mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2026-03-26 06:37:11 +00:00
QA fixes and rollback of audit_only logic
Signed-off-by: Frederick Witty <frederick.witty@gotyto.com>
This commit is contained in:
parent
11becb32c5
commit
71206432be
6 changed files with 9 additions and 37 deletions
|
|
@ -7,30 +7,6 @@
|
|||
ansible.builtin.import_tasks:
|
||||
file: fetch_audit_output.yml
|
||||
|
||||
- name: Audit_only | Capture audit files to control node
|
||||
when:
|
||||
- audit_only
|
||||
- audit_capture_files_dir is defined
|
||||
- audit_capture_files_dir | length > 0
|
||||
block:
|
||||
- name: Audit_only | Ensure capture directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
|
||||
state: directory
|
||||
mode: 'u=rwx,go=rx'
|
||||
become: false
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Audit_only | Copy audit files to capture directory
|
||||
ansible.builtin.fetch:
|
||||
src: "{{ item }}"
|
||||
dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
|
||||
flat: true
|
||||
failed_when: false
|
||||
loop:
|
||||
- "{{ pre_audit_outfile }}"
|
||||
- "{{ post_audit_outfile }}"
|
||||
|
||||
- name: Audit_only | Show Audit Summary
|
||||
when: audit_only
|
||||
ansible.builtin.debug:
|
||||
|
|
|
|||
|
|
@ -214,15 +214,15 @@
|
|||
block:
|
||||
- name: "PRELIM | AUDIT | Discover is wireless adapter on system"
|
||||
ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless
|
||||
register: discover_wireless_adapters
|
||||
register: prelim_wireless_adapters
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
failed_when: discover_wireless_adapters.rc not in [ 0, 1 ]
|
||||
failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ]
|
||||
|
||||
- name: "PRELIM | PATCH | Install Network-Manager | if wireless adapter present"
|
||||
when:
|
||||
- rhel9cis_install_network_manager
|
||||
- discover_wireless_adapters.rc == 0
|
||||
- prelim_wireless_adapters.rc == 0
|
||||
- "'NetworkManager' not in ansible_facts.packages"
|
||||
ansible.builtin.package:
|
||||
name: NetworkManager
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@
|
|||
- name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled"
|
||||
when:
|
||||
- rhel9cis_rule_3_1_2
|
||||
- discover_wireless_adapters.rc == 0
|
||||
- prelim_wireless_adapters.rc == 0
|
||||
tags:
|
||||
- level1-server
|
||||
- patch
|
||||
|
|
|
|||
|
|
@ -195,7 +195,7 @@
|
|||
register: discovered_rsyslog_remote_host
|
||||
notify: Restart rsyslog
|
||||
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client"
|
||||
when: rhel9cis_rule_6_2_3_7
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
@ -208,7 +208,7 @@
|
|||
- NIST800-53R5_AU-12
|
||||
- NIST800-53R5_CM-6
|
||||
block:
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client. | When not log host"
|
||||
when: not rhel9cis_system_is_log_server
|
||||
ansible.builtin.replace:
|
||||
path: /etc/rsyslog.conf
|
||||
|
|
@ -221,7 +221,7 @@
|
|||
- '^(module\(load="imtcp"\))'
|
||||
- '^(input\(type="imtcp")'
|
||||
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
|
||||
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote clients. | When log host"
|
||||
when: rhel9cis_system_is_log_server
|
||||
ansible.builtin.replace:
|
||||
path: /etc/rsyslog.conf
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue