ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

updated

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-07-24 14:01:40 +01:00
parent 06a1f2997c
commit 42aa624d50
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
4 changed files with 36 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tasks/audit_only.yml
View file

@ -1,28 +1,28 @@
--- ---
- name: Audit_Only | Create local Directories for hosts - name: Audit_Only | Create local Directories for hosts
when: fetch_audit_files
ansible.builtin.file: ansible.builtin.file:
mode: '0755' mode: '0755'
path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}" path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
recurse: true recurse: true
state: directory state: directory
when: fetch_audit_files
delegate_to: localhost delegate_to: localhost
become: false become: false
- name: Audit_only | Get audits from systems and put in group dir - name: Audit_only | Get audits from systems and put in group dir
when: fetch_audit_files
ansible.builtin.fetch: ansible.builtin.fetch:
dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/" dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
flat: true flat: true
mode: '0644' mode: '0644'
src: "{{ pre_audit_outfile }}" src: "{{ pre_audit_outfile }}"
when: fetch_audit_files
- name: Audit_only | Show Audit Summary - name: Audit_only | Show Audit Summary
when: when:
- audit_only - audit_only
ansible.builtin.debug: ansible.builtin.debug:
msg: "The Audit results are: {{ pre_audit_summary }}." msg: "{{ audit_results.split('\n') }}"
- name: Audit_only | Stop Playbook Audit Only selected - name: Audit_only | Stop Playbook Audit Only selected
when: when:

7
tasks/pre_remediation_audit.yml
View file

@ -63,16 +63,17 @@
register: goss_available register: goss_available
- name: Pre Audit Setup | If audit ensure goss is available - name: Pre Audit Setup | If audit ensure goss is available
when:
- not goss_available.stat.exists
ansible.builtin.assert: ansible.builtin.assert:
that: goss_available.stat.exists
msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}" msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"
- name: Pre Audit Setup | Copy ansible default vars values to test audit - name: Pre Audit Setup | Copy ansible default vars values to test audit
when:
- run_audit
tags: tags:
- goss_template - goss_template
- run_audit - run_audit
when:
- run_audit
ansible.builtin.template: ansible.builtin.template:
src: ansible_vars_goss.yml.j2 src: ansible_vars_goss.yml.j2
dest: "{{ audit_vars_path }}" dest: "{{ audit_vars_path }}"

10
vars/main.yml
View file

@ -12,9 +12,19 @@ rhel9cis_allowed_crypto_policies_modules:
- 'AD-SUPPORT' - 'AD-SUPPORT'
- 'AD-SUPPORT-LEGACY' - 'AD-SUPPORT-LEGACY'
- 'NO-SHA1' - 'NO-SHA1'
- 'NO-SSHCBC'
- 'NO-SSHETM'
- 'NO-SSHWEAKCIPHER'
- 'NO-SSHWEAKMAC'
- 'NO-WEAKMAC'
# Used to control warning summary # Used to control warning summary
warn_control_list: "" warn_control_list: ""
warn_count: 0 warn_count: 0
gpg_key_package: "{{ ansible_facts.distribution | lower }}-gpg-keys" gpg_key_package: "{{ ansible_facts.distribution | lower }}-gpg-keys"
## Control 6.3.3.x - Audit template
# This variable governs if the auditd logic should be executed(if value is true).
# NOTE: The current default value is likely to be overriden(via 'set_fact') by other further tasks(in sub-section 'Auditd rules').
update_audit_template: false