mode: '0644'
@@ -21,14 +21,14 @@
   when:
       - audit_format == "json"
   block:
-      - name: Post Audit | Capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: cat {{ post_audit_outfile }}
-        register: discovered_post_audit
+      - name: capture data {{ post_audit_outfile }}
+        ansible.builtin.shell: "cat {{ post_audit_outfile }}"
+        register: post_audit
         changed_when: false
 
-      - name: Post Audit | Capture post-audit result
+      - name: Capture post-audit result
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ discovered_post_audit.stdout | from_json | json_query(summary) }}"
+            post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}"
         vars:
             summary: summary."summary-line"
 
@@ -36,11 +36,11 @@
   when:
       - audit_format == "documentation"
   block:
-      - name: Post Audit | Capture data {{ post_audit_outfile }}
-        ansible.builtin.shell: tail -2 {{ post_audit_outfile }}
-        register: discovered_post_audit
+      - name: Post Audit | capture data {{ post_audit_outfile }}
+        ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}"
+        register: post_audit
         changed_when: false
 
       - name: Post Audit | Capture post-audit result
         ansible.builtin.set_fact:
-            post_audit_summary: "{{ discovered_post_audit.stdout_lines }}"
+            post_audit_summary: "{{ post_audit.stdout_lines }}"

tasks/pre_remediation_audit.yml

@@ -33,23 +33,25 @@
   when:
       - audit_content == 'copy'
   ansible.builtin.copy:
-      src: "{{ audit_local_copy }}"
+      src: "{{ audit_conf_source }}"
       dest: "{{ audit_conf_dest }}"
       mode: preserve
 
 - name: Pre Audit Setup | Unarchive audit content files on server
   when:
-      - audit_content == 'archived'
+      - audit_content == 'archive'
   ansible.builtin.unarchive:
-      src: "{{ audit_conf_copy  }}"
-      dest: "{{ audit_conf_dir }}"
+      src: "{{ audit_conf_source }}"
+      dest: "{{ audit_conf_dest }}"
 
 - name: Pre Audit Setup | Get audit content from url
   when:
       - audit_content == 'get_url'
-  ansible.builtin.get_url:
-      url: "{{ audit_files_url }}"
-      dest: "{{ audit_conf_dir }}"
+  ansible.builtin.unarchive:
+      src: "{{ audit_conf_source }}"
+      dest: "{{ audit_conf_dest }}/{{ benchmark }}-Audit"
+      remote_src: "{{ ( audit_conf_source is contains ('http'))| ternary(true, false ) }}"
+      extra_opts: "{{ (audit_conf_source is contains ('github')) | ternary('--strip-components=1', [] ) }}"
 
 - name: Pre Audit Setup | Check Goss is available
   when:
@@ -58,19 +60,20 @@
       - name: Pre Audit Setup | Check for goss file
         ansible.builtin.stat:
             path: "{{ audit_bin }}"
-        register: discovered_goss_available
+        register: goss_available
 
       - name: Pre Audit Setup | If audit ensure goss is available
+        when:
+            - not goss_available.stat.exists
         ansible.builtin.assert:
-            that: discovered_goss_available.stat.exists
             msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
 
 - name: Pre Audit Setup | Copy ansible default vars values to test audit
-  when:
-      - run_audit
   tags:
       - goss_template
       - run_audit
+  when:
+      - run_audit
   ansible.builtin.template:
       src: ansible_vars_goss.yml.j2
       dest: "{{ audit_vars_path }}"
@@ -81,7 +84,7 @@
   changed_when: true
   environment:
       AUDIT_BIN: "{{ audit_bin }}"
-      AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
+      AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
       AUDIT_FILE: goss.yml
 
 - name: Pre Audit | Capture audit data if json format
@@ -89,13 +92,13 @@
       - audit_format == "json"
   block:
       - name: Pre Audit | Capture data {{ pre_audit_outfile }}
-        ansible.builtin.shell: cat {{ pre_audit_outfile }}
-        register: discovered_pre_audit
+        ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
+        register: pre_audit
         changed_when: false
 
       - name: Pre Audit | Capture pre-audit result
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ discovered_pre_audit.stdout | from_json | json_query(summary) }}"
+            pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
         vars:
             summary: summary."summary-line"
 
@@ -104,16 +107,15 @@
       - audit_format == "documentation"
   block:
       - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
-        ansible.builtin.shell: tail -2 {{ pre_audit_outfile }}
-        register: discovered_pre_audit
+        ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
+        register: pre_audit
         changed_when: false
 
       - name: Pre Audit | Capture pre-audit result | documentation format
         ansible.builtin.set_fact:
-            pre_audit_summary: "{{ discovered_pre_audit.stdout_lines }}"
+            pre_audit_summary: "{{ pre_audit.stdout_lines }}"
 
 - name: Audit_Only | Run Audit Only
   when:
       - audit_only
-  ansible.builtin.import_tasks:
-      file: audit_only.yml
+  ansible.builtin.import_tasks: audit_only.yml

tasks/section_1/cis_1.3.x.yml

@@ -9,10 +9,6 @@
 
       - name: "1.3.1 | PATCH | Ensure AIDE is installed | Build AIDE DB"
         ansible.builtin.shell: /usr/sbin/aide --init
-        changed_when: false
-        failed_when: false
-        async: 45
-        poll: 0
         args:
             creates: /var/lib/aide/aide.db.new.gz
         when: not ansible_check_mode