QA fixes and rollback of audit_only logic

Signed-off-by: Frederick Witty <frederick.witty@gotyto.com>
This commit is contained in:
Frederick Witty 2026-02-11 14:54:30 -05:00
parent 11becb32c5
commit 71206432be
No known key found for this signature in database
GPG key ID: 0CFA99C02DE4D8C3
6 changed files with 9 additions and 37 deletions

View file

@ -7,30 +7,6 @@
ansible.builtin.import_tasks:
file: fetch_audit_output.yml
- name: Audit_only | Capture audit files to control node
when:
- audit_only
- audit_capture_files_dir is defined
- audit_capture_files_dir | length > 0
block:
- name: Audit_only | Ensure capture directory exists
ansible.builtin.file:
path: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}"
state: directory
mode: 'u=rwx,go=rx'
become: false
delegate_to: localhost
- name: Audit_only | Copy audit files to capture directory
ansible.builtin.fetch:
src: "{{ item }}"
dest: "{{ audit_capture_files_dir }}/{{ inventory_hostname }}/"
flat: true
failed_when: false
loop:
- "{{ pre_audit_outfile }}"
- "{{ post_audit_outfile }}"
- name: Audit_only | Show Audit Summary
when: audit_only
ansible.builtin.debug:

View file

@ -214,15 +214,15 @@
block:
- name: "PRELIM | AUDIT | Discover is wireless adapter on system"
ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless
register: discover_wireless_adapters
register: prelim_wireless_adapters
changed_when: false
check_mode: false
failed_when: discover_wireless_adapters.rc not in [ 0, 1 ]
failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ]
- name: "PRELIM | PATCH | Install Network-Manager | if wireless adapter present"
when:
- rhel9cis_install_network_manager
- discover_wireless_adapters.rc == 0
- prelim_wireless_adapters.rc == 0
- "'NetworkManager' not in ansible_facts.packages"
ansible.builtin.package:
name: NetworkManager

View file

@ -44,7 +44,7 @@
- name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled"
when:
- rhel9cis_rule_3_1_2
- discover_wireless_adapters.rc == 0
- prelim_wireless_adapters.rc == 0
tags:
- level1-server
- patch

View file

@ -195,7 +195,7 @@
register: discovered_rsyslog_remote_host
notify: Restart rsyslog
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client"
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client"
when: rhel9cis_rule_6_2_3_7
tags:
- level1-server
@ -208,7 +208,7 @@
- NIST800-53R5_AU-12
- NIST800-53R5_CM-6
block:
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote client. | When not log host"
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote client. | When not log host"
when: not rhel9cis_system_is_log_server
ansible.builtin.replace:
path: /etc/rsyslog.conf
@ -221,7 +221,7 @@
- '^(module\(load="imtcp"\))'
- '^(input\(type="imtcp")'
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to recieve logs from a remote clients. | When log host"
- name: "6.2.3.7 | PATCH | Ensure rsyslog is not configured to receive logs from a remote clients. | When log host"
when: rhel9cis_system_is_log_server
ansible.builtin.replace:
path: /etc/rsyslog.conf